Series comparison

-[Qemu-devel] [PULL 00/15] tcg patch queue
+[PULL 00/11] tcg patch queue
-The following changes since commit 3284aa128153750f14a61e8a96fd085e6f2999b6:
+The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
-  Merge remote-tracking branch 'remotes/lersek/tags/edk2-pull-2019-04-22' into staging (2019-04-24 13:19:41 +0100)
+  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20190426
+  https://github.com/rth7680/qemu.git tags/pull-tcg-20201008
-for you to fetch changes up to ef5dae6805cce7b59d129d801bdc5db71bcbd60d:
+for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:
-  cputlb: Fix io_readx() to respect the access_type (2019-04-25 10:40:06 -0700)
+  accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)
 ----------------------------------------------------------------
-Add tcg_gen_extract2_*.
+Extend maximum gvec vector size
-Deal with overflow of TranslationBlocks.
+Fix i386 avx2 dupi
-Respect access_type in io_readx.
+Fix mips host user-only write detection
 Misc cleanups.
 ----------------------------------------------------------------
-David Hildenbrand (1):
+Kele Huang (1):
-      tcg: Implement tcg_gen_extract2_{i32,i64}
+      accel/tcg: Fix computing of is_write for MIPS
-Richard Henderson (13):
+Richard Henderson (10):
-      tcg: Add INDEX_op_extract2_{i32,i64}
+      tcg: Adjust simd_desc size encoding
-      tcg: Use deposit and extract2 in tcg_gen_shifti_i64
+      tcg: Drop union from TCGArgConstraint
-      tcg: Use extract2 in tcg_gen_deposit_{i32,i64}
+      tcg: Move sorted_args into TCGArgConstraint.sort_index
-      tcg/i386: Support INDEX_op_extract2_{i32,i64}
+      tcg: Remove TCG_CT_REG
-      tcg/arm: Support INDEX_op_extract2_i32
+      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
-      tcg/aarch64: Support INDEX_op_extract2_{i32,i64}
+      tcg: Remove TCGOpDef.used
-      tcg: Hoist max_insns computation to tb_gen_code
+      tcg/i386: Fix dupi for avx2 32-bit hosts
-      tcg: Restart after TB code generation overflow
+      tcg: Fix generation of dupi_vec for 32-bit host
-      tcg: Restart TB generation after relocation overflow
+      tcg/optimize: Fold dup2_vec
-      tcg: Restart TB generation after constant pool overflow
+      tcg: Remove TCG_TARGET_HAS_cmp_vec
       tcg: Restart TB generation after out-of-line ldst overflow
       tcg/ppc: Allow the constant pool to overflow at 32k
       tcg/arm: Restrict constant pool displacement to 12 bits
-Shahab Vahedi (1):
+ include/tcg/tcg-gvec-desc.h  | 38 ++++++++++++------
-      cputlb: Fix io_readx() to respect the access_type
+ include/tcg/tcg.h            | 22 ++++------
  tcg/aarch64/tcg-target.h     |  1 -
  tcg/i386/tcg-target.h        |  1 -
  tcg/ppc/tcg-target.h         |  1 -
  accel/tcg/user-exec.c        | 43 ++++++++++++++++++--
  tcg/optimize.c               | 15 +++++++
  tcg/tcg-op-gvec.c            | 35 ++++++++++++----
  tcg/tcg-op-vec.c             | 12 ++++--
  tcg/tcg.c                    | 96 +++++++++++++++++++-------------------------
  tcg/aarch64/tcg-target.c.inc | 17 ++++----
  tcg/arm/tcg-target.c.inc     | 29 ++++++-------
  tcg/i386/tcg-target.c.inc    | 39 +++++++-----------
  tcg/mips/tcg-target.c.inc    | 21 +++++-----
  tcg/ppc/tcg-target.c.inc     | 29 ++++++-------
  tcg/riscv/tcg-target.c.inc   | 16 ++++----
  tcg/s390/tcg-target.c.inc    | 22 +++++-----
  tcg/sparc/tcg-target.c.inc   | 21 ++++------
  tcg/tci/tcg-target.c.inc     |  3 +-
 files changed, 244 insertions(+), 217 deletions(-)
- include/exec/exec-all.h       |   4 +-
- include/exec/translator.h     |   3 +-
- tcg/aarch64/tcg-target.h      |   2 +
- tcg/arm/tcg-target.h          |   1 +
- tcg/i386/tcg-target.h         |   2 +
- tcg/mips/tcg-target.h         |   2 +
- tcg/ppc/tcg-target.h          |   2 +
- tcg/riscv/tcg-target.h        |   2 +
- tcg/s390/tcg-target.h         |   2 +
- tcg/sparc/tcg-target.h        |   2 +
- tcg/tcg-op.h                  |   6 ++
- tcg/tcg-opc.h                 |   2 +
- tcg/tcg.h                     |  16 +++---
- tcg/tci/tcg-target.h          |   2 +
- accel/tcg/cputlb.c            |   5 +-
- accel/tcg/translate-all.c     |  53 ++++++++++++++---
- accel/tcg/translator.c        |  15 +----
- target/alpha/translate.c      |   4 +-
- target/arm/translate.c        |   4 +-
- target/cris/translate.c       |  10 +---
- target/hppa/translate.c       |   5 +-
- target/i386/translate.c       |   4 +-
- target/lm32/translate.c       |  10 +---
- target/m68k/translate.c       |   4 +-
- target/microblaze/translate.c |  10 +---
- target/mips/translate.c       |   4 +-
- target/moxie/translate.c      |  11 +---
- target/nios2/translate.c      |  14 +----
- target/openrisc/translate.c   |   4 +-
- target/ppc/translate.c        |   4 +-
- target/riscv/translate.c      |   4 +-
- target/s390x/translate.c      |   4 +-
- target/sh4/translate.c        |   4 +-
- target/sparc/translate.c      |   4 +-
- target/tilegx/translate.c     |  12 +---
- target/tricore/translate.c    |  16 +-----
- target/unicore32/translate.c  |  10 +---
- target/xtensa/translate.c     |   4 +-
- tcg/aarch64/tcg-target.inc.c  |  27 +++++++--
- tcg/arm/tcg-target.inc.c      |  98 ++++++++++++++++++--------------
- tcg/i386/tcg-target.inc.c     |  17 +++++-
- tcg/mips/tcg-target.inc.c     |   6 +-
- tcg/optimize.c                |  16 ++++++
- tcg/ppc/tcg-target.inc.c      |  42 +++++++-------
- tcg/riscv/tcg-target.inc.c    |  16 ++++--
- tcg/s390/tcg-target.inc.c     |  20 ++++---
- tcg/tcg-ldst.inc.c            |  18 +++---
- tcg/tcg-op.c                  | 129 +++++++++++++++++++++++++++++++++---------
- tcg/tcg-pool.inc.c            |  12 ++--
- tcg/tcg.c                     |  85 +++++++++++++++-------------
- tcg/README                    |   7 +++
-files changed, 451 insertions(+), 309 deletions(-)

-[Qemu-devel] [PULL 01/15] tcg: Implement tcg_gen_extract2_{i32, i64}
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Will be helpful for s390x. Input 128 bit and output 64 bit only,
-which is sufficient for now.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Message-Id: <20190225154204.26751-1-david@redhat.com>
-[rth: Add matching tcg_gen_extract2_i32.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.h |  6 ++++++
- tcg/tcg-op.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
-files changed, 50 insertions(+)
-diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.h
-+++ b/tcg/tcg-op.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
-                          unsigned int ofs, unsigned int len);
- void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
-                           unsigned int ofs, unsigned int len);
-+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
-+                          unsigned int ofs);
- void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, TCGLabel *);
- void tcg_gen_brcondi_i32(TCGCond cond, TCGv_i32 arg1, int32_t arg2, TCGLabel *);
- void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
-                          unsigned int ofs, unsigned int len);
- void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
-                           unsigned int ofs, unsigned int len);
-+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
-+                          unsigned int ofs);
- void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, TCGLabel *);
- void tcg_gen_brcondi_i64(TCGCond cond, TCGv_i64 arg1, int64_t arg2, TCGLabel *);
- void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
- #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i64
- #define tcg_gen_extract_tl tcg_gen_extract_i64
- #define tcg_gen_sextract_tl tcg_gen_sextract_i64
-+#define tcg_gen_extract2_tl tcg_gen_extract2_i64
- #define tcg_const_tl tcg_const_i64
- #define tcg_const_local_tl tcg_const_local_i64
- #define tcg_gen_movcond_tl tcg_gen_movcond_i64
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
- #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i32
- #define tcg_gen_extract_tl tcg_gen_extract_i32
- #define tcg_gen_sextract_tl tcg_gen_sextract_i32
-+#define tcg_gen_extract2_tl tcg_gen_extract2_i32
- #define tcg_const_tl tcg_const_i32
- #define tcg_const_local_tl tcg_const_local_i32
- #define tcg_gen_movcond_tl tcg_gen_movcond_i32
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
-     tcg_gen_sari_i32(ret, ret, 32 - len);
- }
-+/*
-+ * Extract 32-bits from a 64-bit input, ah:al, starting from ofs.
-+ * Unlike tcg_gen_extract_i32 above, len is fixed at 32.
-+ */
-+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
-+                          unsigned int ofs)
-+{
-+    tcg_debug_assert(ofs <= 32);
-+    if (ofs == 0) {
-+        tcg_gen_mov_i32(ret, al);
-+    } else if (ofs == 32) {
-+        tcg_gen_mov_i32(ret, ah);
-+    } else if (al == ah) {
-+        tcg_gen_rotri_i32(ret, al, ofs);
-+    } else {
-+        TCGv_i32 t0 = tcg_temp_new_i32();
-+        tcg_gen_shri_i32(t0, al, ofs);
-+        tcg_gen_deposit_i32(ret, t0, ah, 32 - ofs, ofs);
-+        tcg_temp_free_i32(t0);
-+    }
-+}
-+
- void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
-                          TCGv_i32 c2, TCGv_i32 v1, TCGv_i32 v2)
- {
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
-     tcg_gen_sari_i64(ret, ret, 64 - len);
- }
-+/*
-+ * Extract 64 bits from a 128-bit input, ah:al, starting from ofs.
-+ * Unlike tcg_gen_extract_i64 above, len is fixed at 64.
-+ */
-+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
-+                          unsigned int ofs)
-+{
-+    tcg_debug_assert(ofs <= 64);
-+    if (ofs == 0) {
-+        tcg_gen_mov_i64(ret, al);
-+    } else if (ofs == 64) {
-+        tcg_gen_mov_i64(ret, ah);
-+    } else if (al == ah) {
-+        tcg_gen_rotri_i64(ret, al, ofs);
-+    } else {
-+        TCGv_i64 t0 = tcg_temp_new_i64();
-+        tcg_gen_shri_i64(t0, al, ofs);
-+        tcg_gen_deposit_i64(ret, t0, ah, 64 - ofs, ofs);
-+        tcg_temp_free_i64(t0);
-+    }
-+}
-+
- void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
-                          TCGv_i64 c2, TCGv_i64 v1, TCGv_i64 v2)
- {
---
-.17.1

