Series comparison

-[Qemu-devel] [PULL 00/15] tcg patch queue
+[PULL 0/4] tcg patch queue
-The following changes since commit 3284aa128153750f14a61e8a96fd085e6f2999b6:
+Pretty small still, but there are two patches that ought
 to get backported to stable, so no point in delaying.
-  Merge remote-tracking branch 'remotes/lersek/tags/edk2-pull-2019-04-22' into staging (2019-04-24 13:19:41 +0100)
+r~
 The following changes since commit a5ba0a7e4e150d1350a041f0d0ef9ca6c8d7c307:
   Merge tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu into staging (2024-12-11 15:16:47 +0000)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20190426
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241212
-for you to fetch changes up to ef5dae6805cce7b59d129d801bdc5db71bcbd60d:
+for you to fetch changes up to 7ac87b14a92234b6a89b701b4043ad6cf8bdcccf:
-  cputlb: Fix io_readx() to respect the access_type (2019-04-25 10:40:06 -0700)
+  target/sparc: Use memcpy() and remove memcpy32() (2024-12-12 14:28:38 -0600)
 ----------------------------------------------------------------
-Add tcg_gen_extract2_*.
+tcg: Reset free_temps before tcg_optimize
-Deal with overflow of TranslationBlocks.
+tcg/riscv: Fix StoreStore barrier generation
-Respect access_type in io_readx.
+include/exec: Introduce fpst alias in helper-head.h.inc
 target/sparc: Use memcpy() and remove memcpy32()
 ----------------------------------------------------------------
-David Hildenbrand (1):
+Philippe Mathieu-Daudé (1):
-      tcg: Implement tcg_gen_extract2_{i32,i64}
+      target/sparc: Use memcpy() and remove memcpy32()
-Richard Henderson (13):
+Richard Henderson (2):
-      tcg: Add INDEX_op_extract2_{i32,i64}
+      tcg: Reset free_temps before tcg_optimize
-      tcg: Use deposit and extract2 in tcg_gen_shifti_i64
+      include/exec: Introduce fpst alias in helper-head.h.inc
       tcg: Use extract2 in tcg_gen_deposit_{i32,i64}
       tcg/i386: Support INDEX_op_extract2_{i32,i64}
       tcg/arm: Support INDEX_op_extract2_i32
       tcg/aarch64: Support INDEX_op_extract2_{i32,i64}
       tcg: Hoist max_insns computation to tb_gen_code
       tcg: Restart after TB code generation overflow
       tcg: Restart TB generation after relocation overflow
       tcg: Restart TB generation after constant pool overflow
       tcg: Restart TB generation after out-of-line ldst overflow
       tcg/ppc: Allow the constant pool to overflow at 32k
       tcg/arm: Restrict constant pool displacement to 12 bits
-Shahab Vahedi (1):
+Roman Artemev (1):
-      cputlb: Fix io_readx() to respect the access_type
+      tcg/riscv: Fix StoreStore barrier generation
- include/exec/exec-all.h       |   4 +-
+ include/tcg/tcg-temp-internal.h |  6 ++++++
- include/exec/translator.h     |   3 +-
+ accel/tcg/plugin-gen.c          |  2 +-
- tcg/aarch64/tcg-target.h      |   2 +
+ target/sparc/win_helper.c       | 26 ++++++++------------------
- tcg/arm/tcg-target.h          |   1 +
+ tcg/tcg.c                       |  5 ++++-
- tcg/i386/tcg-target.h         |   2 +
+ include/exec/helper-head.h.inc  |  3 +++
- tcg/mips/tcg-target.h         |   2 +
+ tcg/riscv/tcg-target.c.inc      |  2 +-
- tcg/ppc/tcg-target.h          |   2 +
+files changed, 23 insertions(+), 21 deletions(-)
  tcg/riscv/tcg-target.h        |   2 +
  tcg/s390/tcg-target.h         |   2 +
  tcg/sparc/tcg-target.h        |   2 +
  tcg/tcg-op.h                  |   6 ++
  tcg/tcg-opc.h                 |   2 +
  tcg/tcg.h                     |  16 +++---
  tcg/tci/tcg-target.h          |   2 +
  accel/tcg/cputlb.c            |   5 +-
  accel/tcg/translate-all.c     |  53 ++++++++++++++---
  accel/tcg/translator.c        |  15 +----
  target/alpha/translate.c      |   4 +-
  target/arm/translate.c        |   4 +-
  target/cris/translate.c       |  10 +---
  target/hppa/translate.c       |   5 +-
  target/i386/translate.c       |   4 +-
  target/lm32/translate.c       |  10 +---