-[Qemu-devel] [PULL 14/15] tcg/arm: Restrict constant pool displacement to 12 bits
+[PULL 01/11] tcg: Adjust simd_desc size encoding
-This will not necessarily restrict the size of the TB, since for v7
+With larger vector sizes, it turns out oprsz == maxsz, and we only
-the majority of constant pool usage is for calls from the out-of-line
+need to represent mismatch for oprsz <= 32.  We do, however, need
-ldst code, which is already at the end of the TB.  But this does
+to represent larger oprsz and do so without reducing SIMD_DATA_BITS.
 allow us to save one insn per reference on the off-chance.
+Reduce the size of the oprsz field and increase the maxsz field.
+Steal the oprsz value of 24 to indicate equality with maxsz.
+Tested-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/arm/tcg-target.inc.c | 57 +++++++++++++++-------------------------
+ include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
-file changed, 21 insertions(+), 36 deletions(-)
+ tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 files changed, 52 insertions(+), 21 deletions(-)
-diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
+diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.inc.c
+--- a/include/tcg/tcg-gvec-desc.h
-+++ b/tcg/arm/tcg-target.inc.c
++++ b/include/tcg/tcg-gvec-desc.h
-@@ -XXX,XX +XXX,XX @@ static inline bool reloc_pc24(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
+@@ -XXX,XX +XXX,XX @@
-     return false;
+ #ifndef TCG_TCG_GVEC_DESC_H
- }
+ #define TCG_TCG_GVEC_DESC_H
-+static inline bool reloc_pc13(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
+-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
-+{
+-#define SIMD_OPRSZ_SHIFT   0
-+    ptrdiff_t offset = tcg_ptr_byte_diff(target, code_ptr) - 8;
+-#define SIMD_OPRSZ_BITS    5
-+
++/*
-+    if (offset >= -0xfff && offset <= 0xfff) {
++ * This configuration allows MAXSZ to represent 2048 bytes, and
-+        tcg_insn_unit insn = *code_ptr;
++ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
-+        bool u = (offset >= 0);
++ *
-+        if (!u) {
++ * Encode this with:
-+            offset = -offset;
++ *   0, 1, 3 -> 8, 16, 32
-+        }
++ *   2       -> maxsz
-+        insn = deposit32(insn, 23, 1, u);
++ *
-+        insn = deposit32(insn, 0, 12, offset);
++ * This steals the input that would otherwise map to 24 to match maxsz.
-+        *code_ptr = insn;
++ */
-+        return true;
++#define SIMD_MAXSZ_SHIFT   0
-+    }
++#define SIMD_MAXSZ_BITS    8
-+    return false;
 -#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 -#define SIMD_MAXSZ_BITS    5
 +#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
 +#define SIMD_OPRSZ_BITS    2
 -#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
 +#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
  #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
  /* Create a descriptor from components.  */
  uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 -/* Extract the operation size from a descriptor.  */
 -static inline intptr_t simd_oprsz(uint32_t desc)
 -{
 -    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
 -}
 -
  /* Extract the max vector size from a descriptor.  */
  static inline intptr_t simd_maxsz(uint32_t desc)
  {
 -    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
 +    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
 +}
 +
- static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
++/* Extract the operation size from a descriptor.  */
-                         intptr_t value, intptr_t addend)
++static inline intptr_t simd_oprsz(uint32_t desc)
 +{
 +    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
 +    intptr_t o = f * 8 + 8;
 +    intptr_t m = simd_maxsz(desc);
 +    return f == 2 ? m : o;
  }
  /* Extract the operation-specific data from a descriptor.  */
 diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op-gvec.c
 +++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
     of the operand offsets so that we can check them all at once.  */
  static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
  {
-@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
+-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-     if (type == R_ARM_PC24) {
+-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
-         return reloc_pc24(code_ptr, (tcg_insn_unit *)value);
+-    tcg_debug_assert(oprsz > 0);
-     } else if (type == R_ARM_PC13) {
+-    tcg_debug_assert(oprsz <= maxsz);
--        intptr_t diff = value - (uintptr_t)(code_ptr + 2);
+-    tcg_debug_assert((oprsz & opr_align) == 0);
--        tcg_insn_unit insn = *code_ptr;
++    uint32_t max_align;
--        bool u;
++
--
++    switch (oprsz) {
--        if (diff >= -0xfff && diff <= 0xfff) {
++    case 8:
--            u = (diff >= 0);
++    case 16:
--            if (!u) {
++    case 32:
--                diff = -diff;
++        tcg_debug_assert(oprsz <= maxsz);
--            }
++        break;
--        } else {
++    default:
--            int rd = extract32(insn, 12, 4);
++        tcg_debug_assert(oprsz == maxsz);
--            int rt = rd == TCG_REG_PC ? TCG_REG_TMP : rd;
++        break;
--
++    }
--            if (diff < 0x1000 || diff >= 0x100000) {
++    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
--                return false;
++
--            }
++    max_align = maxsz >= 16 ? 15 : 7;
--
+     tcg_debug_assert((maxsz & max_align) == 0);
--            /* add rt, pc, #high */
+     tcg_debug_assert((ofs & max_align) == 0);
 -            *code_ptr++ = ((insn & 0xf0000000) | (1 << 25) | ARITH_ADD
 -                           | (TCG_REG_PC << 16) | (rt << 12)
 -                           | (20 << 7) | (diff >> 12));
 -            /* ldr rd, [rt, #low] */
 -            insn = deposit32(insn, 12, 4, rt);
 -            diff &= 0xfff;
 -            u = 1;
 -        }
 -        insn = deposit32(insn, 23, 1, u);
 -        insn = deposit32(insn, 0, 12, diff);
 -        *code_ptr = insn;
 +        return reloc_pc13(code_ptr, (tcg_insn_unit *)value);
      } else {
          g_assert_not_reached();
      }
 -    return true;
  }
+@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
  #define TCG_CT_CONST_ARM  0x100
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld8s_r(TCGContext *s, int cond, TCGReg rt,
  static void tcg_out_movi_pool(TCGContext *s, int cond, int rd, uint32_t arg)
  {
--    /* The 12-bit range on the ldr insn is sometimes a bit too small.
+     uint32_t desc = 0;
--       In order to get around that we require two insns, one of which
--       will usually be a nop, but may be replaced in patch_reloc.  */
+-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
-     new_pool_label(s, arg, R_ARM_PC13, s->code_ptr, 0);
+-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-     tcg_out_ld32_12(s, cond, rd, TCG_REG_PC, 0);
+-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
--    tcg_out_nop(s);
++    check_size_align(oprsz, maxsz, 0);
- }
++    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
- static void tcg_out_movi32(TCGContext *s, int cond, int rd, uint32_t arg)
+     oprsz = (oprsz / 8) - 1;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *addr)
+     maxsz = (maxsz / 8) - 1;
-         tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
++
-         tcg_out_blx(s, COND_AL, TCG_REG_TMP);
++    /*
-     } else {
++     * We have just asserted in check_size_align that either
--        /* ??? Know that movi_pool emits exactly 2 insns.  */
++     * oprsz is {8,16,32} or matches maxsz.  Encode the final
--        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 4);
++     * case with '2', as that would otherwise map to 24.
-+        /* ??? Know that movi_pool emits exactly 1 insn.  */
++     */
-+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 0);
++    if (oprsz == maxsz) {
-         tcg_out_movi_pool(s, COND_AL, TCG_REG_PC, addri);
++        oprsz = 2;
-     }
++    }
- }
++
      desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
      desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
      desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 09/15] tcg: Restart after TB code generation overflow
+[PULL 02/11] tcg: Drop union from TCGArgConstraint
-If a TB generates too much code, try again with fewer insns.
+The union is unused; let "regs" appear in the main structure
 without the "u.regs" wrapping.
-Fixes: https://bugs.launchpad.net/bugs/1824853
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.c | 38 ++++++++++++++++++++++++++++++++------
+ include/tcg/tcg.h            |  4 +---
- tcg/tcg.c                 |  4 ++++
+ tcg/tcg.c                    | 22 +++++++++++-----------
-files changed, 36 insertions(+), 6 deletions(-)
+ tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
  tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
  tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
  tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
  tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
  tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
  tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
  tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
  tcg/tci/tcg-target.c.inc     |  2 +-
 files changed, 91 insertions(+), 93 deletions(-)
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
+--- a/include/tcg/tcg.h
-+++ b/accel/tcg/translate-all.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
-     tb->cflags = cflags;
+ typedef struct TCGArgConstraint {
-     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+     uint16_t ct;
-     tcg_ctx->tb_cflags = cflags;
+     uint8_t alias_index;
-+ tb_overflow:
+-    union {
+-        TCGRegSet regs;
- #ifdef CONFIG_PROFILER
+-    } u;
-     /* includes aborted translations because of exceptions */
++    TCGRegSet regs;
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
+ } TCGArgConstraint;
-     ti = profile_getclock();
- #endif
+ #define TCG_MAX_OP_ARGS 16
 -    /* ??? Overflow could be handled better here.  In particular, we
 -       don't need to re-do gen_intermediate_code, nor should we re-do
 -       the tcg optimization currently hidden inside tcg_gen_code.  All
 -       that should be required is to flush the TBs, allocate a new TB,
 -       re-initialize it per above, and re-do the actual code generation.  */
      gen_code_size = tcg_gen_code(tcg_ctx, tb);
      if (unlikely(gen_code_size < 0)) {
 -        goto buffer_overflow;
 +        switch (gen_code_size) {
 +        case -1:
 +            /*
 +             * Overflow of code_gen_buffer, or the current slice of it.
 +             *
 +             * TODO: We don't need to re-do gen_intermediate_code, nor
 +             * should we re-do the tcg optimization currently hidden
 +             * inside tcg_gen_code.  All that should be required is to
 +             * flush the TBs, allocate a new TB, re-initialize it per
 +             * above, and re-do the actual code generation.
 +             */
 +            goto buffer_overflow;
 +
 +        case -2:
 +            /*
 +             * The code generated for the TranslationBlock is too large.
 +             * The maximum size allowed by the unwind info is 64k.
 +             * There may be stricter constraints from relocations
 +             * in the tcg backend.
 +             *
 +             * Try again with half as many insns as we attempted this time.
 +             * If a single insn overflows, there's a bug somewhere...
 +             */
 +            max_insns = tb->icount;
 +            assert(max_insns > 1);
 +            max_insns /= 2;
 +            goto tb_overflow;
 +
 +        default:
 +            g_assert_not_reached();
 +        }
      }
      search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
      if (unlikely(search_size < 0)) {
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
+@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
-         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
+             return 0;
-             return -1;
+         n = 0;
          for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
 -            if (tcg_regset_test_reg(arg_ct->u.regs, i))
 +            if (tcg_regset_test_reg(arg_ct->regs, i))
                  n++;
          }
-+        /* Test for TB overflow, as seen by gen_insn_end_off.  */
-+        if (unlikely(tcg_current_code_size(s) > UINT16_MAX)) {
-+            return -2;
-+        }
      }
-     tcg_debug_assert(num_insns >= 0);
+@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
-     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
+             /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].u.regs = 0;
 +            def->args_ct[i].regs = 0;
              def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      pset = la_temp_pref(ts);
                      set = *pset;
 -                    set &= ct->u.regs;
 +                    set &= ct->regs;
                      if (ct->ct & TCG_CT_IALIAS) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
                      if (set == 0) {
 -                        set = ct->u.regs;
 +                        set = ct->regs;
                      }
                      *pset = set;
                  }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
          return;
      }
 -    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
 -    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
 +    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
 +    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
      /* Allocate the output register now.  */
      if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              }
          }
 -        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
 +        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
          reg = ts->reg;
 -        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
 +        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
              /* nothing to do : the constraint is satisfied */
          } else {
          allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 and move the temporary register into it */
              temp_load(s, ts, tcg_target_available_regs[ts->type],
                        i_allocated_regs, 0);
 -            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
 +            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                  o_preferred_regs, ts->indirect_base);
              if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                  /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                  && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
              } else if (arg_ct->ct & TCG_CT_NEWREG) {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              } else {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              }
              tcg_regset_set_reg(o_allocated_regs, reg);
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r': /* general registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffffu;
 +        ct->regs |= 0xffffffffu;
          break;
      case 'w': /* advsimd registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffff00000000ull;
 +        ct->regs |= 0xffffffff00000000ull;
          break;
      case 'l': /* qemu_ld / qemu_st address, data_reg */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffffu;
 +        ct->regs = 0xffffffffu;
  #ifdef CONFIG_SOFTMMU
          /* x0 and x1 will be overwritten when reading the tlb entry,
             and x2, and x3 for helper args, better to avoid using them. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
  #endif
          break;
      case 'A': /* Valid for arithmetic immediate (positive or negative).  */
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      /* qemu_ld address */
      case 'l':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
  #ifdef CONFIG_SOFTMMU
          /* r0-r2,lr will be overwritten when reading the tlb entry,
             so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
      /* qemu_st address & data */
      case 's':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
  #if defined(CONFIG_SOFTMMU)
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
  #if TARGET_LONG_BITS == 64
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #endif
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch(*ct_str++) {
      case 'a':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
          break;
      case 'b':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
          break;
      case 'c':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
          break;
      case 'd':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
          break;
      case 'S':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
          break;
      case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
          break;
      case 'q':
          /* A register that can be used as a byte operand.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
          break;
      case 'Q':
          /* A register with an addressable second byte (e.g. %ah).  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xf;
 +        ct->regs = 0xf;
          break;
      case 'r':
          /* A general register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_GENERAL_REGS;
 +        ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
          /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'x':
          /* A vector register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_VECTOR_REGS;
 +        ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
          break;
      case 'e':
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch(*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'L': /* qemu_ld input arg constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
          if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
          }
  #endif
          break;
      case 'S': /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
          if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
          } else {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
          }
  #endif
          break;
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
 +        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'v':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff00000000ull;
 +        ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
  #endif
          break;
      case 'I':
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
  #endif
          break;
      case 'I':
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':                  /* all registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 +        ct->regs = 0xffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
      case 'A':
          ct->ct |= TCG_CT_CONST_S33;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'R':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
 +        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
          ct->ct |= TCG_CT_CONST_S11;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
 +        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
          return NULL;
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 12/15] tcg: Restart TB generation after out-of-line ldst overflow
+[PULL 03/11] tcg: Move sorted_args into TCGArgConstraint.sort_index
-This is part c of relocation overflow handling.
+This uses an existing hole in the TCGArgConstraint structure
 and will be convenient for keeping the data in one place.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.inc.c | 16 ++++++++++------
+ include/tcg/tcg.h |  2 +-
- tcg/arm/tcg-target.inc.c     | 16 ++++++++++------
+ tcg/tcg.c         | 35 +++++++++++++++++------------------
- tcg/i386/tcg-target.inc.c    |  6 ++++--
+files changed, 18 insertions(+), 19 deletions(-)
  tcg/mips/tcg-target.inc.c    |  6 ++++--
  tcg/ppc/tcg-target.inc.c     | 14 ++++++++++----
  tcg/riscv/tcg-target.inc.c   | 16 ++++++++++++----
  tcg/s390/tcg-target.inc.c    | 20 ++++++++++++--------
  tcg/tcg-ldst.inc.c           | 18 +++++++++---------
  tcg/tcg.c                    |  7 ++++---
 files changed, 75 insertions(+), 44 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.inc.c
+--- a/include/tcg/tcg.h
-+++ b/tcg/aarch64/tcg-target.inc.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
-     tcg_out_insn(s, 3406, ADR, rd, offset);
+ typedef struct TCGArgConstraint {
- }
+     uint16_t ct;
+     uint8_t alias_index;
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
++    uint8_t sort_index;
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     TCGRegSet regs;
- {
+ } TCGArgConstraint;
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
-     TCGMemOp size = opc & MO_SIZE;
+     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
+     uint8_t flags;
--    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
+     TCGArgConstraint *args_ct;
--    tcg_debug_assert(ok);
+-    int *sorted_args;
-+    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
+ #if defined(CONFIG_DEBUG_TCG)
-+        return false;
+     int used;
 +    }
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
      tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      }
      tcg_out_goto(s, lb->raddr);
 +    return true;
  }
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
      TCGMemOp size = opc & MO_SIZE;
 -    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
      tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      tcg_out_adr(s, TCG_REG_X4, lb->raddr);
      tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
      tcg_out_goto(s, lb->raddr);
 +    return true;
  }
  static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
 diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.inc.c
 +++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
      label->label_ptr[0] = label_ptr;
  }
 -static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGReg argreg, datalo, datahi;
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
      void *func;
 -    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      argreg = tcg_out_arg_reg32(s, TCG_REG_R0, TCG_AREG0);
      if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      }
      tcg_out_goto(s, COND_AL, lb->raddr);
 +    return true;
  }
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGReg argreg, datalo, datahi;
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
 -    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      argreg = TCG_REG_R0;
      argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      /* Tail-call to the helper, which will return to the fast path.  */
      tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    return true;
  }
  #endif /* SOFTMMU */
 diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.inc.c
 +++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
  /*
   * Generate code for the slow path for a load at the end of block
   */
 -static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* Jump to the code corresponding to next IR of qemu_st */
      tcg_out_jmp(s, l->raddr);
 +    return true;
  }
  /*
   * Generate code for the slow path for a store at the end of block
   */
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* "Tail call" to the helper, with the return address back inline.  */
      tcg_out_push(s, retaddr);
      tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    return true;
  }
  #elif TCG_TARGET_REG_BITS == 32
  # define x86_guest_base_seg     0
 diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.inc.c
 +++ b/tcg/mips/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
      }
  }
 -static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      } else {
          tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
      }
 +    return true;
  }
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)], true);
      /* delay slot */
      tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
 +    return true;
  }
  #endif
-diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.inc.c
-+++ b/tcg/ppc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = lptr;
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
-     TCGReg hi, lo, arg = TCG_REG_R3;
--    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
-+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     }
-     tcg_out_b(s, 0, lb->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
-     TCGMemOp s_bits = opc & MO_SIZE;
-     TCGReg hi, lo, arg = TCG_REG_R3;
--    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
-+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
-     tcg_out_b(s, 0, lb->raddr);
-+    return true;
- }
- #endif /* SOFTMMU */
-diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.inc.c
-+++ b/tcg/riscv/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = label_ptr[0];
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
-     TCGMemOp opc = get_memop(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     }
-     /* resolve label address */
--    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
-+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
-+                     (intptr_t) s->code_ptr, 0)) {
-+        return false;
-+    }
-     /* call load helper */
-     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
-     tcg_out_goto(s, l->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
-     TCGMemOp opc = get_memop(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     }
-     /* resolve label address */
--    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
-+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
-+                     (intptr_t) s->code_ptr, 0)) {
-+        return false;
-+    }
-     /* call store helper */
-     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
-     tcg_out_goto(s, l->raddr);
-+    return true;
- }
- #endif /* CONFIG_SOFTMMU */
-diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.inc.c
-+++ b/tcg/s390/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = label_ptr;
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
--    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
--                          (intptr_t)s->code_ptr, 2);
--    tcg_debug_assert(ok);
-+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-+                     (intptr_t)s->code_ptr, 2)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
-     if (TARGET_LONG_BITS == 64) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_R2);
-     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
--    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
--                          (intptr_t)s->code_ptr, 2);
--    tcg_debug_assert(ok);
-+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-+                     (intptr_t)s->code_ptr, 2)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
-     if (TARGET_LONG_BITS == 64) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
-     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
-+    return true;
- }
- #else
- static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
-diff --git a/tcg/tcg-ldst.inc.c b/tcg/tcg-ldst.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-ldst.inc.c
-+++ b/tcg/tcg-ldst.inc.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGLabelQemuLdst {
-  * Generate TB finalization at the end of block
-  */
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
--static bool tcg_out_ldst_finalize(TCGContext *s)
-+static int tcg_out_ldst_finalize(TCGContext *s)
- {
-     TCGLabelQemuLdst *lb;
-     /* qemu_ld/st slow paths */
-     QSIMPLEQ_FOREACH(lb, &s->ldst_labels, next) {
--        if (lb->is_ld) {
--            tcg_out_qemu_ld_slow_path(s, lb);
--        } else {
--            tcg_out_qemu_st_slow_path(s, lb);
-+        if (lb->is_ld
-+            ? !tcg_out_qemu_ld_slow_path(s, lb)
-+            : !tcg_out_qemu_st_slow_path(s, lb)) {
-+            return -2;
-         }
-         /* Test for (pending) buffer overflow.  The assumption is that any
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_ldst_finalize(TCGContext *s)
-            the buffer completely.  Thus we can test for overflow after
-            generating code without having to check during generation.  */
-         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
--            return false;
-+            return -1;
-         }
-     }
--    return true;
-+    return 0;
- }
- /*
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *target);
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
- static int tcg_target_const_match(tcg_target_long val, TCGType type,
+     int op, total_args, n, i;
-                                   const TCGArgConstraint *arg_ct);
+     TCGOpDef *def;
- #ifdef TCG_TARGET_NEED_LDST_LABELS
+     TCGArgConstraint *args_ct;
--static bool tcg_out_ldst_finalize(TCGContext *s);
+-    int *sorted_args;
-+static int tcg_out_ldst_finalize(TCGContext *s);
+     TCGTemp *ts;
- #endif
+     memset(s, 0, sizeof(*s));
- #define TCG_HIGHWATER 1024
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
      /* Generate TB finalization at the end of block */
  #ifdef TCG_TARGET_NEED_LDST_LABELS
 -    if (!tcg_out_ldst_finalize(s)) {
 -        return -1;
 +    i = tcg_out_ldst_finalize(s);
 +    if (i < 0) {
 +        return i;
      }
- #endif
- #ifdef TCG_TARGET_NEED_POOL_LABELS
+     args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
 -    sorted_args = g_malloc(sizeof(int) * total_args);
      for(op = 0; op < NB_OPS; op++) {
          def = &tcg_op_defs[op];
          def->args_ct = args_ct;
 -        def->sorted_args = sorted_args;
          n = def->nb_iargs + def->nb_oargs;
 -        sorted_args += n;
          args_ct += n;
      }
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
  /* sort from highest priority to lowest */
  static void sort_constraints(TCGOpDef *def, int start, int n)
  {
 -    int i, j, p1, p2, tmp;
 +    int i, j;
 +    TCGArgConstraint *a = def->args_ct;
 -    for(i = 0; i < n; i++)
 -        def->sorted_args[start + i] = start + i;
 -    if (n <= 1)
 +    for (i = 0; i < n; i++) {
 +        a[start + i].sort_index = start + i;
 +    }
 +    if (n <= 1) {
          return;
 -    for(i = 0; i < n - 1; i++) {
 -        for(j = i + 1; j < n; j++) {
 -            p1 = get_constraint_priority(def, def->sorted_args[start + i]);
 -            p2 = get_constraint_priority(def, def->sorted_args[start + j]);
 +    }
 +    for (i = 0; i < n - 1; i++) {
 +        for (j = i + 1; j < n; j++) {
 +            int p1 = get_constraint_priority(def, a[start + i].sort_index);
 +            int p2 = get_constraint_priority(def, a[start + j].sort_index);
              if (p1 < p2) {
 -                tmp = def->sorted_args[start + i];
 -                def->sorted_args[start + i] = def->sorted_args[start + j];
 -                def->sorted_args[start + j] = tmp;
 +                int tmp = a[start + i].sort_index;
 +                a[start + i].sort_index = a[start + j].sort_index;
 +                a[start + j].sort_index = tmp;
              }
          }
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
      for (k = 0; k < nb_iargs; k++) {
          TCGRegSet i_preferred_regs, o_preferred_regs;
 -        i = def->sorted_args[nb_oargs + k];
 +        i = def->args_ct[nb_oargs + k].sort_index;
          arg = op->args[i];
          arg_ct = &def->args_ct[i];
          ts = arg_temp(arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      int k2, i2;
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
 -                        i2 = def->sorted_args[nb_oargs + k2];
 +                        i2 = def->args_ct[nb_oargs + k2].sort_index;
                          if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
                              reg == new_args[i2]) {
                              goto allocate_in_reg;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          /* satisfy the output constraints */
          for(k = 0; k < nb_oargs; k++) {
 -            i = def->sorted_args[k];
 +            i = def->args_ct[k].sort_index;
              arg = op->args[i];
              arg_ct = &def->args_ct[i];
              ts = arg_temp(arg);
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 11/15] tcg: Restart TB generation after constant pool overflow
+[PULL 04/11] tcg: Remove TCG_CT_REG
-This is part b of relocation overflow handling.
+This wasn't actually used for anything, really.  All variable
 operands must accept registers, and which are indicated by the
 set in TCGArgConstraint.regs.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-pool.inc.c | 12 +++++++-----
+ include/tcg/tcg.h            |  1 -
- tcg/tcg.c          |  9 +++++----
+ tcg/tcg.c                    | 15 ++++-----------
-files changed, 12 insertions(+), 9 deletions(-)
+ tcg/aarch64/tcg-target.c.inc |  3 ---
  tcg/arm/tcg-target.c.inc     |  3 ---
  tcg/i386/tcg-target.c.inc    | 11 -----------
  tcg/mips/tcg-target.c.inc    |  3 ---
  tcg/ppc/tcg-target.c.inc     |  5 -----
  tcg/riscv/tcg-target.c.inc   |  2 --
  tcg/s390/tcg-target.c.inc    |  4 ----
  tcg/sparc/tcg-target.c.inc   |  5 -----
  tcg/tci/tcg-target.c.inc     |  1 -
 files changed, 4 insertions(+), 49 deletions(-)
-diff --git a/tcg/tcg-pool.inc.c b/tcg/tcg-pool.inc.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-pool.inc.c
+--- a/include/tcg/tcg.h
-+++ b/tcg/tcg-pool.inc.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static inline void new_pool_l8(TCGContext *s, int rtype, tcg_insn_unit *label,
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
- /* To be provided by cpu/tcg-target.inc.c.  */
+ #define TCG_CT_ALIAS  0x80
- static void tcg_out_nop_fill(tcg_insn_unit *p, int count);
+ #define TCG_CT_IALIAS 0x40
+ #define TCG_CT_NEWREG 0x20 /* output requires a new register */
--static bool tcg_out_pool_finalize(TCGContext *s)
+-#define TCG_CT_REG    0x01
-+static int tcg_out_pool_finalize(TCGContext *s)
+ #define TCG_CT_CONST  0x02 /* any constant of register size */
- {
-     TCGLabelPoolData *p = s->pool_labels;
+ typedef struct TCGArgConstraint {
      TCGLabelPoolData *l = NULL;
      void *a;
      if (p == NULL) {
 -        return true;
 +        return 0;
      }
      /* ??? Round up to qemu_icache_linesize, but then do not round
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_pool_finalize(TCGContext *s)
          size_t size = sizeof(tcg_target_ulong) * p->nlong;
          if (!l || l->nlong != p->nlong || memcmp(l->data, p->data, size)) {
              if (unlikely(a > s->code_gen_highwater)) {
 -                return false;
 +                return -1;
              }
              memcpy(a, p->data, size);
              a += size;
              l = p;
          }
 -        patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend);
 +        if (!patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend)) {
 +            return -2;
 +        }
      }
      s->code_ptr = a;
 -    return true;
 +    return 0;
  }
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
- #ifdef TCG_TARGET_NEED_POOL_LABELS
+ /* we give more priority to constraints with less registers */
-     /* Allow the prologue to put e.g. guest_base into a pool entry.  */
+ static int get_constraint_priority(const TCGOpDef *def, int k)
-     {
+ {
--        bool ok = tcg_out_pool_finalize(s);
+-    const TCGArgConstraint *arg_ct;
--        tcg_debug_assert(ok);
++    const TCGArgConstraint *arg_ct = &def->args_ct[k];
-+        int result = tcg_out_pool_finalize(s);
++    int n;
-+        tcg_debug_assert(result == 0);
 -    int i, n;
 -    arg_ct = &def->args_ct[k];
      if (arg_ct->ct & TCG_CT_ALIAS) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
 -        if (!(arg_ct->ct & TCG_CT_REG))
 -            return 0;
 -        n = 0;
 -        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
 -            if (tcg_regset_test_reg(arg_ct->regs, i))
 -                n++;
 -        }
 +        n = ctpop64(arg_ct->regs);
      }
+     return TCG_TARGET_NB_REGS - n + 1;
+ }
+@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
+                         int oarg = *ct_str - '0';
+                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
+                         tcg_debug_assert(oarg < def->nb_oargs);
+-                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
++                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
+                         /* TCG_CT_ALIAS is for the output arguments.
+                            The input is tagged with TCG_CT_IALIAS. */
+                         def->args_ct[i] = def->args_ct[oarg];
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+ {
+     switch (*ct_str++) {
+     case 'r': /* general registers */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs |= 0xffffffffu;
+         break;
+     case 'w': /* advsimd registers */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs |= 0xffffffff00000000ull;
+         break;
+     case 'l': /* qemu_ld / qemu_st address, data_reg */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffffffffu;
+ #ifdef CONFIG_SOFTMMU
+         /* x0 and x1 will be overwritten when reading the tlb entry,
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+         break;
+     case 'r':
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffff;
+         break;
+     /* qemu_ld address */
+     case 'l':
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffff;
+ #ifdef CONFIG_SOFTMMU
+         /* r0-r2,lr will be overwritten when reading the tlb entry,
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+     /* qemu_st address & data */
+     case 's':
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffff;
+         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
+            and r0-r1 doing the byte swapping, so don't use these. */
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+ {
+     switch(*ct_str++) {
+     case 'a':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
+         break;
+     case 'b':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
+         break;
+     case 'c':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
+         break;
+     case 'd':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
+         break;
+     case 'S':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
+         break;
+     case 'D':
+-        ct->ct |= TCG_CT_REG;
+         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
+         break;
+     case 'q':
+         /* A register that can be used as a byte operand.  */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+         break;
+     case 'Q':
+         /* A register with an addressable second byte (e.g. %ah).  */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xf;
+         break;
+     case 'r':
+         /* A general register.  */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs |= ALL_GENERAL_REGS;
+         break;
+     case 'W':
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+         break;
+     case 'x':
+         /* A vector register.  */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs |= ALL_VECTOR_REGS;
+         break;
+         /* qemu_ld/st address constraint */
+     case 'L':
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
+         tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
+         tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+ {
+     switch(*ct_str++) {
+     case 'r':
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffffffff;
+         break;
+     case 'L': /* qemu_ld input arg constraint */
+-        ct->ct |= TCG_CT_REG;
+         ct->regs = 0xffffffff;
+         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
+ #if defined(CONFIG_SOFTMMU)
+@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
+         break;
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
+     case 'S': /* qemu_st constraint */
-     }
+-        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'v':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
- #ifdef TCG_TARGET_NEED_POOL_LABELS
+         break;
--    if (!tcg_out_pool_finalize(s)) {
+     case 'S':                   /* qemu_st constraint */
--        return -1;
+-        ct->ct |= TCG_CT_REG;
-+    i = tcg_out_pool_finalize(s);
+         ct->regs = 0xffffffff;
-+    if (i < 0) {
+         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
-+        return i;
+ #ifdef CONFIG_SOFTMMU
-     }
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
- #endif
+index XXXXXXX..XXXXXXX 100644
-     if (!tcg_resolve_relocs(s)) {
+--- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':                  /* all registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'R':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
          tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 10/15] tcg: Restart TB generation after relocation overflow
+[PULL 05/11] tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
-If the TB generates too much code, such that backend relocations
+These are easier to set and test when they have their own fields.
-overflow, try again with a smaller TB.  In support of this, move
+Reduce the size of alias_index and sort_index to 4 bits, which is
-relocation processing from a random place within tcg_out_op, in
+sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
-the handling of branch opcodes, to a new function at the end of
+constants within the ct field.
 tcg_gen_code.
-This is not a complete solution, as there are additional relocs
+Move all initialization to allocation time, rather than init
-generated for out-of-line ldst handling and constant pools.
+individual fields in process_op_defs.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg.h | 15 +++++++-------
+ include/tcg/tcg.h | 14 +++++++-------
- tcg/tcg.c | 61 ++++++++++++++++++++++++++-----------------------------
+ tcg/tcg.c         | 28 ++++++++++++----------------
-files changed, 36 insertions(+), 40 deletions(-)
+files changed, 19 insertions(+), 23 deletions(-)
-diff --git a/tcg/tcg.h b/tcg/tcg.h
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.h
+--- a/include/tcg/tcg.h
-+++ b/tcg/tcg.h
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t tcg_insn_unit;
+@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
-     do { if (!(X)) { __builtin_unreachable(); } } while (0)
+ void tcg_dump_info(void);
- #endif
+ void tcg_dump_op_count(void);
--typedef struct TCGRelocation {
+-#define TCG_CT_ALIAS  0x80
--    struct TCGRelocation *next;
+-#define TCG_CT_IALIAS 0x40
--    int type;
+-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
-+typedef struct TCGRelocation TCGRelocation;
+-#define TCG_CT_CONST  0x02 /* any constant of register size */
-+struct TCGRelocation {
++#define TCG_CT_CONST  1 /* any constant of register size */
-+    QSIMPLEQ_ENTRY(TCGRelocation) next;
-     tcg_insn_unit *ptr;
+ typedef struct TCGArgConstraint {
-     intptr_t addend;
+-    uint16_t ct;
--} TCGRelocation;
+-    uint8_t alias_index;
-+    int type;
+-    uint8_t sort_index;
-+};
++    unsigned ct : 16;
++    unsigned alias_index : 4;
- typedef struct TCGLabel TCGLabel;
++    unsigned sort_index : 4;
- struct TCGLabel {
++    bool oalias : 1;
-@@ -XXX,XX +XXX,XX @@ struct TCGLabel {
++    bool ialias : 1;
-     union {
++    bool newreg : 1;
-         uintptr_t value;
+     TCGRegSet regs;
-         tcg_insn_unit *value_ptr;
+ } TCGArgConstraint;
--        TCGRelocation *first_reloc;
      } u;
 -#ifdef CONFIG_DEBUG_TCG
 +    QSIMPLEQ_HEAD(, TCGRelocation) relocs;
      QSIMPLEQ_ENTRY(TCGLabel) next;
 -#endif
  };
  typedef struct TCGPool {
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
  #endif
  #ifdef CONFIG_DEBUG_TCG
 -    QSIMPLEQ_HEAD(, TCGLabel) labels;
      int temps_in_use;
      int goto_tb_issue_mask;
  #endif
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
      TCGTemp temps[TCG_MAX_TEMPS]; /* globals first, temps after */
      QTAILQ_HEAD(, TCGOp) ops, free_ops;
 +    QSIMPLEQ_HEAD(, TCGLabel) labels;
      /* Tells which temporary holds a given register.
         It does not take into account fixed registers */
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static __attribute__((unused)) inline void tcg_patch64(tcg_insn_unit *p,
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
- static void tcg_out_reloc(TCGContext *s, tcg_insn_unit *code_ptr, int type,
+         total_args += n;
                            TCGLabel *l, intptr_t addend)
  {
 -    TCGRelocation *r;
 +    TCGRelocation *r = tcg_malloc(sizeof(TCGRelocation));
 -    if (l->has_value) {
 -        /* FIXME: This may break relocations on RISC targets that
 -           modify instruction fields in place.  The caller may not have
 -           written the initial value.  */
 -        bool ok = patch_reloc(code_ptr, type, l->u.value, addend);
 -        tcg_debug_assert(ok);
 -    } else {
 -        /* add a new relocation entry */
 -        r = tcg_malloc(sizeof(TCGRelocation));
 -        r->type = type;
 -        r->ptr = code_ptr;
 -        r->addend = addend;
 -        r->next = l->u.first_reloc;
 -        l->u.first_reloc = r;
 -    }
 +    r->type = type;
 +    r->ptr = code_ptr;
 +    r->addend = addend;
 +    QSIMPLEQ_INSERT_TAIL(&l->relocs, r, next);
  }
  static void tcg_out_label(TCGContext *s, TCGLabel *l, tcg_insn_unit *ptr)
  {
 -    intptr_t value = (intptr_t)ptr;
 -    TCGRelocation *r;
 -
      tcg_debug_assert(!l->has_value);
 -
 -    for (r = l->u.first_reloc; r != NULL; r = r->next) {
 -        bool ok = patch_reloc(r->ptr, r->type, value, r->addend);
 -        tcg_debug_assert(ok);
 -    }
 -
      l->has_value = 1;
      l->u.value_ptr = ptr;
  }
@@ -XXX,XX +XXX,XX @@ TCGLabel *gen_new_label(void)
      TCGContext *s = tcg_ctx;
      TCGLabel *l = tcg_malloc(sizeof(TCGLabel));
 -    *l = (TCGLabel){
 -        .id = s->nb_labels++
 -    };
 -#ifdef CONFIG_DEBUG_TCG
 +    memset(l, 0, sizeof(TCGLabel));
 +    l->id = s->nb_labels++;
 +    QSIMPLEQ_INIT(&l->relocs);
 +
      QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
 -#endif
      return l;
  }
 +static bool tcg_resolve_relocs(TCGContext *s)
 +{
 +    TCGLabel *l;
 +
 +    QSIMPLEQ_FOREACH(l, &s->labels, next) {
 +        TCGRelocation *r;
 +        uintptr_t value = l->u.value;
 +
 +        QSIMPLEQ_FOREACH(r, &l->relocs, next) {
 +            if (!patch_reloc(r->ptr, r->type, value, r->addend)) {
 +                return false;
 +            }
 +        }
 +    }
 +    return true;
 +}
 +
  static void set_jmp_reset_offset(TCGContext *s, int which)
  {
      size_t off = tcg_current_code_size(s);
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
      QTAILQ_INIT(&s->ops);
      QTAILQ_INIT(&s->free_ops);
 -#ifdef CONFIG_DEBUG_TCG
      QSIMPLEQ_INIT(&s->labels);
 -#endif
  }
  static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
          return -1;
      }
- #endif
-+    if (!tcg_resolve_relocs(s)) {
+-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
-+        return -2;
++    args_ct = g_new0(TCGArgConstraint, total_args);
-+    }
+     for(op = 0; op < NB_OPS; op++) {
-     /* flush instruction cache */
+         def = &tcg_op_defs[op];
-     flush_icache_range((uintptr_t)s->code_buf, (uintptr_t)s->code_ptr);
+@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
      const TCGArgConstraint *arg_ct = &def->args_ct[k];
      int n;
 -    if (arg_ct->ct & TCG_CT_ALIAS) {
 +    if (arg_ct->oalias) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
              /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].regs = 0;
 -            def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
                  case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
                          tcg_debug_assert(def->args_ct[oarg].regs != 0);
 -                        /* TCG_CT_ALIAS is for the output arguments.
 -                           The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 -                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
 +                        /* The output sets oalias.  */
 +                        def->args_ct[oarg].oalias = true;
                          def->args_ct[oarg].alias_index = i;
 -                        def->args_ct[i].ct |= TCG_CT_IALIAS;
 +                        /* The input sets ialias. */
 +                        def->args_ct[i].ialias = true;
                          def->args_ct[i].alias_index = oarg;
                      }
                      ct_str++;
                      break;
                  case '&':
 -                    def->args_ct[i].ct |= TCG_CT_NEWREG;
 +                    def->args_ct[i].newreg = true;
                      ct_str++;
                      break;
                  case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      set = *pset;
                      set &= ct->regs;
 -                    if (ct->ct & TCG_CT_IALIAS) {
 +                    if (ct->ialias) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          }
          i_preferred_regs = o_preferred_regs = 0;
 -        if (arg_ct->ct & TCG_CT_IALIAS) {
 +        if (arg_ct->ialias) {
              o_preferred_regs = op->output_pref[arg_ct->alias_index];
              if (ts->fixed_reg) {
                  /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
                          i2 = def->args_ct[nb_oargs + k2].sort_index;
 -                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
 -                            reg == new_args[i2]) {
 +                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                              goto allocate_in_reg;
                          }
                      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              /* ENV should not be modified.  */
              tcg_debug_assert(!ts->fixed_reg);
 -            if ((arg_ct->ct & TCG_CT_ALIAS)
 -                && !const_args[arg_ct->alias_index]) {
 +            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
 -            } else if (arg_ct->ct & TCG_CT_NEWREG) {
 +            } else if (arg_ct->newreg) {
                  reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 06/15] tcg/arm: Support INDEX_op_extract2_i32
+[PULL 06/11] tcg: Remove TCGOpDef.used
+The last user of this field disappeared in f69d277ece4.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/arm/tcg-target.h     |  2 +-
+ include/tcg/tcg.h | 3 ---
- tcg/arm/tcg-target.inc.c | 25 +++++++++++++++++++++++++
+file changed, 3 deletions(-)
 files changed, 26 insertions(+), 1 deletion(-)
-diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.h
+--- a/include/tcg/tcg.h
-+++ b/tcg/arm/tcg-target.h
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
- #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
+     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
- #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
+     uint8_t flags;
- #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
+     TCGArgConstraint *args_ct;
--#define TCG_TARGET_HAS_extract2_i32     0
+-#if defined(CONFIG_DEBUG_TCG)
-+#define TCG_TARGET_HAS_extract2_i32     1
+-    int used;
- #define TCG_TARGET_HAS_movcond_i32      1
+-#endif
- #define TCG_TARGET_HAS_mulu2_i32        1
+ } TCGOpDef;
- #define TCG_TARGET_HAS_muls2_i32        1
-diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
+ extern TCGOpDef tcg_op_defs[];
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.inc.c
 +++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
      case INDEX_op_sextract_i32:
          tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
          break;
 +    case INDEX_op_extract2_i32:
 +        /* ??? These optimization vs zero should be generic.  */
 +        /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
 +        if (const_args[1]) {
 +            if (const_args[2]) {
 +                tcg_out_movi(s, TCG_TYPE_REG, args[0], 0);
 +            } else {
 +                tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
 +                                args[2], SHIFT_IMM_LSL(32 - args[3]));
 +            }
 +        } else if (const_args[2]) {
 +            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
 +                            args[1], SHIFT_IMM_LSR(args[3]));
 +        } else {
 +            /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
 +            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0,
 +                            args[2], SHIFT_IMM_LSL(32 - args[3]));
 +            tcg_out_dat_reg(s, COND_AL, ARITH_ORR, args[0], TCG_REG_TMP,
 +                            args[1], SHIFT_IMM_LSR(args[3]));
 +        }
 +        break;
      case INDEX_op_div_i32:
          tcg_out_sdiv(s, COND_AL, args[0], args[1], args[2]);
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
          = { .args_ct_str = { "s", "s", "s", "s" } };
      static const TCGTargetOpDef br
          = { .args_ct_str = { "r", "rIN" } };
 +    static const TCGTargetOpDef ext2
 +        = { .args_ct_str = { "r", "rZ", "rZ" } };
      static const TCGTargetOpDef dep
          = { .args_ct_str = { "r", "0", "rZ" } };
      static const TCGTargetOpDef movc
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
          return &br;
      case INDEX_op_deposit_i32:
          return &dep;
 +    case INDEX_op_extract2_i32:
 +        return &ext2;
      case INDEX_op_movcond_i32:
          return &movc;
      case INDEX_op_add2_i32:
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 15/15] cputlb: Fix io_readx() to respect the access_type
+[PULL 07/11] tcg/i386: Fix dupi for avx2 32-bit hosts
-From: Shahab Vahedi <shahab.vahedi@gmail.com>
+The previous change wrongly stated that 32-bit avx2 should have
 used VPBROADCASTW.  But that's a 16-bit broadcast and we want a
 -bit broadcast.
-This change adapts io_readx() to its input access_type. Currently
+Fixes: 7b60ef3264e
-io_readx() treats any memory access as a read, although it has an
+Cc: qemu-stable@nongnu.org
 input argument "MMUAccessType access_type". This results in:
 ) Calling the tlb_fill() only with MMU_DATA_LOAD
 ) Considering only entry->addr_read as the tlb_addr
 Buglink: https://bugs.launchpad.net/qemu/+bug/1825359
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Shahab Vahedi <shahab.vahedi@gmail.com>
 Message-Id: <20190420072236.12347-1-shahab.vahedi@gmail.com>
 [rth: Remove assert; fix expression formatting.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 +++--
+ tcg/i386/tcg-target.c.inc | 2 +-
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tcg/i386/tcg-target.c.inc
-+++ b/accel/tcg/cputlb.c
++++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type,
-         CPUTLBEntry *entry;
+         new_pool_label(s, arg, R_386_PC32, s->code_ptr - 4, -4);
-         target_ulong tlb_addr;
+     } else {
+         if (have_avx2) {
--        tlb_fill(cpu, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
+-            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTW + vex_l, ret);
-+        tlb_fill(cpu, addr, size, access_type, mmu_idx, retaddr);
++            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTD + vex_l, ret);
+         } else {
-         entry = tlb_entry(env, mmu_idx, addr);
+             tcg_out_vex_modrm_pool(s, OPC_VBROADCASTSS, ret);
--        tlb_addr = entry->addr_read;
+         }
 +        tlb_addr = (access_type == MMU_DATA_LOAD ?
 +                    entry->addr_read : entry->addr_code);
          if (!(tlb_addr & ~(TARGET_PAGE_MASK | TLB_RECHECK))) {
              /* RAM access */
              uintptr_t haddr = addr + entry->addend;
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 08/15] tcg: Hoist max_insns computation to tb_gen_code
+[PULL 08/11] tcg: Fix generation of dupi_vec for 32-bit host
-In order to handle TB's that translate to too much code, we
+The definition of INDEX_op_dupi_vec is that it operates on
-need to place the control of the length of the translation
+units of tcg_target_ulong -- in this case 32 bits.  It does
-in the hands of the code gen master loop.
+not work to use this for a uint64_t value that happens to be
 small enough to fit in tcg_target_ulong.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Fixes: d2fd745fe8b
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Fixes: db432672dc5
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h       |  4 ++--
+ tcg/tcg-op-vec.c | 12 ++++++++----
- include/exec/translator.h     |  3 ++-
+file changed, 8 insertions(+), 4 deletions(-)
  accel/tcg/translate-all.c     | 15 +++++++++++++--
  accel/tcg/translator.c        | 15 ++-------------
  target/alpha/translate.c      |  4 ++--
  target/arm/translate.c        |  4 ++--
  target/cris/translate.c       | 10 +---------
  target/hppa/translate.c       |  5 ++---
  target/i386/translate.c       |  4 ++--
  target/lm32/translate.c       | 10 +---------
  target/m68k/translate.c       |  4 ++--
  target/microblaze/translate.c | 10 +---------
  target/mips/translate.c       |  4 ++--
  target/moxie/translate.c      | 11 ++---------
  target/nios2/translate.c      | 14 ++------------
  target/openrisc/translate.c   |  4 ++--
  target/ppc/translate.c        |  4 ++--
  target/riscv/translate.c      |  4 ++--
  target/s390x/translate.c      |  4 ++--
  target/sh4/translate.c        |  4 ++--
  target/sparc/translate.c      |  4 ++--
  target/tilegx/translate.c     | 12 +-----------
  target/tricore/translate.c    | 16 ++--------------
  target/unicore32/translate.c  | 10 +---------
  target/xtensa/translate.c     |  4 ++--
 files changed, 56 insertions(+), 127 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/tcg/tcg-op-vec.c
-+++ b/include/exec/exec-all.h
++++ b/tcg/tcg-op-vec.c
-@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
+@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
- #include "qemu/log.h"
+ void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
+ {
--void gen_intermediate_code(CPUState *cpu, struct TranslationBlock *tb);
+-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
--void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
+-        do_dupi_vec(r, MO_32, a);
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
+-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
-+void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
++    if (TCG_TARGET_REG_BITS == 64) {
-                           target_ulong *data);
+         do_dupi_vec(r, MO_64, a);
++    } else if (a == dup_const(MO_32, a)) {
- void cpu_gen_init(void);
++        do_dupi_vec(r, MO_32, a);
-diff --git a/include/exec/translator.h b/include/exec/translator.h
+     } else {
-index XXXXXXX..XXXXXXX 100644
+         TCGv_i64 c = tcg_const_i64(a);
---- a/include/exec/translator.h
+         tcg_gen_dup_i64_vec(MO_64, r, c);
-+++ b/include/exec/translator.h
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
-@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
-  * @db: Disassembly context.
+ void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
-  * @cpu: Target vCPU.
+ {
-  * @tb: Translation block.
+-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
-+ * @max_insns: Maximum number of insns to translate.
++    if (vece == MO_64) {
-  *
++        tcg_gen_dup64i_vec(r, a);
-  * Generic translator loop.
++    } else {
-  *
++        do_dupi_vec(r, MO_REG, dup_const(vece, a));
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
   * - When too many instructions have been translated.
   */
  void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
 -                     CPUState *cpu, TranslationBlock *tb);
 +                     CPUState *cpu, TranslationBlock *tb, int max_insns);
  void translator_loop_temp_check(DisasContextBase *db);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tb_page_addr_t phys_pc, phys_page2;
      target_ulong virt_page2;
      tcg_insn_unit *gen_code_buf;
 -    int gen_code_size, search_size;
 +    int gen_code_size, search_size, max_insns;
  #ifdef CONFIG_PROFILER
      TCGProfile *prof = &tcg_ctx->prof;
      int64_t ti;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      cflags &= ~CF_CLUSTER_MASK;
      cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
 +    max_insns = cflags & CF_COUNT_MASK;
 +    if (max_insns == 0) {
 +        max_insns = CF_COUNT_MASK;
 +    }
-+    if (max_insns > TCG_MAX_INSNS) {
-+        max_insns = TCG_MAX_INSNS;
-+    }
-+    if (cpu->singlestep_enabled || singlestep) {
-+        max_insns = 1;
-+    }
-+
-  buffer_overflow:
-     tb = tb_alloc(pc);
-     if (unlikely(!tb)) {
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     tcg_func_start(tcg_ctx);
-     tcg_ctx->cpu = ENV_GET_CPU(env);
--    gen_intermediate_code(cpu, tb);
-+    gen_intermediate_code(cpu, tb, max_insns);
-     tcg_ctx->cpu = NULL;
-     trace_translate_block(tb, tb->pc, tb->tc.ptr);
-diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translator.c
-+++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ void translator_loop_temp_check(DisasContextBase *db)
  }
- void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
+ void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
 -                     CPUState *cpu, TranslationBlock *tb)
 +                     CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      int bp_insn = 0;
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
      db->pc_next = db->pc_first;
      db->is_jmp = DISAS_NEXT;
      db->num_insns = 0;
 +    db->max_insns = max_insns;
      db->singlestep_enabled = cpu->singlestep_enabled;
 -    /* Instruction counting */
 -    db->max_insns = tb_cflags(db->tb) & CF_COUNT_MASK;
 -    if (db->max_insns == 0) {
 -        db->max_insns = CF_COUNT_MASK;
 -    }
 -    if (db->max_insns > TCG_MAX_INSNS) {
 -        db->max_insns = TCG_MAX_INSNS;
 -    }
 -    if (db->singlestep_enabled || singlestep) {
 -        db->max_insns = 1;
 -    }
 -
      ops->init_disas_context(db, cpu);
      tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 diff --git a/target/alpha/translate.c b/target/alpha/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/translate.c
 +++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
      .disas_log          = alpha_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc;
 -    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb);
 +    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
  }
  void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc;
      const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
      }
  #endif
 -    translator_loop(ops, &dc.base, cpu, tb);
 +    translator_loop(ops, &dc.base, cpu, tb, max_insns);
  }
  void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/translate.c
 +++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
   */
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUCRISState *env = cs->env_ptr;
      uint32_t pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      uint32_t page_start;
      target_ulong npc;
      int num_insns;
 -    int max_insns;
      if (env->pregs[PR_VR] == 32) {
          dc->decoder = crisv32_decoder;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      page_start = pc_start & TARGET_PAGE_MASK;
      num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
      gen_tb_start(tb);
      do {
 diff --git a/target/hppa/translate.c b/target/hppa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/translate.c
 +++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
      .disas_log          = hppa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 -
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
 diff --git a/target/i386/translate.c b/target/i386/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/translate.c
 +++ b/target/i386/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc;
 -    translator_loop(&i386_tr_ops, &dc.base, cpu, tb);
 +    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
  }
  void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
 diff --git a/target/lm32/translate.c b/target/lm32/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/translate.c
 +++ b/target/lm32/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
  }
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPULM32State *env = cs->env_ptr;
      LM32CPU *cpu = lm32_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      uint32_t pc_start;
      uint32_t page_start;
      int num_insns;
 -    int max_insns;
      pc_start = tb->pc;
      dc->features = cpu->features;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      page_start = pc_start & TARGET_PAGE_MASK;
      num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
      gen_tb_start(tb);
      do {
 diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/translate.c
 +++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
      .disas_log          = m68k_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc;
 -    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb);
 +    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
  }
  static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
 diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/translate.c
 +++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
  }
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUMBState *env = cs->env_ptr;
      MicroBlazeCPU *cpu = mb_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      uint32_t page_start, org_flags;
      uint32_t npc;
      int num_insns;
 -    int max_insns;
      pc_start = tb->pc;
      dc->cpu = cpu;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      page_start = pc_start & TARGET_PAGE_MASK;
      num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
      gen_tb_start(tb);
      do
 diff --git a/target/mips/translate.c b/target/mips/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/translate.c
 +++ b/target/mips/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
      .disas_log          = mips_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&mips_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  static void fpu_dump_state(CPUMIPSState *env, FILE *f, int flags)
 diff --git a/target/moxie/translate.c b/target/moxie/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/translate.c
 +++ b/target/moxie/translate.c
@@ -XXX,XX +XXX,XX @@ static int decode_opc(MoxieCPU *cpu, DisasContext *ctx)
  }
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUMoxieState *env = cs->env_ptr;
      MoxieCPU *cpu = moxie_env_get_cpu(env);
      DisasContext ctx;
      target_ulong pc_start;
 -    int num_insns, max_insns;
 +    int num_insns;
      pc_start = tb->pc;
      ctx.pc = pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      ctx.singlestep_enabled = 0;
      ctx.bstate = BS_NONE;
      num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
      gen_tb_start(tb);
      do {
 diff --git a/target/nios2/translate.c b/target/nios2/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/translate.c
 +++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
  }
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUNios2State *env = cs->env_ptr;
      DisasContext dc1, *dc = &dc1;
      int num_insns;
 -    int max_insns;
      /* Initialize DC */
      dc->cpu_env = cpu_env;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
      /* Set up instruction counts */
      num_insns = 0;
 -    if (cs->singlestep_enabled || singlestep) {
 -        max_insns = 1;
 -    } else {
 +    if (max_insns > 1) {
          int page_insns = (TARGET_PAGE_SIZE - (tb->pc & TARGET_PAGE_MASK)) / 4;
 -        max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -        if (max_insns == 0) {
 -            max_insns = CF_COUNT_MASK;
 -        }
          if (max_insns > page_insns) {
              max_insns = page_insns;
          }
 -        if (max_insns > TCG_MAX_INSNS) {
 -            max_insns = TCG_MAX_INSNS;
 -        }
      }
      gen_tb_start(tb);
 diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/translate.c
 +++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
      .disas_log          = openrisc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate.c
 +++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
      .disas_log          = ppc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
      .disas_log          = riscv_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  void riscv_translate_init(void)
 diff --git a/target/s390x/translate.c b/target/s390x/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/translate.c
 +++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
      .disas_log          = s390x_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc;
 -    translator_loop(&s390x_tr_ops, &dc.base, cs, tb);
 +    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
  }
  void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
      .disas_log          = sh4_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext ctx;
 -    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb);
 +    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
  }
  void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
      .disas_log          = sparc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc = {};
 -    translator_loop(&sparc_tr_ops, &dc.base, cs, tb);
 +    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
  }
  void sparc_tcg_init(void)
 diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/translate.c
 +++ b/target/tilegx/translate.c
@@ -XXX,XX +XXX,XX @@ static void translate_one_bundle(DisasContext *dc, uint64_t bundle)
      }
  }
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUTLGState *env = cs->env_ptr;
      DisasContext ctx;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
      uint64_t pc_start = tb->pc;
      uint64_t page_start = pc_start & TARGET_PAGE_MASK;
      int num_insns = 0;
 -    int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
      dc->pc = pc_start;
      dc->mmuidx = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
          qemu_log_lock();
          qemu_log("IN: %s\n", lookup_symbol(pc_start));
      }
 -    if (!max_insns) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (cs->singlestep_enabled || singlestep) {
 -        max_insns = 1;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
      gen_tb_start(tb);
      while (1) {
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPUTriCoreState *env, DisasContext *ctx, int *is_branch)
      }
  }
 -void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUTriCoreState *env = cs->env_ptr;
      DisasContext ctx;
      target_ulong pc_start;
 -    int num_insns, max_insns;
 -
 -    num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (singlestep) {
 -        max_insns = 1;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
 +    int num_insns = 0;
      pc_start = tb->pc;
      ctx.pc = pc_start;
 diff --git a/target/unicore32/translate.c b/target/unicore32/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/translate.c
 +++ b/target/unicore32/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
  }
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
  {
      CPUUniCore32State *env = cs->env_ptr;
      DisasContext dc1, *dc = &dc1;
      target_ulong pc_start;
      uint32_t page_start;
      int num_insns;
 -    int max_insns;
      /* generate intermediate code */
      num_temps = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
      cpu_F1d = tcg_temp_new_i64();
      page_start = pc_start & TARGET_PAGE_MASK;
      num_insns = 0;
 -    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 -    if (max_insns == 0) {
 -        max_insns = CF_COUNT_MASK;
 -    }
 -    if (max_insns > TCG_MAX_INSNS) {
 -        max_insns = TCG_MAX_INSNS;
 -    }
  #ifndef CONFIG_USER_ONLY
      if ((env->uncached_asr & ASR_M) == ASR_MODE_USER) {
 diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/translate.c
 +++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
      .disas_log          = xtensa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
      DisasContext dc = {};
 -    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb);
 +    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
  }
  void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 02/15] tcg: Add INDEX_op_extract2_{i32,i64}
+[PULL 09/11] tcg/optimize: Fold dup2_vec
-This will let backends implement the double-word shift operation.
+When the two arguments are identical, this can be reduced to
 dup_vec or to mov_vec from a tcg_constant_vec.
-Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.h |  2 ++
+ tcg/optimize.c | 15 +++++++++++++++
- tcg/arm/tcg-target.h     |  1 +
+file changed, 15 insertions(+)
  tcg/i386/tcg-target.h    |  2 ++
  tcg/mips/tcg-target.h    |  2 ++
  tcg/ppc/tcg-target.h     |  2 ++
  tcg/riscv/tcg-target.h   |  2 ++
  tcg/s390/tcg-target.h    |  2 ++
  tcg/sparc/tcg-target.h   |  2 ++
  tcg/tcg-opc.h            |  2 ++
  tcg/tcg.h                |  1 +
  tcg/tci/tcg-target.h     |  2 ++
  tcg/optimize.c           | 16 ++++++++++++++++
  tcg/tcg-op.c             |  4 ++++
  tcg/tcg.c                |  4 ++++
  tcg/README               |  7 +++++++
 files changed, 51 insertions(+)
-diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.h
-+++ b/tcg/aarch64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     1
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.h
-+++ b/tcg/arm/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
- #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_mulu2_i32        1
- #define TCG_TARGET_HAS_muls2_i32        1
-diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.h
-+++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.h
-+++ b/tcg/mips/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
- #define TCG_TARGET_HAS_deposit_i32      use_mips32r2_instructions
- #define TCG_TARGET_HAS_extract_i32      use_mips32r2_instructions
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_ext8s_i32        use_mips32r2_instructions
- #define TCG_TARGET_HAS_ext16s_i32       use_mips32r2_instructions
- #define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
-@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
- #define TCG_TARGET_HAS_deposit_i64      use_mips32r2_instructions
- #define TCG_TARGET_HAS_extract_i64      use_mips32r2_instructions
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_ext8s_i64        use_mips32r2_instructions
- #define TCG_TARGET_HAS_ext16s_i64       use_mips32r2_instructions
- #define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
-diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.h
-+++ b/tcg/ppc/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_mulu2_i32        0
- #define TCG_TARGET_HAS_muls2_i32        0
-@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.h
-+++ b/tcg/riscv/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      0
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
- #define TCG_TARGET_HAS_mulu2_i32        0
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_extrl_i64_i32    1
- #define TCG_TARGET_HAS_extrh_i64_i32    1
- #define TCG_TARGET_HAS_ext8s_i64        1
-diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.h
-+++ b/tcg/s390/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
- #define TCG_TARGET_HAS_deposit_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_extract_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_sextract_i32   0
-+#define TCG_TARGET_HAS_extract2_i32   0
- #define TCG_TARGET_HAS_movcond_i32    1
- #define TCG_TARGET_HAS_add2_i32       1
- #define TCG_TARGET_HAS_sub2_i32       1
-@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
- #define TCG_TARGET_HAS_deposit_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_extract_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_sextract_i64   0
-+#define TCG_TARGET_HAS_extract2_i64   0
- #define TCG_TARGET_HAS_movcond_i64    1
- #define TCG_TARGET_HAS_add2_i64       1
- #define TCG_TARGET_HAS_sub2_i64       1
-diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/sparc/tcg-target.h
-+++ b/tcg/sparc/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
- #define TCG_TARGET_HAS_deposit_i32      0
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-opc.h
-+++ b/tcg/tcg-opc.h
-@@ -XXX,XX +XXX,XX @@ DEF(rotr_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rot_i32))
- DEF(deposit_i32, 1, 2, 2, IMPL(TCG_TARGET_HAS_deposit_i32))
- DEF(extract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_extract_i32))
- DEF(sextract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_sextract_i32))
-+DEF(extract2_i32, 1, 2, 1, IMPL(TCG_TARGET_HAS_extract2_i32))
- DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END)
-@@ -XXX,XX +XXX,XX @@ DEF(rotr_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rot_i64))
- DEF(deposit_i64, 1, 2, 2, IMPL64 | IMPL(TCG_TARGET_HAS_deposit_i64))
- DEF(extract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_extract_i64))
- DEF(sextract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_sextract_i64))
-+DEF(extract2_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_extract2_i64))
- /* size changing ops */
- DEF(ext_i32_i64, 1, 1, 0, IMPL64)
-diff --git a/tcg/tcg.h b/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.h
-+++ b/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      0
- #define TCG_TARGET_HAS_add2_i64         0
- #define TCG_TARGET_HAS_sub2_i64         0
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
-+++ b/tcg/tci/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_eqv_i32          0
- #define TCG_TARGET_HAS_nand_i32         0
- #define TCG_TARGET_HAS_nor_i32          0
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_div_i64          0
- #define TCG_TARGET_HAS_rem_i64          0
- #define TCG_TARGET_HAS_ext8s_i64        1
 diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/optimize.c
 +++ b/tcg/optimize.c
 @@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
              }
              goto do_default;
-+        CASE_OP_32_64(extract2):
++        case INDEX_op_dup2_vec:
 +            assert(TCG_TARGET_REG_BITS == 32);
 +            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-+                TCGArg v1 = arg_info(op->args[1])->val;
++                tmp = arg_info(op->args[1])->val;
-+                TCGArg v2 = arg_info(op->args[2])->val;
++                if (tmp == arg_info(op->args[2])->val) {
-+
++                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
-+                if (opc == INDEX_op_extract2_i64) {
++                    break;
 +                    tmp = (v1 >> op->args[3]) | (v2 << (64 - op->args[3]));
 +                } else {
 +                    tmp = (v1 >> op->args[3]) | (v2 << (32 - op->args[3]));
 +                    tmp = (int32_t)tmp;
 +                }
-+                tcg_opt_gen_movi(s, op, op->args[0], tmp);
++            } else if (args_are_copies(op->args[1], op->args[2])) {
-+                break;
++                op->opc = INDEX_op_dup_vec;
 +                TCGOP_VECE(op) = MO_32;
 +                nb_iargs = 1;
 +            }
 +            goto do_default;
 +
-         CASE_OP_32_64(setcond):
+         CASE_OP_32_64(not):
-             tmp = do_constant_folding_cond(opc, op->args[1],
+         CASE_OP_32_64(neg):
-                                            op->args[2], op->args[3]);
+         CASE_OP_32_64(ext8s):
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
          tcg_gen_mov_i32(ret, ah);
      } else if (al == ah) {
          tcg_gen_rotri_i32(ret, al, ofs);
 +    } else if (TCG_TARGET_HAS_extract2_i32) {
 +        tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
      } else {
          TCGv_i32 t0 = tcg_temp_new_i32();
          tcg_gen_shri_i32(t0, al, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
          tcg_gen_mov_i64(ret, ah);
      } else if (al == ah) {
          tcg_gen_rotri_i64(ret, al, ofs);
 +    } else if (TCG_TARGET_HAS_extract2_i64) {
 +        tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
      } else {
          TCGv_i64 t0 = tcg_temp_new_i64();
          tcg_gen_shri_i64(t0, al, ofs);
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
          return TCG_TARGET_HAS_extract_i32;
      case INDEX_op_sextract_i32:
          return TCG_TARGET_HAS_sextract_i32;
 +    case INDEX_op_extract2_i32:
 +        return TCG_TARGET_HAS_extract2_i32;
      case INDEX_op_add2_i32:
          return TCG_TARGET_HAS_add2_i32;
      case INDEX_op_sub2_i32:
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
          return TCG_TARGET_HAS_extract_i64;
      case INDEX_op_sextract_i64:
          return TCG_TARGET_HAS_sextract_i64;
 +    case INDEX_op_extract2_i64:
 +        return TCG_TARGET_HAS_extract2_i64;
      case INDEX_op_extrl_i64_i32:
          return TCG_TARGET_HAS_extrl_i64_i32;
      case INDEX_op_extrh_i64_i32:
 diff --git a/tcg/README b/tcg/README
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/README
 +++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ at bit 8.  This operation would be equivalent to
  (using an arithmetic right shift).
 +* extract2_i32/i64 dest, t1, t2, pos
 +
 +For N = {32,64}, extract an N-bit quantity from the concatenation
 +of t2:t1, beginning at pos.  The tcg_gen_extract2_{i32,i64} expander
 +accepts 0 <= pos <= N as inputs.  The backend code generator will
 +not see either 0 or N as inputs for these opcodes.
 +
  * extrl_i64_i32 t0, t1
  For 64-bit hosts only, extract the low 32-bits of input T1 and place it
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 07/15] tcg/aarch64: Support INDEX_op_extract2_{i32, i64}
+[PULL 10/11] tcg: Remove TCG_TARGET_HAS_cmp_vec
+The cmp_vec opcode is mandatory; this symbol is unused.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.h     |  4 ++--
+ tcg/aarch64/tcg-target.h | 1 -
- tcg/aarch64/tcg-target.inc.c | 11 +++++++++++
+ tcg/i386/tcg-target.h    | 1 -
-files changed, 13 insertions(+), 2 deletions(-)
+ tcg/ppc/tcg-target.h     | 1 -
 files changed, 3 deletions(-)
 diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.h
 +++ b/tcg/aarch64/tcg-target.h
 @@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      1
+ #define TCG_TARGET_HAS_shi_vec          1
- #define TCG_TARGET_HAS_extract_i32      1
+ #define TCG_TARGET_HAS_shs_vec          0
- #define TCG_TARGET_HAS_sextract_i32     1
+ #define TCG_TARGET_HAS_shv_vec          1
--#define TCG_TARGET_HAS_extract2_i32     0
+-#define TCG_TARGET_HAS_cmp_vec          1
-+#define TCG_TARGET_HAS_extract2_i32     1
+ #define TCG_TARGET_HAS_mul_vec          1
- #define TCG_TARGET_HAS_movcond_i32      1
+ #define TCG_TARGET_HAS_sat_vec          1
- #define TCG_TARGET_HAS_add2_i32         1
+ #define TCG_TARGET_HAS_minmax_vec       1
- #define TCG_TARGET_HAS_sub2_i32         1
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define TCG_TARGET_HAS_deposit_i64      1
  #define TCG_TARGET_HAS_extract_i64      1
  #define TCG_TARGET_HAS_sextract_i64     1
 -#define TCG_TARGET_HAS_extract2_i64     0
 +#define TCG_TARGET_HAS_extract2_i64     1
  #define TCG_TARGET_HAS_movcond_i64      1
  #define TCG_TARGET_HAS_add2_i64         1
  #define TCG_TARGET_HAS_sub2_i64         1
 diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.inc.c
+--- a/tcg/i386/tcg-target.h
-+++ b/tcg/aarch64/tcg-target.inc.c
++++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
-         tcg_out_sbfm(s, ext, a0, a1, a2, a2 + args[3] - 1);
+ #define TCG_TARGET_HAS_shi_vec          1
-         break;
+ #define TCG_TARGET_HAS_shs_vec          1
+ #define TCG_TARGET_HAS_shv_vec          have_avx2
-+    case INDEX_op_extract2_i64:
+-#define TCG_TARGET_HAS_cmp_vec          1
-+    case INDEX_op_extract2_i32:
+ #define TCG_TARGET_HAS_mul_vec          1
-+        tcg_out_extr(s, ext, a0, a1, a2, args[3]);
+ #define TCG_TARGET_HAS_sat_vec          1
-+        break;
+ #define TCG_TARGET_HAS_minmax_vec       1
-+
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
-     case INDEX_op_add2_i32:
+index XXXXXXX..XXXXXXX 100644
-         tcg_out_addsub2(s, TCG_TYPE_I32, a0, a1, REG0(2), REG0(3),
+--- a/tcg/ppc/tcg-target.h
-                         (int32_t)args[4], args[5], const_args[4],
++++ b/tcg/ppc/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
+@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
-         = { .args_ct_str = { "r", "r", "rAL" } };
+ #define TCG_TARGET_HAS_shi_vec          0
-     static const TCGTargetOpDef dep
+ #define TCG_TARGET_HAS_shs_vec          0
-         = { .args_ct_str = { "r", "0", "rZ" } };
+ #define TCG_TARGET_HAS_shv_vec          1
-+    static const TCGTargetOpDef ext2
+-#define TCG_TARGET_HAS_cmp_vec          1
-+        = { .args_ct_str = { "r", "rZ", "rZ" } };
+ #define TCG_TARGET_HAS_mul_vec          1
-     static const TCGTargetOpDef movc
+ #define TCG_TARGET_HAS_sat_vec          1
-         = { .args_ct_str = { "r", "r", "rA", "rZ", "rZ" } };
+ #define TCG_TARGET_HAS_minmax_vec       1
      static const TCGTargetOpDef add2
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
      case INDEX_op_deposit_i64:
          return &dep;
 +    case INDEX_op_extract2_i32:
 +    case INDEX_op_extract2_i64:
 +        return &ext2;
 +
      case INDEX_op_add2_i32:
      case INDEX_op_add2_i64:
      case INDEX_op_sub2_i32:
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 03/15] tcg: Use deposit and extract2 in tcg_gen_shifti_i64
+[PULL 11/11] accel/tcg: Fix computing of is_write for MIPS
+From: Kele Huang <kele.hwang@gmail.com>
+Detect all MIPS store instructions in cpu_signal_handler for all available
+MIPS versions, and set is_write if encountering such store instructions.
+This fixed the error while dealing with self-modified code for MIPS.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Kele Huang <kele.hwang@gmail.com>
+Signed-off-by: Xu Zou <iwatchnima@gmail.com>
+Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
+[rth: Use uintptr_t for pc to fix n32 build error.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-op.c | 47 ++++++++++++++++++++++++-----------------------
+ accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
-file changed, 24 insertions(+), 23 deletions(-)
+file changed, 39 insertions(+), 4 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
+diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
+--- a/accel/tcg/user-exec.c
-+++ b/tcg/tcg-op.c
++++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
+@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
-             tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_LOW(arg1), c);
-             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
+ #elif defined(__mips__)
-         }
--    } else {
++#if defined(__misp16) || defined(__mips_micromips)
--        TCGv_i32 t0, t1;
++#error "Unsupported encoding"
--
++#endif
--        t0 = tcg_temp_new_i32();
++
--        t1 = tcg_temp_new_i32();
+ int cpu_signal_handler(int host_signum, void *pinfo,
--        if (right) {
+                        void *puc)
--            tcg_gen_shli_i32(t0, TCGV_HIGH(arg1), 32 - c);
+ {
--            if (arith) {
+     siginfo_t *info = pinfo;
--                tcg_gen_sari_i32(t1, TCGV_HIGH(arg1), c);
+     ucontext_t *uc = puc;
--            } else {
+-    greg_t pc = uc->uc_mcontext.pc;
--                tcg_gen_shri_i32(t1, TCGV_HIGH(arg1), c);
+-    int is_write;
--            }
++    uintptr_t pc = uc->uc_mcontext.pc;
--            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
++    uint32_t insn = *(uint32_t *)pc;
--            tcg_gen_or_i32(TCGV_LOW(ret), TCGV_LOW(ret), t0);
++    int is_write = 0;
--            tcg_gen_mov_i32(TCGV_HIGH(ret), t1);
++
-+    } else if (right) {
++    /* Detect all store instructions at program counter. */
-+        if (TCG_TARGET_HAS_extract2_i32) {
++    switch((insn >> 26) & 077) {
-+            tcg_gen_extract2_i32(TCGV_LOW(ret),
++    case 050: /* SB */
-+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
++    case 051: /* SH */
-         } else {
++    case 052: /* SWL */
--            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
++    case 053: /* SW */
--            /* Note: ret can be the same as arg1, so we use t1 */
++    case 054: /* SDL */
--            tcg_gen_shli_i32(t1, TCGV_LOW(arg1), c);
++    case 055: /* SDR */
--            tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
++    case 056: /* SWR */
--            tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), t0);
++    case 070: /* SC */
--            tcg_gen_mov_i32(TCGV_LOW(ret), t1);
++    case 071: /* SWC1 */
-+            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
++    case 074: /* SCD */
-+            tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
++    case 075: /* SDC1 */
-+                                TCGV_HIGH(arg1), 32 - c, c);
++    case 077: /* SD */
-         }
++#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
--        tcg_temp_free_i32(t0);
++    case 072: /* SWC2 */
--        tcg_temp_free_i32(t1);
++    case 076: /* SDC2 */
-+        if (arith) {
++#endif
-+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
++        is_write = 1;
-+        } else {
++        break;
-+            tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
++    case 023: /* COP1X */
 +        /* Required in all versions of MIPS64 since
 +           MIPS64r1 and subsequent versions of MIPS32r2. */
 +        switch (insn & 077) {
 +        case 010: /* SWXC1 */
 +        case 011: /* SDXC1 */
 +        case 015: /* SUXC1 */
 +            is_write = 1;
 +        }
-+    } else {
++        break;
-+        if (TCG_TARGET_HAS_extract2_i32) {
++    }
-+            tcg_gen_extract2_i32(TCGV_HIGH(ret),
-+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
+-    /* XXX: compute is_write */
-+        } else {
+-    is_write = 0;
-+            TCGv_i32 t0 = tcg_temp_new_i32();
+     return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 +            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
 +            tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
 +                                TCGV_HIGH(arg1), c, 32 - c);
 +            tcg_temp_free_i32(t0);
 +        }
 +        tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
      }
  }
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 04/15] tcg: Use extract2 in tcg_gen_deposit_{i32, i64}
+Deleted patch
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.c | 34 ++++++++++++++++++++++++++++++----
-file changed, 30 insertions(+), 4 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
-         return;
-     }
--    mask = (1u << len) - 1;
-     t1 = tcg_temp_new_i32();
-+    if (TCG_TARGET_HAS_extract2_i32) {
-+        if (ofs + len == 32) {
-+            tcg_gen_shli_i32(t1, arg1, len);
-+            tcg_gen_extract2_i32(ret, t1, arg2, len);
-+            goto done;
-+        }
-+        if (ofs == 0) {
-+            tcg_gen_extract2_i32(ret, arg1, arg2, len);
-+            tcg_gen_rotli_i32(ret, ret, len);
-+            goto done;
-+        }
-+    }
-+
-+    mask = (1u << len) - 1;
-     if (ofs + len < 32) {
-         tcg_gen_andi_i32(t1, arg2, mask);
-         tcg_gen_shli_i32(t1, t1, ofs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
-     }
-     tcg_gen_andi_i32(ret, arg1, ~(mask << ofs));
-     tcg_gen_or_i32(ret, ret, t1);
--
-+ done:
-     tcg_temp_free_i32(t1);
- }
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
-         }
-     }
--    mask = (1ull << len) - 1;
-     t1 = tcg_temp_new_i64();
-+    if (TCG_TARGET_HAS_extract2_i64) {
-+        if (ofs + len == 64) {
-+            tcg_gen_shli_i64(t1, arg1, len);
-+            tcg_gen_extract2_i64(ret, t1, arg2, len);
-+            goto done;
-+        }
-+        if (ofs == 0) {
-+            tcg_gen_extract2_i64(ret, arg1, arg2, len);
-+            tcg_gen_rotli_i64(ret, ret, len);
-+            goto done;
-+        }
-+    }
-+
-+    mask = (1ull << len) - 1;
-     if (ofs + len < 64) {
-         tcg_gen_andi_i64(t1, arg2, mask);
-         tcg_gen_shli_i64(t1, t1, ofs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
-     }
-     tcg_gen_andi_i64(ret, arg1, ~(mask << ofs));
-     tcg_gen_or_i64(ret, ret, t1);
--
-+ done:
-     tcg_temp_free_i64(t1);
- }
---
-.17.1

-[Qemu-devel] [PULL 05/15] tcg/i386: Support INDEX_op_extract2_{i32, i64}
+Deleted patch
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/i386/tcg-target.h     |  4 ++--
- tcg/i386/tcg-target.inc.c | 11 +++++++++++
-files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.h
-+++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
--#define TCG_TARGET_HAS_extract2_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     1
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
--#define TCG_TARGET_HAS_extract2_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     1
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.inc.c
-+++ b/tcg/i386/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline int tcg_target_const_match(tcg_target_long val, TCGType type,
- #define OPC_SHUFPS      (0xc6 | P_EXT)
- #define OPC_SHLX        (0xf7 | P_EXT38 | P_DATA16)
- #define OPC_SHRX        (0xf7 | P_EXT38 | P_SIMDF2)
-+#define OPC_SHRD_Ib     (0xac | P_EXT)
- #define OPC_TESTL    (0x85)
- #define OPC_TZCNT       (0xbc | P_EXT | P_SIMDF3)
- #define OPC_UD2         (0x0b | P_EXT)
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         }
-         break;
-+    OP_32_64(extract2):
-+        /* Note that SHRD outputs to the r/m operand.  */
-+        tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
-+        tcg_out8(s, args[3]);
-+        break;
-+
-     case INDEX_op_mb:
-         tcg_out_mb(s, a0);
-         break;
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-     static const TCGTargetOpDef r_0 = { .args_ct_str = { "r", "0" } };
-     static const TCGTargetOpDef r_r_ri = { .args_ct_str = { "r", "r", "ri" } };
-     static const TCGTargetOpDef r_r_re = { .args_ct_str = { "r", "r", "re" } };
-+    static const TCGTargetOpDef r_0_r = { .args_ct_str = { "r", "0", "r" } };
-     static const TCGTargetOpDef r_0_re = { .args_ct_str = { "r", "0", "re" } };
-     static const TCGTargetOpDef r_0_ci = { .args_ct_str = { "r", "0", "ci" } };
-     static const TCGTargetOpDef r_L = { .args_ct_str = { "r", "L" } };
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-     case INDEX_op_ctpop_i32:
-     case INDEX_op_ctpop_i64:
-         return &r_r;
-+    case INDEX_op_extract2_i32:
-+    case INDEX_op_extract2_i64:
-+        return &r_0_r;
-     case INDEX_op_deposit_i32:
-     case INDEX_op_deposit_i64:
---
-.17.1