  target/m68k/translate.c       |   4 +-
  target/microblaze/translate.c |  10 +---
  target/mips/translate.c       |   4 +-
  target/moxie/translate.c      |  11 +---
  target/nios2/translate.c      |  14 +----
  target/openrisc/translate.c   |   4 +-
  target/ppc/translate.c        |   4 +-
  target/riscv/translate.c      |   4 +-
  target/s390x/translate.c      |   4 +-
  target/sh4/translate.c        |   4 +-
  target/sparc/translate.c      |   4 +-
  target/tilegx/translate.c     |  12 +---
  target/tricore/translate.c    |  16 +-----
  target/unicore32/translate.c  |  10 +---
  target/xtensa/translate.c     |   4 +-
  tcg/aarch64/tcg-target.inc.c  |  27 +++++++--
  tcg/arm/tcg-target.inc.c      |  98 ++++++++++++++++++--------------
  tcg/i386/tcg-target.inc.c     |  17 +++++-
  tcg/mips/tcg-target.inc.c     |   6 +-
  tcg/optimize.c                |  16 ++++++
  tcg/ppc/tcg-target.inc.c      |  42 +++++++-------
  tcg/riscv/tcg-target.inc.c    |  16 ++++--
  tcg/s390/tcg-target.inc.c     |  20 ++++---
  tcg/tcg-ldst.inc.c            |  18 +++---
  tcg/tcg-op.c                  | 129 +++++++++++++++++++++++++++++++++---------
  tcg/tcg-pool.inc.c            |  12 ++--
  tcg/tcg.c                     |  85 +++++++++++++++-------------
  tcg/README                    |   7 +++
 files changed, 451 insertions(+), 309 deletions(-)

-[Qemu-devel] [PULL 01/15] tcg: Implement tcg_gen_extract2_{i32, i64}
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Will be helpful for s390x. Input 128 bit and output 64 bit only,
-which is sufficient for now.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Message-Id: <20190225154204.26751-1-david@redhat.com>
-[rth: Add matching tcg_gen_extract2_i32.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.h |  6 ++++++
- tcg/tcg-op.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
-files changed, 50 insertions(+)
-diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.h
-+++ b/tcg/tcg-op.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
-                          unsigned int ofs, unsigned int len);
- void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
-                           unsigned int ofs, unsigned int len);
-+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
-+                          unsigned int ofs);
- void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, TCGLabel *);
- void tcg_gen_brcondi_i32(TCGCond cond, TCGv_i32 arg1, int32_t arg2, TCGLabel *);
- void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
-                          unsigned int ofs, unsigned int len);
- void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
-                           unsigned int ofs, unsigned int len);
-+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
-+                          unsigned int ofs);
- void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, TCGLabel *);
- void tcg_gen_brcondi_i64(TCGCond cond, TCGv_i64 arg1, int64_t arg2, TCGLabel *);
- void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
- #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i64
- #define tcg_gen_extract_tl tcg_gen_extract_i64
- #define tcg_gen_sextract_tl tcg_gen_sextract_i64
-+#define tcg_gen_extract2_tl tcg_gen_extract2_i64
- #define tcg_const_tl tcg_const_i64
- #define tcg_const_local_tl tcg_const_local_i64
- #define tcg_gen_movcond_tl tcg_gen_movcond_i64
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
- #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i32
- #define tcg_gen_extract_tl tcg_gen_extract_i32
- #define tcg_gen_sextract_tl tcg_gen_sextract_i32
-+#define tcg_gen_extract2_tl tcg_gen_extract2_i32
- #define tcg_const_tl tcg_const_i32
- #define tcg_const_local_tl tcg_const_local_i32
- #define tcg_gen_movcond_tl tcg_gen_movcond_i32
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
-     tcg_gen_sari_i32(ret, ret, 32 - len);
- }
-+/*
-+ * Extract 32-bits from a 64-bit input, ah:al, starting from ofs.