-[Qemu-devel] [PULL 13/15] tcg/ppc: Allow the constant pool to overflow at 32k
+Deleted patch
-There is no point in coding for a 2GB offset when the max TB size
-is already limited to 64k.  If we further restrict to 32k then we
-can eliminate the extra ADDIS instruction.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.inc.c | 28 ++++++++++------------------
-file changed, 10 insertions(+), 18 deletions(-)
-diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.inc.c
-+++ b/tcg/ppc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-                         intptr_t value, intptr_t addend)
- {
-     tcg_insn_unit *target;
--    tcg_insn_unit old;
-     value += addend;
-     target = (tcg_insn_unit *)value;
-@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-     case R_PPC_REL24:
-         return reloc_pc24(code_ptr, target);
-     case R_PPC_ADDR16:
--        /* We are abusing this relocation type.  This points to a pair
--           of insns, addis + load.  If the displacement is small, we
--           can nop out the addis.  */
--        if (value == (int16_t)value) {
--            code_ptr[0] = NOP;
--            old = deposit32(code_ptr[1], 0, 16, value);
--            code_ptr[1] = deposit32(old, 16, 5, TCG_REG_TB);
--        } else {
--            int16_t lo = value;
--            int hi = value - lo;
--            if (hi + lo != value) {
--                return false;
--            }
--            code_ptr[0] = deposit32(code_ptr[0], 0, 16, hi >> 16);
--            code_ptr[1] = deposit32(code_ptr[1], 0, 16, lo);
-+        /*
-+         * We are (slightly) abusing this relocation type.  In particular,
-+         * assert that the low 2 bits are zero, and do not modify them.
-+         * That way we can use this with LD et al that have opcode bits
-+         * in the low 2 bits of the insn.
-+         */
-+        if ((value & 3) || value != (int16_t)value) {
-+            return false;
-         }
-+        *code_ptr = (*code_ptr & ~0xfffc) | (value & 0xfffc);
-         break;
-     default:
-         g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
-     if (!in_prologue && USE_REG_TB) {
-         new_pool_label(s, arg, R_PPC_ADDR16, s->code_ptr,
-                        -(intptr_t)s->code_gen_ptr);
--        tcg_out32(s, ADDIS | TAI(ret, TCG_REG_TB, 0));
--        tcg_out32(s, LD | TAI(ret, ret, 0));
-+        tcg_out32(s, LD | TAI(ret, TCG_REG_TB, 0));
-         return;
-     }
---
-.17.1

The following changes since commit 3284aa128153750f14a61e8a96fd085e6f2999b6:

Merge remote-tracking branch 'remotes/lersek/tags/edk2-pull-2019-04-22' into staging (2019-04-24 13:19:41 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20190426

for you to fetch changes up to ef5dae6805cce7b59d129d801bdc5db71bcbd60d:

cputlb: Fix io_readx() to respect the access_type (2019-04-25 10:40:06 -0700)

----------------------------------------------------------------
Add tcg_gen_extract2_*.
Deal with overflow of TranslationBlocks.
Respect access_type in io_readx.

----------------------------------------------------------------
David Hildenbrand (1):
      tcg: Implement tcg_gen_extract2_{i32,i64}

Richard Henderson (13):
      tcg: Add INDEX_op_extract2_{i32,i64}
      tcg: Use deposit and extract2 in tcg_gen_shifti_i64
      tcg: Use extract2 in tcg_gen_deposit_{i32,i64}
      tcg/i386: Support INDEX_op_extract2_{i32,i64}
      tcg/arm: Support INDEX_op_extract2_i32
      tcg/aarch64: Support INDEX_op_extract2_{i32,i64}
      tcg: Hoist max_insns computation to tb_gen_code
      tcg: Restart after TB code generation overflow
      tcg: Restart TB generation after relocation overflow
      tcg: Restart TB generation after constant pool overflow
      tcg: Restart TB generation after out-of-line ldst overflow
      tcg/ppc: Allow the constant pool to overflow at 32k
      tcg/arm: Restrict constant pool displacement to 12 bits

Shahab Vahedi (1):
      cputlb: Fix io_readx() to respect the access_type

From: David Hildenbrand <david@redhat.com>

Will be helpful for s390x. Input 128 bit and output 64 bit only,
which is sufficient for now.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190225154204.26751-1-david@redhat.com>
[rth: Add matching tcg_gen_extract2_i32.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.h |  6 ++++++
 tcg/tcg-op.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
                          unsigned int ofs, unsigned int len);
 void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
                           unsigned int ofs, unsigned int len);
+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
+                          unsigned int ofs);
 void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, TCGLabel *);
 void tcg_gen_brcondi_i32(TCGCond cond, TCGv_i32 arg1, int32_t arg2, TCGLabel *);
 void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
                          unsigned int ofs, unsigned int len);
 void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
                           unsigned int ofs, unsigned int len);
+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
+                          unsigned int ofs);
 void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, TCGLabel *);
 void tcg_gen_brcondi_i64(TCGCond cond, TCGv_i64 arg1, int64_t arg2, TCGLabel *);
 void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i64
 #define tcg_gen_extract_tl tcg_gen_extract_i64
 #define tcg_gen_sextract_tl tcg_gen_sextract_i64
+#define tcg_gen_extract2_tl tcg_gen_extract2_i64
 #define tcg_const_tl tcg_const_i64
 #define tcg_const_local_tl tcg_const_local_i64
 #define tcg_gen_movcond_tl tcg_gen_movcond_i64
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i32
 #define tcg_gen_extract_tl tcg_gen_extract_i32
 #define tcg_gen_sextract_tl tcg_gen_sextract_i32
+#define tcg_gen_extract2_tl tcg_gen_extract2_i32
 #define tcg_const_tl tcg_const_i32
 #define tcg_const_local_tl tcg_const_local_i32
 #define tcg_gen_movcond_tl tcg_gen_movcond_i32
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
     tcg_gen_sari_i32(ret, ret, 32 - len);
 }
 
+/*
+ * Extract 32-bits from a 64-bit input, ah:al, starting from ofs.
+ * Unlike tcg_gen_extract_i32 above, len is fixed at 32.
+ */
+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
+                          unsigned int ofs)
+{
+    tcg_debug_assert(ofs <= 32);
+    if (ofs == 0) {
+        tcg_gen_mov_i32(ret, al);
+    } else if (ofs == 32) {
+        tcg_gen_mov_i32(ret, ah);
+    } else if (al == ah) {
+        tcg_gen_rotri_i32(ret, al, ofs);
+    } else {
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        tcg_gen_shri_i32(t0, al, ofs);
+        tcg_gen_deposit_i32(ret, t0, ah, 32 - ofs, ofs);
+        tcg_temp_free_i32(t0);
+    }
+}
+
 void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
                          TCGv_i32 c2, TCGv_i32 v1, TCGv_i32 v2)
 {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
     tcg_gen_sari_i64(ret, ret, 64 - len);
 }
 
+/*
+ * Extract 64 bits from a 128-bit input, ah:al, starting from ofs.
+ * Unlike tcg_gen_extract_i64 above, len is fixed at 64.
+ */
+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
+                          unsigned int ofs)
+{
+    tcg_debug_assert(ofs <= 64);
+    if (ofs == 0) {
+        tcg_gen_mov_i64(ret, al);
+    } else if (ofs == 64) {
+        tcg_gen_mov_i64(ret, ah);
+    } else if (al == ah) {
+        tcg_gen_rotri_i64(ret, al, ofs);
+    } else {
+        TCGv_i64 t0 = tcg_temp_new_i64();
+        tcg_gen_shri_i64(t0, al, ofs);
+        tcg_gen_deposit_i64(ret, t0, ah, 64 - ofs, ofs);
+        tcg_temp_free_i64(t0);
+    }
+}
+
 void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
                          TCGv_i64 c2, TCGv_i64 v1, TCGv_i64 v2)
 {
-- 
2.17.1

This will let backends implement the double-word shift operation.