-+ * Unlike tcg_gen_extract_i32 above, len is fixed at 32.
-+ */
-+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
-+                          unsigned int ofs)
-+{
-+    tcg_debug_assert(ofs <= 32);
-+    if (ofs == 0) {
-+        tcg_gen_mov_i32(ret, al);
-+    } else if (ofs == 32) {
-+        tcg_gen_mov_i32(ret, ah);
-+    } else if (al == ah) {
-+        tcg_gen_rotri_i32(ret, al, ofs);
-+    } else {
-+        TCGv_i32 t0 = tcg_temp_new_i32();
-+        tcg_gen_shri_i32(t0, al, ofs);
-+        tcg_gen_deposit_i32(ret, t0, ah, 32 - ofs, ofs);
-+        tcg_temp_free_i32(t0);
-+    }
-+}
-+
- void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
-                          TCGv_i32 c2, TCGv_i32 v1, TCGv_i32 v2)
- {
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
-     tcg_gen_sari_i64(ret, ret, 64 - len);
- }
-+/*
-+ * Extract 64 bits from a 128-bit input, ah:al, starting from ofs.
-+ * Unlike tcg_gen_extract_i64 above, len is fixed at 64.
-+ */
-+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
-+                          unsigned int ofs)
-+{
-+    tcg_debug_assert(ofs <= 64);
-+    if (ofs == 0) {
-+        tcg_gen_mov_i64(ret, al);
-+    } else if (ofs == 64) {
-+        tcg_gen_mov_i64(ret, ah);
-+    } else if (al == ah) {
-+        tcg_gen_rotri_i64(ret, al, ofs);
-+    } else {
-+        TCGv_i64 t0 = tcg_temp_new_i64();
-+        tcg_gen_shri_i64(t0, al, ofs);
-+        tcg_gen_deposit_i64(ret, t0, ah, 64 - ofs, ofs);
-+        tcg_temp_free_i64(t0);
-+    }
-+}
-+
- void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
-                          TCGv_i64 c2, TCGv_i64 v1, TCGv_i64 v2)
- {
---
-.17.1

-[Qemu-devel] [PULL 02/15] tcg: Add INDEX_op_extract2_{i32,i64}
+Deleted patch
-This will let backends implement the double-word shift operation.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/aarch64/tcg-target.h |  2 ++
- tcg/arm/tcg-target.h     |  1 +
- tcg/i386/tcg-target.h    |  2 ++
- tcg/mips/tcg-target.h    |  2 ++
- tcg/ppc/tcg-target.h     |  2 ++
- tcg/riscv/tcg-target.h   |  2 ++
- tcg/s390/tcg-target.h    |  2 ++
- tcg/sparc/tcg-target.h   |  2 ++
- tcg/tcg-opc.h            |  2 ++
- tcg/tcg.h                |  1 +
- tcg/tci/tcg-target.h     |  2 ++
- tcg/optimize.c           | 16 ++++++++++++++++
- tcg/tcg-op.c             |  4 ++++
- tcg/tcg.c                |  4 ++++
- tcg/README               |  7 +++++++
-files changed, 51 insertions(+)
-diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.h
-+++ b/tcg/aarch64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     1
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.h
-+++ b/tcg/arm/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
- #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_mulu2_i32        1
- #define TCG_TARGET_HAS_muls2_i32        1
-diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.h
-+++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.h
-+++ b/tcg/mips/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
- #define TCG_TARGET_HAS_deposit_i32      use_mips32r2_instructions
- #define TCG_TARGET_HAS_extract_i32      use_mips32r2_instructions
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_ext8s_i32        use_mips32r2_instructions
- #define TCG_TARGET_HAS_ext16s_i32       use_mips32r2_instructions
- #define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
-@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
- #define TCG_TARGET_HAS_deposit_i64      use_mips32r2_instructions
- #define TCG_TARGET_HAS_extract_i64      use_mips32r2_instructions
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_ext8s_i64        use_mips32r2_instructions
- #define TCG_TARGET_HAS_ext16s_i64       use_mips32r2_instructions
- #define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
-diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.h
-+++ b/tcg/ppc/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_mulu2_i32        0
- #define TCG_TARGET_HAS_muls2_i32        0
-@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.h
-+++ b/tcg/riscv/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      0
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
- #define TCG_TARGET_HAS_mulu2_i32        0