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     1
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_mips32r2_instructions
 #define TCG_TARGET_HAS_extract_i32      use_mips32r2_instructions
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_ext8s_i32        use_mips32r2_instructions
 #define TCG_TARGET_HAS_ext16s_i32       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_deposit_i64      use_mips32r2_instructions
 #define TCG_TARGET_HAS_extract_i64      use_mips32r2_instructions
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_ext8s_i64        use_mips32r2_instructions
 #define TCG_TARGET_HAS_ext16s_i64       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i32      0
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extrl_i64_i32    1
 #define TCG_TARGET_HAS_extrh_i64_i32    1
 #define TCG_TARGET_HAS_ext8s_i64        1
diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.h
+++ b/tcg/s390/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
 #define TCG_TARGET_HAS_deposit_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_extract_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_sextract_i32   0
+#define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_movcond_i32    1
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
 #define TCG_TARGET_HAS_deposit_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_extract_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_sextract_i64   0
+#define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_movcond_i64    1
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.h
+++ b/tcg/sparc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_deposit_i32      0
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-opc.h
+++ b/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(rotr_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rot_i32))
 DEF(deposit_i32, 1, 2, 2, IMPL(TCG_TARGET_HAS_deposit_i32))
 DEF(extract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_extract_i32))
 DEF(sextract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_sextract_i32))
+DEF(extract2_i32, 1, 2, 1, IMPL(TCG_TARGET_HAS_extract2_i32))
 
 DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END)
 
@@ -XXX,XX +XXX,XX @@ DEF(rotr_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rot_i64))
 DEF(deposit_i64, 1, 2, 2, IMPL64 | IMPL(TCG_TARGET_HAS_deposit_i64))
 DEF(extract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_extract_i64))
 DEF(sextract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_sextract_i64))
+DEF(extract2_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_extract2_i64))
 
 /* size changing ops */
 DEF(ext_i32_i64, 1, 1, 0, IMPL64)
diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          0
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        1
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        CASE_OP_32_64(extract2):
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                TCGArg v1 = arg_info(op->args[1])->val;
+                TCGArg v2 = arg_info(op->args[2])->val;
+
+                if (opc == INDEX_op_extract2_i64) {
+                    tmp = (v1 >> op->args[3]) | (v2 << (64 - op->args[3]));
+                } else {
+                    tmp = (v1 >> op->args[3]) | (v2 << (32 - op->args[3]));
+                    tmp = (int32_t)tmp;
+                }
+                tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                break;
+            }
+            goto do_default;
+
         CASE_OP_32_64(setcond):
             tmp = do_constant_folding_cond(opc, op->args[1],
                                            op->args[2], op->args[3]);
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
         tcg_gen_mov_i32(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i32(ret, al, ofs);
+    } else if (TCG_TARGET_HAS_extract2_i32) {
+        tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
     } else {
         TCGv_i32 t0 = tcg_temp_new_i32();
         tcg_gen_shri_i32(t0, al, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
         tcg_gen_mov_i64(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i64(ret, al, ofs);
+    } else if (TCG_TARGET_HAS_extract2_i64) {
+        tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
         tcg_gen_shri_i64(t0, al, ofs);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
         return TCG_TARGET_HAS_extract_i32;
     case INDEX_op_sextract_i32:
         return TCG_TARGET_HAS_sextract_i32;
+    case INDEX_op_extract2_i32:
+        return TCG_TARGET_HAS_extract2_i32;
     case INDEX_op_add2_i32:
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
         return TCG_TARGET_HAS_extract_i64;
     case INDEX_op_sextract_i64:
         return TCG_TARGET_HAS_sextract_i64;
+    case INDEX_op_extract2_i64:
+        return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_extrl_i64_i32:
         return TCG_TARGET_HAS_extrl_i64_i32;
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/README b/tcg/README
index XXXXXXX..XXXXXXX 100644
--- a/tcg/README
+++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ at bit 8.  This operation would be equivalent to
 
 (using an arithmetic right shift).
 
+* extract2_i32/i64 dest, t1, t2, pos
+
+For N = {32,64}, extract an N-bit quantity from the concatenation
+of t2:t1, beginning at pos.  The tcg_gen_extract2_{i32,i64} expander
+accepts 0 <= pos <= N as inputs.  The backend code generator will
+not see either 0 or N as inputs for these opcodes.
+
 * extrl_i64_i32 t0, t1
 
 For 64-bit hosts only, extract the low 32-bits of input T1 and place it
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 47 ++++++++++++++++++++++++-----------------------
 1 file changed, 24 insertions(+), 23 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_LOW(arg1), c);
             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
         }
-    } else {
-        TCGv_i32 t0, t1;
-
-        t0 = tcg_temp_new_i32();
-        t1 = tcg_temp_new_i32();
-        if (right) {
-            tcg_gen_shli_i32(t0, TCGV_HIGH(arg1), 32 - c);
-            if (arith) {
-                tcg_gen_sari_i32(t1, TCGV_HIGH(arg1), c);
-            } else {
-                tcg_gen_shri_i32(t1, TCGV_HIGH(arg1), c);
-            }
-            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
-            tcg_gen_or_i32(TCGV_LOW(ret), TCGV_LOW(ret), t0);
-            tcg_gen_mov_i32(TCGV_HIGH(ret), t1);
+    } else if (right) {
+        if (TCG_TARGET_HAS_extract2_i32) {
+            tcg_gen_extract2_i32(TCGV_LOW(ret),
+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
         } else {
-            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
-            /* Note: ret can be the same as arg1, so we use t1 */
-            tcg_gen_shli_i32(t1, TCGV_LOW(arg1), c);
-            tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
-            tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), t0);
-            tcg_gen_mov_i32(TCGV_LOW(ret), t1);
+            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
+            tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
+                                TCGV_HIGH(arg1), 32 - c, c);
         }
-        tcg_temp_free_i32(t0);
-        tcg_temp_free_i32(t1);
+        if (arith) {
+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
+        } else {
+            tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
+        }
+    } else {
+        if (TCG_TARGET_HAS_extract2_i32) {
+            tcg_gen_extract2_i32(TCGV_HIGH(ret),
+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
+        } else {
+            TCGv_i32 t0 = tcg_temp_new_i32();
+            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
+            tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
+                                TCGV_HIGH(arg1), c, 32 - c);
+            tcg_temp_free_i32(t0);
+        }
+        tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
     }
 }
 
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
         return;
     }
 
-    mask = (1u << len) - 1;
     t1 = tcg_temp_new_i32();
 
+    if (TCG_TARGET_HAS_extract2_i32) {
+        if (ofs + len == 32) {
+            tcg_gen_shli_i32(t1, arg1, len);
+            tcg_gen_extract2_i32(ret, t1, arg2, len);
+            goto done;
+        }
+        if (ofs == 0) {
+            tcg_gen_extract2_i32(ret, arg1, arg2, len);
+            tcg_gen_rotli_i32(ret, ret, len);
+            goto done;
+        }
+    }
+
+    mask = (1u << len) - 1;
     if (ofs + len < 32) {
         tcg_gen_andi_i32(t1, arg2, mask);
         tcg_gen_shli_i32(t1, t1, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
     }
     tcg_gen_andi_i32(ret, arg1, ~(mask << ofs));
     tcg_gen_or_i32(ret, ret, t1);
-
+ done:
     tcg_temp_free_i32(t1);
 }
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
         }
     }
 
-    mask = (1ull << len) - 1;
     t1 = tcg_temp_new_i64();
 
+    if (TCG_TARGET_HAS_extract2_i64) {
+        if (ofs + len == 64) {
+            tcg_gen_shli_i64(t1, arg1, len);
+            tcg_gen_extract2_i64(ret, t1, arg2, len);
+            goto done;
+        }
+        if (ofs == 0) {
+            tcg_gen_extract2_i64(ret, arg1, arg2, len);
+            tcg_gen_rotli_i64(ret, ret, len);
+            goto done;
+        }
+    }
+
+    mask = (1ull << len) - 1;
     if (ofs + len < 64) {
         tcg_gen_andi_i64(t1, arg2, mask);
         tcg_gen_shli_i64(t1, t1, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
     }
     tcg_gen_andi_i64(ret, arg1, ~(mask << ofs));
     tcg_gen_or_i64(ret, ret, t1);
-
+ done:
     tcg_temp_free_i64(t1);
 }
 
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |  4 ++--
 tcg/i386/tcg-target.inc.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
-#define TCG_TARGET_HAS_extract2_i32     0
+#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
-#define TCG_TARGET_HAS_extract2_i64     0
+#define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline int tcg_target_const_match(tcg_target_long val, TCGType type,
 #define OPC_SHUFPS      (0xc6 | P_EXT)
 #define OPC_SHLX        (0xf7 | P_EXT38 | P_DATA16)
 #define OPC_SHRX        (0xf7 | P_EXT38 | P_SIMDF2)
+#define OPC_SHRD_Ib     (0xac | P_EXT)
 #define OPC_TESTL	(0x85)
 #define OPC_TZCNT       (0xbc | P_EXT | P_SIMDF3)
 #define OPC_UD2         (0x0b | P_EXT)
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
+    OP_32_64(extract2):
+        /* Note that SHRD outputs to the r/m operand.  */
+        tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
+        tcg_out8(s, args[3]);
+        break;
+
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
     static const TCGTargetOpDef r_0 = { .args_ct_str = { "r", "0" } };
     static const TCGTargetOpDef r_r_ri = { .args_ct_str = { "r", "r", "ri" } };
     static const TCGTargetOpDef r_r_re = { .args_ct_str = { "r", "r", "re" } };
+    static const TCGTargetOpDef r_0_r = { .args_ct_str = { "r", "0", "r" } };
     static const TCGTargetOpDef r_0_re = { .args_ct_str = { "r", "0", "re" } };
     static const TCGTargetOpDef r_0_ci = { .args_ct_str = { "r", "0", "ci" } };
     static const TCGTargetOpDef r_L = { .args_ct_str = { "r", "L" } };
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
     case INDEX_op_ctpop_i32:
     case INDEX_op_ctpop_i64:
         return &r_r;
+    case INDEX_op_extract2_i32:
+    case INDEX_op_extract2_i64:
+        return &r_0_r;
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-- 
2.17.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |  2 +-
 tcg/arm/tcg-target.inc.c | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
-#define TCG_TARGET_HAS_extract2_i32     0
+#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_sextract_i32:
         tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
+    case INDEX_op_extract2_i32:
+        /* ??? These optimization vs zero should be generic.  */
+        /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
+        if (const_args[1]) {
+            if (const_args[2]) {
+                tcg_out_movi(s, TCG_TYPE_REG, args[0], 0);
+            } else {
+                tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
+                                args[2], SHIFT_IMM_LSL(32 - args[3]));
+            }
+        } else if (const_args[2]) {
+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
+                            args[1], SHIFT_IMM_LSR(args[3]));
+        } else {
+            /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0,
+                            args[2], SHIFT_IMM_LSL(32 - args[3]));
+            tcg_out_dat_reg(s, COND_AL, ARITH_ORR, args[0], TCG_REG_TMP,
+                            args[1], SHIFT_IMM_LSR(args[3]));
+        }
+        break;
 
     case INDEX_op_div_i32:
         tcg_out_sdiv(s, COND_AL, args[0], args[1], args[2]);
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
         = { .args_ct_str = { "s", "s", "s", "s" } };
     static const TCGTargetOpDef br
         = { .args_ct_str = { "r", "rIN" } };
+    static const TCGTargetOpDef ext2
+        = { .args_ct_str = { "r", "rZ", "rZ" } };
     static const TCGTargetOpDef dep
         = { .args_ct_str = { "r", "0", "rZ" } };
     static const TCGTargetOpDef movc
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
         return &br;
     case INDEX_op_deposit_i32:
         return &dep;
+    case INDEX_op_extract2_i32:
+        return &ext2;
     case INDEX_op_movcond_i32:
         return &movc;
     case INDEX_op_add2_i32:
-- 
2.17.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h     |  4 ++--
 tcg/aarch64/tcg-target.inc.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

In order to handle TB's that translate to too much code, we
need to place the control of the length of the translation
in the hands of the code gen master loop.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  4 ++--
 include/exec/translator.h     |  3 ++-
 accel/tcg/translate-all.c     | 15 +++++++++++++--
 accel/tcg/translator.c        | 15 ++-------------
 target/alpha/translate.c      |  4 ++--
 target/arm/translate.c        |  4 ++--
 target/cris/translate.c       | 10 +---------
 target/hppa/translate.c       |  5 ++---
 target/i386/translate.c       |  4 ++--
 target/lm32/translate.c       | 10 +---------
 target/m68k/translate.c       |  4 ++--
 target/microblaze/translate.c | 10 +---------
 target/mips/translate.c       |  4 ++--
 target/moxie/translate.c      | 11 ++---------
 target/nios2/translate.c      | 14 ++------------
 target/openrisc/translate.c   |  4 ++--
 target/ppc/translate.c        |  4 ++--
 target/riscv/translate.c      |  4 ++--
 target/s390x/translate.c      |  4 ++--
 target/sh4/translate.c        |  4 ++--
 target/sparc/translate.c      |  4 ++--
 target/tilegx/translate.c     | 12 +-----------
 target/tricore/translate.c    | 16 ++--------------
 target/unicore32/translate.c  | 10 +---------
 target/xtensa/translate.c     |  4 ++--
 25 files changed, 56 insertions(+), 127 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 
 #include "qemu/log.h"
 
-void gen_intermediate_code(CPUState *cpu, struct TranslationBlock *tb);
-void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
+void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
 void cpu_gen_init(void);
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
+ * @max_insns: Maximum number of insns to translate.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When too many instructions have been translated.
  */
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb);
+                     CPUState *cpu, TranslationBlock *tb, int max_insns);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb_page_addr_t phys_pc, phys_page2;
     target_ulong virt_page2;
     tcg_insn_unit *gen_code_buf;
-    int gen_code_size, search_size;
+    int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     cflags &= ~CF_CLUSTER_MASK;
     cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
 
+    max_insns = cflags & CF_COUNT_MASK;
+    if (max_insns == 0) {
+        max_insns = CF_COUNT_MASK;
+    }
+    if (max_insns > TCG_MAX_INSNS) {
+        max_insns = TCG_MAX_INSNS;
+    }
+    if (cpu->singlestep_enabled || singlestep) {
+        max_insns = 1;
+    }
+
  buffer_overflow:
     tb = tb_alloc(pc);
     if (unlikely(!tb)) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = ENV_GET_CPU(env);
-    gen_intermediate_code(cpu, tb);
+    gen_intermediate_code(cpu, tb, max_insns);
     tcg_ctx->cpu = NULL;
 
     trace_translate_block(tb, tb->pc, tb->tc.ptr);
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ void translator_loop_temp_check(DisasContextBase *db)
 }
 
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb)
+                     CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     int bp_insn = 0;
 
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     db->pc_next = db->pc_first;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
+    db->max_insns = max_insns;
     db->singlestep_enabled = cpu->singlestep_enabled;
 
-    /* Instruction counting */
-    db->max_insns = tb_cflags(db->tb) & CF_COUNT_MASK;
-    if (db->max_insns == 0) {
-        db->max_insns = CF_COUNT_MASK;
-    }
-    if (db->max_insns > TCG_MAX_INSNS) {
-        db->max_insns = TCG_MAX_INSNS;
-    }
-    if (db->singlestep_enabled || singlestep) {
-        db->max_insns = 1;
-    }
-
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb);
+    translator_loop(ops, &dc.base, cpu, tb, max_insns);
 }
 
 void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
  */
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUCRISState *env = cs->env_ptr;
     uint32_t pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t page_start;
     target_ulong npc;
     int num_insns;
-    int max_insns;
 
     if (env->pregs[PR_VR] == 32) {
         dc->decoder = crisv32_decoder;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/translate.c b/target/i386/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/translate.c
+++ b/target/i386/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/lm32/translate.c b/target/lm32/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/translate.c
+++ b/target/lm32/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPULM32State *env = cs->env_ptr;
     LM32CPU *cpu = lm32_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t pc_start;
     uint32_t page_start;
     int num_insns;
-    int max_insns;
 
     pc_start = tb->pc;
     dc->features = cpu->features;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUMBState *env = cs->env_ptr;
     MicroBlazeCPU *cpu = mb_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t page_start, org_flags;
     uint32_t npc;
     int num_insns;
-    int max_insns;
 
     pc_start = tb->pc;
     dc->cpu = cpu;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do
diff --git a/target/mips/translate.c b/target/mips/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 static void fpu_dump_state(CPUMIPSState *env, FILE *f, int flags)
diff --git a/target/moxie/translate.c b/target/moxie/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/translate.c
+++ b/target/moxie/translate.c
@@ -XXX,XX +XXX,XX @@ static int decode_opc(MoxieCPU *cpu, DisasContext *ctx)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUMoxieState *env = cs->env_ptr;
     MoxieCPU *cpu = moxie_env_get_cpu(env);
     DisasContext ctx;
     target_ulong pc_start;
-    int num_insns, max_insns;
+    int num_insns;
 
     pc_start = tb->pc;
     ctx.pc = pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     ctx.singlestep_enabled = 0;
     ctx.bstate = BS_NONE;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUNios2State *env = cs->env_ptr;
     DisasContext dc1, *dc = &dc1;
     int num_insns;
-    int max_insns;
 
     /* Initialize DC */
     dc->cpu_env = cpu_env;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 
     /* Set up instruction counts */
     num_insns = 0;
-    if (cs->singlestep_enabled || singlestep) {
-        max_insns = 1;
-    } else {
+    if (max_insns > 1) {
         int page_insns = (TARGET_PAGE_SIZE - (tb->pc & TARGET_PAGE_MASK)) / 4;
-        max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-        if (max_insns == 0) {
-            max_insns = CF_COUNT_MASK;
-        }
         if (max_insns > page_insns) {
             max_insns = page_insns;
         }
-        if (max_insns > TCG_MAX_INSNS) {
-            max_insns = TCG_MAX_INSNS;
-        }
     }
 
     gen_tb_start(tb);
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void riscv_translate_init(void)
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb);
+    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb);
+    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/translate.c
+++ b/target/tilegx/translate.c
@@ -XXX,XX +XXX,XX @@ static void translate_one_bundle(DisasContext *dc, uint64_t bundle)
     }
 }
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUTLGState *env = cs->env_ptr;
     DisasContext ctx;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint64_t pc_start = tb->pc;
     uint64_t page_start = pc_start & TARGET_PAGE_MASK;
     int num_insns = 0;
-    int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 
     dc->pc = pc_start;
     dc->mmuidx = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
         qemu_log_lock();
         qemu_log("IN: %s\n", lookup_symbol(pc_start));
     }
-    if (!max_insns) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (cs->singlestep_enabled || singlestep) {
-        max_insns = 1;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
     gen_tb_start(tb);
 
     while (1) {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPUTriCoreState *env, DisasContext *ctx, int *is_branch)
     }
 }
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUTriCoreState *env = cs->env_ptr;
     DisasContext ctx;
     target_ulong pc_start;
-    int num_insns, max_insns;
-
-    num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (singlestep) {
-        max_insns = 1;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
+    int num_insns = 0;
 
     pc_start = tb->pc;
     ctx.pc = pc_start;
diff --git a/target/unicore32/translate.c b/target/unicore32/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/translate.c
+++ b/target/unicore32/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUUniCore32State *env = cs->env_ptr;
     DisasContext dc1, *dc = &dc1;
     target_ulong pc_start;
     uint32_t page_start;
     int num_insns;
-    int max_insns;
 
     /* generate intermediate code */
     num_temps = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
     cpu_F1d = tcg_temp_new_i64();
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
 #ifndef CONFIG_USER_ONLY
     if ((env->uncached_asr & ASR_M) == ASR_MODE_USER) {
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb);
+    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.17.1

If a TB generates too much code, try again with fewer insns.

Fixes: https://bugs.launchpad.net/bugs/1824853
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 38 ++++++++++++++++++++++++++++++++------
 tcg/tcg.c                 |  4 ++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
     tcg_ctx->tb_cflags = cflags;
+ tb_overflow:
 
 #ifdef CONFIG_PROFILER
     /* includes aborted translations because of exceptions */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     ti = profile_getclock();
 #endif
 
-    /* ??? Overflow could be handled better here.  In particular, we
-       don't need to re-do gen_intermediate_code, nor should we re-do
-       the tcg optimization currently hidden inside tcg_gen_code.  All
-       that should be required is to flush the TBs, allocate a new TB,
-       re-initialize it per above, and re-do the actual code generation.  */
     gen_code_size = tcg_gen_code(tcg_ctx, tb);
     if (unlikely(gen_code_size < 0)) {
-        goto buffer_overflow;
+        switch (gen_code_size) {
+        case -1:
+            /*
+             * Overflow of code_gen_buffer, or the current slice of it.
+             *
+             * TODO: We don't need to re-do gen_intermediate_code, nor
+             * should we re-do the tcg optimization currently hidden
+             * inside tcg_gen_code.  All that should be required is to
+             * flush the TBs, allocate a new TB, re-initialize it per
+             * above, and re-do the actual code generation.
+             */
+            goto buffer_overflow;
+
+        case -2:
+            /*
+             * The code generated for the TranslationBlock is too large.
+             * The maximum size allowed by the unwind info is 64k.
+             * There may be stricter constraints from relocations
+             * in the tcg backend.
+             *
+             * Try again with half as many insns as we attempted this time.
+             * If a single insn overflows, there's a bug somewhere...
+             */
+            max_insns = tb->icount;
+            assert(max_insns > 1);
+            max_insns /= 2;
+            goto tb_overflow;
+
+        default:
+            g_assert_not_reached();
+        }
     }
     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
     if (unlikely(search_size < 0)) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
             return -1;
         }
+        /* Test for TB overflow, as seen by gen_insn_end_off.  */
+        if (unlikely(tcg_current_code_size(s) > UINT16_MAX)) {
+            return -2;
+        }
     }
     tcg_debug_assert(num_insns >= 0);
     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
-- 
2.17.1

If the TB generates too much code, such that backend relocations
overflow, try again with a smaller TB.  In support of this, move
relocation processing from a random place within tcg_out_op, in
the handling of branch opcodes, to a new function at the end of
tcg_gen_code.

This is not a complete solution, as there are additional relocs
generated for out-of-line ldst handling and constant pools.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.h | 15 +++++++-------
 tcg/tcg.c | 61 ++++++++++++++++++++++++++-----------------------------
 2 files changed, 36 insertions(+), 40 deletions(-)

diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t tcg_insn_unit;
     do { if (!(X)) { __builtin_unreachable(); } } while (0)
 #endif
 
-typedef struct TCGRelocation {
-    struct TCGRelocation *next;
-    int type;
+typedef struct TCGRelocation TCGRelocation;
+struct TCGRelocation {
+    QSIMPLEQ_ENTRY(TCGRelocation) next;
     tcg_insn_unit *ptr;
     intptr_t addend;
-} TCGRelocation; 
+    int type;
+};
 
 typedef struct TCGLabel TCGLabel;
 struct TCGLabel {
@@ -XXX,XX +XXX,XX @@ struct TCGLabel {
     union {
         uintptr_t value;
         tcg_insn_unit *value_ptr;
-        TCGRelocation *first_reloc;
     } u;
-#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_HEAD(, TCGRelocation) relocs;
     QSIMPLEQ_ENTRY(TCGLabel) next;
-#endif
 };
 
 typedef struct TCGPool {
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
 #endif
 
 #ifdef CONFIG_DEBUG_TCG
-    QSIMPLEQ_HEAD(, TCGLabel) labels;
     int temps_in_use;
     int goto_tb_issue_mask;
 #endif
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
     TCGTemp temps[TCG_MAX_TEMPS]; /* globals first, temps after */
 
     QTAILQ_HEAD(, TCGOp) ops, free_ops;
+    QSIMPLEQ_HEAD(, TCGLabel) labels;
 
     /* Tells which temporary holds a given register.
        It does not take into account fixed registers */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static __attribute__((unused)) inline void tcg_patch64(tcg_insn_unit *p,
 static void tcg_out_reloc(TCGContext *s, tcg_insn_unit *code_ptr, int type,
                           TCGLabel *l, intptr_t addend)
 {
-    TCGRelocation *r;
+    TCGRelocation *r = tcg_malloc(sizeof(TCGRelocation));
 
-    if (l->has_value) {
-        /* FIXME: This may break relocations on RISC targets that
-           modify instruction fields in place.  The caller may not have 
-           written the initial value.  */
-        bool ok = patch_reloc(code_ptr, type, l->u.value, addend);
-        tcg_debug_assert(ok);
-    } else {
-        /* add a new relocation entry */
-        r = tcg_malloc(sizeof(TCGRelocation));
-        r->type = type;
-        r->ptr = code_ptr;
-        r->addend = addend;
-        r->next = l->u.first_reloc;
-        l->u.first_reloc = r;
-    }
+    r->type = type;
+    r->ptr = code_ptr;
+    r->addend = addend;
+    QSIMPLEQ_INSERT_TAIL(&l->relocs, r, next);
 }
 
 static void tcg_out_label(TCGContext *s, TCGLabel *l, tcg_insn_unit *ptr)
 {
-    intptr_t value = (intptr_t)ptr;
-    TCGRelocation *r;
-
     tcg_debug_assert(!l->has_value);
-
-    for (r = l->u.first_reloc; r != NULL; r = r->next) {
-        bool ok = patch_reloc(r->ptr, r->type, value, r->addend);
-        tcg_debug_assert(ok);
-    }
-
     l->has_value = 1;
     l->u.value_ptr = ptr;
 }
@@ -XXX,XX +XXX,XX @@ TCGLabel *gen_new_label(void)
     TCGContext *s = tcg_ctx;
     TCGLabel *l = tcg_malloc(sizeof(TCGLabel));
 
-    *l = (TCGLabel){
-        .id = s->nb_labels++
-    };
-#ifdef CONFIG_DEBUG_TCG
+    memset(l, 0, sizeof(TCGLabel));
+    l->id = s->nb_labels++;
+    QSIMPLEQ_INIT(&l->relocs);
+
     QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
-#endif
 
     return l;
 }
 
+static bool tcg_resolve_relocs(TCGContext *s)
+{
+    TCGLabel *l;
+
+    QSIMPLEQ_FOREACH(l, &s->labels, next) {
+        TCGRelocation *r;
+        uintptr_t value = l->u.value;
+
+        QSIMPLEQ_FOREACH(r, &l->relocs, next) {
+            if (!patch_reloc(r->ptr, r->type, value, r->addend)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
 static void set_jmp_reset_offset(TCGContext *s, int which)
 {
     size_t off = tcg_current_code_size(s);
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
 
     QTAILQ_INIT(&s->ops);
     QTAILQ_INIT(&s->free_ops);
-#ifdef CONFIG_DEBUG_TCG
     QSIMPLEQ_INIT(&s->labels);
-#endif
 }
 
 static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
         return -1;
     }
 #endif
+    if (!tcg_resolve_relocs(s)) {
+        return -2;
+    }
 
     /* flush instruction cache */
     flush_icache_range((uintptr_t)s->code_buf, (uintptr_t)s->code_ptr);
-- 
2.17.1

This is part b of relocation overflow handling.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-pool.inc.c | 12 +++++++-----
 tcg/tcg.c          |  9 +++++----
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/tcg/tcg-pool.inc.c b/tcg/tcg-pool.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-pool.inc.c
+++ b/tcg/tcg-pool.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void new_pool_l8(TCGContext *s, int rtype, tcg_insn_unit *label,
 /* To be provided by cpu/tcg-target.inc.c.  */
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count);
 
-static bool tcg_out_pool_finalize(TCGContext *s)
+static int tcg_out_pool_finalize(TCGContext *s)
 {
     TCGLabelPoolData *p = s->pool_labels;
     TCGLabelPoolData *l = NULL;
     void *a;
 
     if (p == NULL) {
-        return true;
+        return 0;
     }
 
     /* ??? Round up to qemu_icache_linesize, but then do not round
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_pool_finalize(TCGContext *s)
         size_t size = sizeof(tcg_target_ulong) * p->nlong;
         if (!l || l->nlong != p->nlong || memcmp(l->data, p->data, size)) {
             if (unlikely(a > s->code_gen_highwater)) {
-                return false;
+                return -1;
             }
             memcpy(a, p->data, size);
             a += size;
             l = p;
         }
-        patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend);
+        if (!patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend)) {
+            return -2;
+        }
     }
 
     s->code_ptr = a;
-    return true;
+    return 0;
 }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
 #ifdef TCG_TARGET_NEED_POOL_LABELS
     /* Allow the prologue to put e.g. guest_base into a pool entry.  */
     {
-        bool ok = tcg_out_pool_finalize(s);
-        tcg_debug_assert(ok);
+        int result = tcg_out_pool_finalize(s);
+        tcg_debug_assert(result == 0);
     }
 #endif
 
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     }
 #endif
 #ifdef TCG_TARGET_NEED_POOL_LABELS
-    if (!tcg_out_pool_finalize(s)) {
-        return -1;
+    i = tcg_out_pool_finalize(s);
+    if (i < 0) {
+        return i;
     }
 #endif
     if (!tcg_resolve_relocs(s)) {
-- 
2.17.1

This is part c of relocation overflow handling.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.inc.c | 16 ++++++++++------
 tcg/arm/tcg-target.inc.c     | 16 ++++++++++------
 tcg/i386/tcg-target.inc.c    |  6 ++++--
 tcg/mips/tcg-target.inc.c    |  6 ++++--
 tcg/ppc/tcg-target.inc.c     | 14 ++++++++++----
 tcg/riscv/tcg-target.inc.c   | 16 ++++++++++++----
 tcg/s390/tcg-target.inc.c    | 20 ++++++++++++--------
 tcg/tcg-ldst.inc.c           | 18 +++++++++---------
 tcg/tcg.c                    |  7 ++++---
 9 files changed, 75 insertions(+), 44 deletions(-)

diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.inc.c
+++ b/tcg/aarch64/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
     tcg_out_insn(s, 3406, ADR, rd, offset);
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp size = opc & MO_SIZE;
 
-    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
     tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_goto(s, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp size = opc & MO_SIZE;
 
-    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
     tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_adr(s, TCG_REG_X4, lb->raddr);
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
     tcg_out_goto(s, lb->raddr);
+    return true;
 }
 
 static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     void *func;
 
-    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     argreg = tcg_out_arg_reg32(s, TCG_REG_R0, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_goto(s, COND_AL, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     argreg = TCG_REG_R0;
     argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 
     /* Tail-call to the helper, which will return to the fast path.  */
     tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    return true;
 }
 #endif /* SOFTMMU */
 
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
 /*
  * Generate code for the slow path for a load at the end of block
  */
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
     /* Jump to the code corresponding to next IR of qemu_st */
     tcg_out_jmp(s, l->raddr);
+    return true;
 }
 
 /*
  * Generate code for the slow path for a store at the end of block
  */
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     /* "Tail call" to the helper, with the return address back inline.  */
     tcg_out_push(s, retaddr);
     tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    return true;
 }
 #elif TCG_TARGET_REG_BITS == 32
 # define x86_guest_base_seg     0
diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.inc.c
+++ b/tcg/mips/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
     }
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     } else {
         tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
     }
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)], true);
     /* delay slot */
     tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
+    return true;
 }
 #endif
 
diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = lptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGReg hi, lo, arg = TCG_REG_R3;
 
-    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_b(s, 0, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp s_bits = opc & MO_SIZE;
     TCGReg hi, lo, arg = TCG_REG_R3;
 
-    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 
     tcg_out_b(s, 0, lb->raddr);
+    return true;
 }
 #endif /* SOFTMMU */
 
diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.inc.c
+++ b/tcg/riscv/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr[0];
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     }
 
     /* resolve label address */
-    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
+                     (intptr_t) s->code_ptr, 0)) {
+        return false;
+    }
 
     /* call load helper */
     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
 
     tcg_out_goto(s, l->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     }
 
     /* resolve label address */
-    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
+                     (intptr_t) s->code_ptr, 0)) {
+        return false;
+    }
 
     /* call store helper */
     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
 
     tcg_out_goto(s, l->raddr);
+    return true;
 }
 #endif /* CONFIG_SOFTMMU */
 
diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.inc.c
+++ b/tcg/s390/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                          (intptr_t)s->code_ptr, 2);
-    tcg_debug_assert(ok);
+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
+                     (intptr_t)s->code_ptr, 2)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_R2);
 
     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                          (intptr_t)s->code_ptr, 2);
-    tcg_debug_assert(ok);
+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
+                     (intptr_t)s->code_ptr, 2)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 
     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
+    return true;
 }
 #else
 static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
diff --git a/tcg/tcg-ldst.inc.c b/tcg/tcg-ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-ldst.inc.c
+++ b/tcg/tcg-ldst.inc.c
@@ -XXX,XX +XXX,XX @@ typedef struct TCGLabelQemuLdst {
  * Generate TB finalization at the end of block
  */
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
 
-static bool tcg_out_ldst_finalize(TCGContext *s)
+static int tcg_out_ldst_finalize(TCGContext *s)
 {
     TCGLabelQemuLdst *lb;
 
     /* qemu_ld/st slow paths */
     QSIMPLEQ_FOREACH(lb, &s->ldst_labels, next) {
-        if (lb->is_ld) {
-            tcg_out_qemu_ld_slow_path(s, lb);
-        } else {
-            tcg_out_qemu_st_slow_path(s, lb);
+        if (lb->is_ld
+            ? !tcg_out_qemu_ld_slow_path(s, lb)
+            : !tcg_out_qemu_st_slow_path(s, lb)) {
+            return -2;
         }
 
         /* Test for (pending) buffer overflow.  The assumption is that any
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_ldst_finalize(TCGContext *s)
            the buffer completely.  Thus we can test for overflow after
            generating code without having to check during generation.  */
         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
-            return false;
+            return -1;
         }
     }
-    return true;
+    return 0;
 }
 
 /*
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *target);
 static int tcg_target_const_match(tcg_target_long val, TCGType type,
                                   const TCGArgConstraint *arg_ct);
 #ifdef TCG_TARGET_NEED_LDST_LABELS
-static bool tcg_out_ldst_finalize(TCGContext *s);
+static int tcg_out_ldst_finalize(TCGContext *s);
 #endif
 
 #define TCG_HIGHWATER 1024
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
     /* Generate TB finalization at the end of block */
 #ifdef TCG_TARGET_NEED_LDST_LABELS
-    if (!tcg_out_ldst_finalize(s)) {
-        return -1;
+    i = tcg_out_ldst_finalize(s);
+    if (i < 0) {
+        return i;
     }
 #endif
 #ifdef TCG_TARGET_NEED_POOL_LABELS
-- 
2.17.1

There is no point in coding for a 2GB offset when the max TB size
is already limited to 64k.  If we further restrict to 32k then we
can eliminate the extra ADDIS instruction.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.inc.c | 28 ++++++++++------------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                         intptr_t value, intptr_t addend)
 {
     tcg_insn_unit *target;
-    tcg_insn_unit old;
 
     value += addend;
     target = (tcg_insn_unit *)value;
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
     case R_PPC_REL24:
         return reloc_pc24(code_ptr, target);
     case R_PPC_ADDR16:
-        /* We are abusing this relocation type.  This points to a pair
-           of insns, addis + load.  If the displacement is small, we
-           can nop out the addis.  */
-        if (value == (int16_t)value) {
-            code_ptr[0] = NOP;
-            old = deposit32(code_ptr[1], 0, 16, value);
-            code_ptr[1] = deposit32(old, 16, 5, TCG_REG_TB);
-        } else {
-            int16_t lo = value;
-            int hi = value - lo;
-            if (hi + lo != value) {
-                return false;
-            }
-            code_ptr[0] = deposit32(code_ptr[0], 0, 16, hi >> 16);
-            code_ptr[1] = deposit32(code_ptr[1], 0, 16, lo);
+        /*
+         * We are (slightly) abusing this relocation type.  In particular,
+         * assert that the low 2 bits are zero, and do not modify them.
+         * That way we can use this with LD et al that have opcode bits
+         * in the low 2 bits of the insn.
+         */
+        if ((value & 3) || value != (int16_t)value) {
+            return false;
         }
+        *code_ptr = (*code_ptr & ~0xfffc) | (value & 0xfffc);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     if (!in_prologue && USE_REG_TB) {
         new_pool_label(s, arg, R_PPC_ADDR16, s->code_ptr,
                        -(intptr_t)s->code_gen_ptr);
-        tcg_out32(s, ADDIS | TAI(ret, TCG_REG_TB, 0));
-        tcg_out32(s, LD | TAI(ret, ret, 0));
+        tcg_out32(s, LD | TAI(ret, TCG_REG_TB, 0));
         return;
     }
 
-- 
2.17.1

This will not necessarily restrict the size of the TB, since for v7
the majority of constant pool usage is for calls from the out-of-line
ldst code, which is already at the end of the TB.  But this does
allow us to save one insn per reference on the off-chance.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.inc.c | 57 +++++++++++++++-------------------------
 1 file changed, 21 insertions(+), 36 deletions(-)

diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline bool reloc_pc24(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
     return false;
 }
 