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_extrl_i64_i32    1
- #define TCG_TARGET_HAS_extrh_i64_i32    1
- #define TCG_TARGET_HAS_ext8s_i64        1
-diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.h
-+++ b/tcg/s390/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
- #define TCG_TARGET_HAS_deposit_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_extract_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_sextract_i32   0
-+#define TCG_TARGET_HAS_extract2_i32   0
- #define TCG_TARGET_HAS_movcond_i32    1
- #define TCG_TARGET_HAS_add2_i32       1
- #define TCG_TARGET_HAS_sub2_i32       1
-@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
- #define TCG_TARGET_HAS_deposit_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_extract_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
- #define TCG_TARGET_HAS_sextract_i64   0
-+#define TCG_TARGET_HAS_extract2_i64   0
- #define TCG_TARGET_HAS_movcond_i64    1
- #define TCG_TARGET_HAS_add2_i64       1
- #define TCG_TARGET_HAS_sub2_i64       1
-diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/sparc/tcg-target.h
-+++ b/tcg/sparc/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
- #define TCG_TARGET_HAS_deposit_i32      0
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-opc.h
-+++ b/tcg/tcg-opc.h
-@@ -XXX,XX +XXX,XX @@ DEF(rotr_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rot_i32))
- DEF(deposit_i32, 1, 2, 2, IMPL(TCG_TARGET_HAS_deposit_i32))
- DEF(extract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_extract_i32))
- DEF(sextract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_sextract_i32))
-+DEF(extract2_i32, 1, 2, 1, IMPL(TCG_TARGET_HAS_extract2_i32))
- DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END)
-@@ -XXX,XX +XXX,XX @@ DEF(rotr_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rot_i64))
- DEF(deposit_i64, 1, 2, 2, IMPL64 | IMPL(TCG_TARGET_HAS_deposit_i64))
- DEF(extract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_extract_i64))
- DEF(sextract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_sextract_i64))
-+DEF(extract2_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_extract2_i64))
- /* size changing ops */
- DEF(ext_i32_i64, 1, 1, 0, IMPL64)
-diff --git a/tcg/tcg.h b/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.h
-+++ b/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
- #define TCG_TARGET_HAS_deposit_i64      0
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_movcond_i64      0
- #define TCG_TARGET_HAS_add2_i64         0
- #define TCG_TARGET_HAS_sub2_i64         0
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
-+++ b/tcg/tci/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      0
- #define TCG_TARGET_HAS_sextract_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     0
- #define TCG_TARGET_HAS_eqv_i32          0
- #define TCG_TARGET_HAS_nand_i32         0
- #define TCG_TARGET_HAS_nor_i32          0
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     0
- #define TCG_TARGET_HAS_div_i64          0
- #define TCG_TARGET_HAS_rem_i64          0
- #define TCG_TARGET_HAS_ext8s_i64        1
-diff --git a/tcg/optimize.c b/tcg/optimize.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/optimize.c
-+++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-             }
-             goto do_default;
-+        CASE_OP_32_64(extract2):
-+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-+                TCGArg v1 = arg_info(op->args[1])->val;
-+                TCGArg v2 = arg_info(op->args[2])->val;
-+
-+                if (opc == INDEX_op_extract2_i64) {
-+                    tmp = (v1 >> op->args[3]) | (v2 << (64 - op->args[3]));
-+                } else {
-+                    tmp = (v1 >> op->args[3]) | (v2 << (32 - op->args[3]));
-+                    tmp = (int32_t)tmp;
-+                }
-+                tcg_opt_gen_movi(s, op, op->args[0], tmp);
-+                break;
-+            }
-+            goto do_default;
-+
-         CASE_OP_32_64(setcond):
-             tmp = do_constant_folding_cond(opc, op->args[1],
-                                            op->args[2], op->args[3]);