+static inline bool reloc_pc13(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
+{
+    ptrdiff_t offset = tcg_ptr_byte_diff(target, code_ptr) - 8;
+
+    if (offset >= -0xfff && offset <= 0xfff) {
+        tcg_insn_unit insn = *code_ptr;
+        bool u = (offset >= 0);
+        if (!u) {
+            offset = -offset;
+        }
+        insn = deposit32(insn, 23, 1, u);
+        insn = deposit32(insn, 0, 12, offset);
+        *code_ptr = insn;
+        return true;
+    }
+    return false;
+}
+
 static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                         intptr_t value, intptr_t addend)
 {
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
     if (type == R_ARM_PC24) {
         return reloc_pc24(code_ptr, (tcg_insn_unit *)value);
     } else if (type == R_ARM_PC13) {
-        intptr_t diff = value - (uintptr_t)(code_ptr + 2);
-        tcg_insn_unit insn = *code_ptr;
-        bool u;
-
-        if (diff >= -0xfff && diff <= 0xfff) {
-            u = (diff >= 0);
-            if (!u) {
-                diff = -diff;
-            }
-        } else {
-            int rd = extract32(insn, 12, 4);
-            int rt = rd == TCG_REG_PC ? TCG_REG_TMP : rd;
-
-            if (diff < 0x1000 || diff >= 0x100000) {
-                return false;
-            }
-
-            /* add rt, pc, #high */
-            *code_ptr++ = ((insn & 0xf0000000) | (1 << 25) | ARITH_ADD
-                           | (TCG_REG_PC << 16) | (rt << 12)
-                           | (20 << 7) | (diff >> 12));
-            /* ldr rd, [rt, #low] */
-            insn = deposit32(insn, 12, 4, rt);
-            diff &= 0xfff;
-            u = 1;
-        }
-        insn = deposit32(insn, 23, 1, u);
-        insn = deposit32(insn, 0, 12, diff);
-        *code_ptr = insn;
+        return reloc_pc13(code_ptr, (tcg_insn_unit *)value);
     } else {
         g_assert_not_reached();
     }
-    return true;
 }
 
 #define TCG_CT_CONST_ARM  0x100
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld8s_r(TCGContext *s, int cond, TCGReg rt,
 
 static void tcg_out_movi_pool(TCGContext *s, int cond, int rd, uint32_t arg)
 {
-    /* The 12-bit range on the ldr insn is sometimes a bit too small.
-       In order to get around that we require two insns, one of which
-       will usually be a nop, but may be replaced in patch_reloc.  */
     new_pool_label(s, arg, R_ARM_PC13, s->code_ptr, 0);
     tcg_out_ld32_12(s, cond, rd, TCG_REG_PC, 0);
-    tcg_out_nop(s);
 }
 
 static void tcg_out_movi32(TCGContext *s, int cond, int rd, uint32_t arg)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *addr)
         tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
         tcg_out_blx(s, COND_AL, TCG_REG_TMP);
     } else {
-        /* ??? Know that movi_pool emits exactly 2 insns.  */
-        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 4);
+        /* ??? Know that movi_pool emits exactly 1 insn.  */
+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 0);
         tcg_out_movi_pool(s, COND_AL, TCG_REG_PC, addri);
     }
 }
-- 
2.17.1

From: Shahab Vahedi <shahab.vahedi@gmail.com>

This change adapts io_readx() to its input access_type. Currently
io_readx() treats any memory access as a read, although it has an
input argument "MMUAccessType access_type". This results in:

1) Calling the tlb_fill() only with MMU_DATA_LOAD
2) Considering only entry->addr_read as the tlb_addr

Buglink: https://bugs.launchpad.net/qemu/+bug/1825359
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Shahab Vahedi <shahab.vahedi@gmail.com>
Message-Id: <20190420072236.12347-1-shahab.vahedi@gmail.com>
[rth: Remove assert; fix expression formatting.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         CPUTLBEntry *entry;
         target_ulong tlb_addr;
 
-        tlb_fill(cpu, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
+        tlb_fill(cpu, addr, size, access_type, mmu_idx, retaddr);
 
         entry = tlb_entry(env, mmu_idx, addr);
-        tlb_addr = entry->addr_read;
+        tlb_addr = (access_type == MMU_DATA_LOAD ?
+                    entry->addr_read : entry->addr_code);
         if (!(tlb_addr & ~(TARGET_PAGE_MASK | TLB_RECHECK))) {
             /* RAM access */
             uintptr_t haddr = addr + entry->addend;
-- 
2.17.1

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20201008

for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:

accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)

----------------------------------------------------------------
Extend maximum gvec vector size
Fix i386 avx2 dupi
Fix mips host user-only write detection
Misc cleanups.

----------------------------------------------------------------
Kele Huang (1):
      accel/tcg: Fix computing of is_write for MIPS

Richard Henderson (10):
      tcg: Adjust simd_desc size encoding
      tcg: Drop union from TCGArgConstraint
      tcg: Move sorted_args into TCGArgConstraint.sort_index
      tcg: Remove TCG_CT_REG
      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
      tcg: Remove TCGOpDef.used
      tcg/i386: Fix dupi for avx2 32-bit hosts
      tcg: Fix generation of dupi_vec for 32-bit host
      tcg/optimize: Fold dup2_vec
      tcg: Remove TCG_TARGET_HAS_cmp_vec

With larger vector sizes, it turns out oprsz == maxsz, and we only
need to represent mismatch for oprsz <= 32.  We do, however, need
to represent larger oprsz and do so without reducing SIMD_DATA_BITS.

Reduce the size of the oprsz field and increase the maxsz field.
Steal the oprsz value of 24 to indicate equality with maxsz.

Tested-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
 tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 2 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-gvec-desc.h
+++ b/include/tcg/tcg-gvec-desc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TCG_TCG_GVEC_DESC_H
 #define TCG_TCG_GVEC_DESC_H
 
-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
-#define SIMD_OPRSZ_SHIFT   0
-#define SIMD_OPRSZ_BITS    5
+/*
+ * This configuration allows MAXSZ to represent 2048 bytes, and
+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+ *
+ * Encode this with:
+ *   0, 1, 3 -> 8, 16, 32
+ *   2       -> maxsz
+ *
+ * This steals the input that would otherwise map to 24 to match maxsz.
+ */
+#define SIMD_MAXSZ_SHIFT   0
+#define SIMD_MAXSZ_BITS    8
 
-#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
-#define SIMD_MAXSZ_BITS    5
+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_OPRSZ_BITS    2
 
-#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
 
 /* Create a descriptor from components.  */
 uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 
-/* Extract the operation size from a descriptor.  */
-static inline intptr_t simd_oprsz(uint32_t desc)
-{
-    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
-}
-
 /* Extract the max vector size from a descriptor.  */
 static inline intptr_t simd_maxsz(uint32_t desc)
 {
-    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
+    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
+}
+
+/* Extract the operation size from a descriptor.  */
+static inline intptr_t simd_oprsz(uint32_t desc)
+{
+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+    intptr_t o = f * 8 + 8;
+    intptr_t m = simd_maxsz(desc);
+    return f == 2 ? m : o;
 }
 
 /* Extract the operation-specific data from a descriptor.  */
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
    of the operand offsets so that we can check them all at once.  */
 static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
 {
-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
-    tcg_debug_assert(oprsz > 0);
-    tcg_debug_assert(oprsz <= maxsz);
-    tcg_debug_assert((oprsz & opr_align) == 0);
+    uint32_t max_align;
+
+    switch (oprsz) {
+    case 8:
+    case 16:
+    case 32:
+        tcg_debug_assert(oprsz <= maxsz);
+        break;
+    default:
+        tcg_debug_assert(oprsz == maxsz);
+        break;
+    }
+    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
+
+    max_align = maxsz >= 16 ? 15 : 7;
     tcg_debug_assert((maxsz & max_align) == 0);
     tcg_debug_assert((ofs & max_align) == 0);
 }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
 {
     uint32_t desc = 0;
 
-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
+    check_size_align(oprsz, maxsz, 0);
+    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 
     oprsz = (oprsz / 8) - 1;
     maxsz = (maxsz / 8) - 1;
+
+    /*
+     * We have just asserted in check_size_align that either
+     * oprsz is {8,16,32} or matches maxsz.  Encode the final
+     * case with '2', as that would otherwise map to 24.
+     */
+    if (oprsz == maxsz) {
+        oprsz = 2;
+    }
+
     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
     desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
-- 
2.25.1

The union is unused; let "regs" appear in the main structure
without the "u.regs" wrapping.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h            |  4 +---
 tcg/tcg.c                    | 22 +++++++++++-----------
 tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
 tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
 tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
 tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
 tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
 tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
 tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
 tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
 tcg/tci/tcg-target.c.inc     |  2 +-
 11 files changed, 91 insertions(+), 93 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 typedef struct TCGArgConstraint {
     uint16_t ct;
     uint8_t alias_index;
-    union {
-        TCGRegSet regs;
-    } u;
+    TCGRegSet regs;
 } TCGArgConstraint;
 
 #define TCG_MAX_OP_ARGS 16
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
             return 0;
         n = 0;
         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->u.regs, i))
+            if (tcg_regset_test_reg(arg_ct->regs, i))
                 n++;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].u.regs = 0;
+            def->args_ct[i].regs = 0;
             def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     pset = la_temp_pref(ts);
                     set = *pset;
 
-                    set &= ct->u.regs;
+                    set &= ct->regs;
                     if (ct->ct & TCG_CT_IALIAS) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
                     if (set == 0) {
-                        set = ct->u.regs;
+                        set = ct->regs;
                     }
                     *pset = set;
                 }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
         return;
     }
 
-    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
-    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
+    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
+    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
 
     /* Allocate the output register now.  */
     if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             }
         }
 
-        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
+        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
         reg = ts->reg;
 
-        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
             /* nothing to do : the constraint is satisfied */
         } else {
         allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                and move the temporary register into it */
             temp_load(s, ts, tcg_target_available_regs[ts->type],
                       i_allocated_regs, 0);
-            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
+            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                 o_preferred_regs, ts->indirect_base);
             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
             } else if (arg_ct->ct & TCG_CT_NEWREG) {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             } else {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             }
             tcg_regset_set_reg(o_allocated_regs, reg);
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r': /* general registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffffu;
+        ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffff00000000ull;
+        ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffffu;
+        ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
            and x2, and x3 for helper args, better to avoid using them. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
 #endif
         break;
     case 'A': /* Valid for arithmetic immediate (positive or negative).  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
            so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
     /* qemu_st address & data */
     case 's':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 #if defined(CONFIG_SOFTMMU)
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 #if TARGET_LONG_BITS == 64
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #endif
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'a':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xf;
+        ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_GENERAL_REGS;
+        ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
         /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'x':
         /* A vector register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_VECTOR_REGS;
+        ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
         break;
 
     case 'e':
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
         }
 #endif
         break;
     case 'S': /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
         } else {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
         }
 #endif
         break;
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
+        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'v':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff00000000ull;
+        ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
 #endif
         break;
     case 'I':
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
 #endif
         break;
     case 'I':
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':                  /* all registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        ct->regs = 0xffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
     case 'A':
         ct->ct |= TCG_CT_CONST_S33;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'R':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
+        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
         ct->ct |= TCG_CT_CONST_S11;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
+        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
         return NULL;
-- 
2.25.1

This uses an existing hole in the TCGArgConstraint structure
and will be convenient for keeping the data in one place.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 +-
 tcg/tcg.c         | 35 +++++++++++++++++------------------
 2 files changed, 18 insertions(+), 19 deletions(-)

This wasn't actually used for anything, really.  All variable
operands must accept registers, and which are indicated by the
set in TCGArgConstraint.regs.

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 #define TCG_CT_ALIAS  0x80
 #define TCG_CT_IALIAS 0x40
 #define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_REG    0x01
 #define TCG_CT_CONST  0x02 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
 /* we give more priority to constraints with less registers */
 static int get_constraint_priority(const TCGOpDef *def, int k)
 {
-    const TCGArgConstraint *arg_ct;
+    const TCGArgConstraint *arg_ct = &def->args_ct[k];
+    int n;
 
-    int i, n;
-    arg_ct = &def->args_ct[k];
     if (arg_ct->ct & TCG_CT_ALIAS) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
-        if (!(arg_ct->ct & TCG_CT_REG))
-            return 0;
-        n = 0;
-        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->regs, i))
-                n++;
-        }
+        n = ctpop64(arg_ct->regs);
     }
     return TCG_TARGET_NB_REGS - n + 1;
 }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         int oarg = *ct_str - '0';
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
-                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
+                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                         /* TCG_CT_ALIAS is for the output arguments.
                            The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r': /* general registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
 
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     /* qemu_st address & data */
     case 's':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'a':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
     case 'x':
         /* A vector register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
         tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S': /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'v':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':                  /* all registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'R':
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
         tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'r':
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
-- 
2.25.1

These are easier to set and test when they have their own fields.
Reduce the size of alias_index and sort_index to 4 bits, which is
sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
constants within the ct field.

Move all initialization to allocation time, rather than init
individual fields in process_op_defs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 14 +++++++-------
 tcg/tcg.c         | 28 ++++++++++++----------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(void);
 void tcg_dump_op_count(void);
 
-#define TCG_CT_ALIAS  0x80
-#define TCG_CT_IALIAS 0x40
-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_CONST  0x02 /* any constant of register size */
+#define TCG_CT_CONST  1 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
-    uint16_t ct;
-    uint8_t alias_index;
-    uint8_t sort_index;
+    unsigned ct : 16;
+    unsigned alias_index : 4;
+    unsigned sort_index : 4;
+    bool oalias : 1;
+    bool ialias : 1;
+    bool newreg : 1;
     TCGRegSet regs;
 } TCGArgConstraint;
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
         total_args += n;
     }
 
-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    args_ct = g_new0(TCGArgConstraint, total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
     const TCGArgConstraint *arg_ct = &def->args_ct[k];
     int n;
 
-    if (arg_ct->ct & TCG_CT_ALIAS) {
+    if (arg_ct->oalias) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].regs = 0;
-            def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
                 case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
                         tcg_debug_assert(def->args_ct[oarg].regs != 0);
-                        /* TCG_CT_ALIAS is for the output arguments.
-                           The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
-                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
+                        /* The output sets oalias.  */
+                        def->args_ct[oarg].oalias = true;
                         def->args_ct[oarg].alias_index = i;
-                        def->args_ct[i].ct |= TCG_CT_IALIAS;
+                        /* The input sets ialias. */
+                        def->args_ct[i].ialias = true;
                         def->args_ct[i].alias_index = oarg;
                     }
                     ct_str++;
                     break;
                 case '&':
-                    def->args_ct[i].ct |= TCG_CT_NEWREG;
+                    def->args_ct[i].newreg = true;
                     ct_str++;
                     break;
                 case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     set = *pset;
 
                     set &= ct->regs;
-                    if (ct->ct & TCG_CT_IALIAS) {
+                    if (ct->ialias) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
 
         i_preferred_regs = o_preferred_regs = 0;
-        if (arg_ct->ct & TCG_CT_IALIAS) {
+        if (arg_ct->ialias) {
             o_preferred_regs = op->output_pref[arg_ct->alias_index];
             if (ts->fixed_reg) {
                 /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                     reg = ts->reg;
                     for (k2 = 0 ; k2 < k ; k2++) {
                         i2 = def->args_ct[nb_oargs + k2].sort_index;
-                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
-                            reg == new_args[i2]) {
+                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                             goto allocate_in_reg;
                         }
                     }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             /* ENV should not be modified.  */
             tcg_debug_assert(!ts->fixed_reg);
 
-            if ((arg_ct->ct & TCG_CT_ALIAS)
-                && !const_args[arg_ct->alias_index]) {
+            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
-            } else if (arg_ct->ct & TCG_CT_NEWREG) {
+            } else if (arg_ct->newreg) {
                 reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
-- 
2.25.1

The definition of INDEX_op_dupi_vec is that it operates on
units of tcg_target_ulong -- in this case 32 bits.  It does
not work to use this for a uint64_t value that happens to be
small enough to fit in tcg_target_ulong.

Fixes: d2fd745fe8b
Fixes: db432672dc5
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
 
 void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
 {
-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
-        do_dupi_vec(r, MO_32, a);
-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
+    if (TCG_TARGET_REG_BITS == 64) {
         do_dupi_vec(r, MO_64, a);
+    } else if (a == dup_const(MO_32, a)) {
+        do_dupi_vec(r, MO_32, a);
     } else {
         TCGv_i64 c = tcg_const_i64(a);
         tcg_gen_dup_i64_vec(MO_64, r, c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
 
 void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
 {
-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    if (vece == MO_64) {
+        tcg_gen_dup64i_vec(r, a);
+    } else {
+        do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    }
 }
 
 void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
-- 
2.25.1

When the two arguments are identical, this can be reduced to
dup_vec or to mov_vec from a tcg_constant_vec.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        case INDEX_op_dup2_vec:
+            assert(TCG_TARGET_REG_BITS == 32);
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                tmp = arg_info(op->args[1])->val;
+                if (tmp == arg_info(op->args[2])->val) {
+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                    break;
+                }
+            } else if (args_are_copies(op->args[1], op->args[2])) {
+                op->opc = INDEX_op_dup_vec;
+                TCGOP_VECE(op) = MO_32;
+                nb_iargs = 1;
+            }
+            goto do_default;
+
         CASE_OP_32_64(not):
         CASE_OP_32_64(neg):
         CASE_OP_32_64(ext8s):
-- 
2.25.1

The cmp_vec opcode is mandatory; this symbol is unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h | 1 -
 tcg/i386/tcg-target.h    | 1 -
 tcg/ppc/tcg-target.h     | 1 -
 3 files changed, 3 deletions(-)

From: Kele Huang <kele.hwang@gmail.com>

Detect all MIPS store instructions in cpu_signal_handler for all available
MIPS versions, and set is_write if encountering such store instructions.

This fixed the error while dealing with self-modified code for MIPS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Kele Huang <kele.hwang@gmail.com>
Signed-off-by: Xu Zou <iwatchnima@gmail.com>
Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
[rth: Use uintptr_t for pc to fix n32 build error.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
 #elif defined(__mips__)
 
+#if defined(__misp16) || defined(__mips_micromips)
+#error "Unsupported encoding"
+#endif
+
 int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
     siginfo_t *info = pinfo;
     ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.pc;
-    int is_write;
+    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
+    int is_write = 0;
+
+    /* Detect all store instructions at program counter. */
+    switch((insn >> 26) & 077) {
+    case 050: /* SB */
+    case 051: /* SH */
+    case 052: /* SWL */
+    case 053: /* SW */
+    case 054: /* SDL */
+    case 055: /* SDR */
+    case 056: /* SWR */
+    case 070: /* SC */
+    case 071: /* SWC1 */
+    case 074: /* SCD */
+    case 075: /* SDC1 */
+    case 077: /* SD */
+#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
+    case 072: /* SWC2 */
+    case 076: /* SDC2 */
+#endif
+        is_write = 1;
+        break;
+    case 023: /* COP1X */
+        /* Required in all versions of MIPS64 since
+           MIPS64r1 and subsequent versions of MIPS32r2. */
+        switch (insn & 077) {
+        case 010: /* SWXC1 */
+        case 011: /* SDXC1 */
+        case 015: /* SUXC1 */
+            is_write = 1;
+        }
+        break;
+    }
 
-    /* XXX: compute is_write */
-    is_write = 0;
     return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }
 
-- 
2.25.1