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
-         tcg_gen_mov_i32(ret, ah);
-     } else if (al == ah) {
-         tcg_gen_rotri_i32(ret, al, ofs);
-+    } else if (TCG_TARGET_HAS_extract2_i32) {
-+        tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
-     } else {
-         TCGv_i32 t0 = tcg_temp_new_i32();
-         tcg_gen_shri_i32(t0, al, ofs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
-         tcg_gen_mov_i64(ret, ah);
-     } else if (al == ah) {
-         tcg_gen_rotri_i64(ret, al, ofs);
-+    } else if (TCG_TARGET_HAS_extract2_i64) {
-+        tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
-     } else {
-         TCGv_i64 t0 = tcg_temp_new_i64();
-         tcg_gen_shri_i64(t0, al, ofs);
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
-         return TCG_TARGET_HAS_extract_i32;
-     case INDEX_op_sextract_i32:
-         return TCG_TARGET_HAS_sextract_i32;
-+    case INDEX_op_extract2_i32:
-+        return TCG_TARGET_HAS_extract2_i32;
-     case INDEX_op_add2_i32:
-         return TCG_TARGET_HAS_add2_i32;
-     case INDEX_op_sub2_i32:
-@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
-         return TCG_TARGET_HAS_extract_i64;
-     case INDEX_op_sextract_i64:
-         return TCG_TARGET_HAS_sextract_i64;
-+    case INDEX_op_extract2_i64:
-+        return TCG_TARGET_HAS_extract2_i64;
-     case INDEX_op_extrl_i64_i32:
-         return TCG_TARGET_HAS_extrl_i64_i32;
-     case INDEX_op_extrh_i64_i32:
-diff --git a/tcg/README b/tcg/README
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/README
-+++ b/tcg/README
-@@ -XXX,XX +XXX,XX @@ at bit 8.  This operation would be equivalent to
- (using an arithmetic right shift).
-+* extract2_i32/i64 dest, t1, t2, pos
-+
-+For N = {32,64}, extract an N-bit quantity from the concatenation
-+of t2:t1, beginning at pos.  The tcg_gen_extract2_{i32,i64} expander
-+accepts 0 <= pos <= N as inputs.  The backend code generator will
-+not see either 0 or N as inputs for these opcodes.
-+
- * extrl_i64_i32 t0, t1
- For 64-bit hosts only, extract the low 32-bits of input T1 and place it
---
-.17.1

-[Qemu-devel] [PULL 03/15] tcg: Use deposit and extract2 in tcg_gen_shifti_i64
+Deleted patch
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.c | 47 ++++++++++++++++++++++++-----------------------
-file changed, 24 insertions(+), 23 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
-             tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_LOW(arg1), c);
-             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
-         }
--    } else {
--        TCGv_i32 t0, t1;
--
--        t0 = tcg_temp_new_i32();
--        t1 = tcg_temp_new_i32();
--        if (right) {
--            tcg_gen_shli_i32(t0, TCGV_HIGH(arg1), 32 - c);
--            if (arith) {
--                tcg_gen_sari_i32(t1, TCGV_HIGH(arg1), c);
--            } else {
--                tcg_gen_shri_i32(t1, TCGV_HIGH(arg1), c);
--            }
--            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
--            tcg_gen_or_i32(TCGV_LOW(ret), TCGV_LOW(ret), t0);
--            tcg_gen_mov_i32(TCGV_HIGH(ret), t1);
-+    } else if (right) {
-+        if (TCG_TARGET_HAS_extract2_i32) {
-+            tcg_gen_extract2_i32(TCGV_LOW(ret),
-+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
-         } else {
--            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
--            /* Note: ret can be the same as arg1, so we use t1 */
--            tcg_gen_shli_i32(t1, TCGV_LOW(arg1), c);
--            tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
--            tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), t0);
--            tcg_gen_mov_i32(TCGV_LOW(ret), t1);
-+            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
-+            tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
-+                                TCGV_HIGH(arg1), 32 - c, c);
-         }
--        tcg_temp_free_i32(t0);
--        tcg_temp_free_i32(t1);
-+        if (arith) {
-+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
-+        } else {
-+            tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
-+        }
-+    } else {
-+        if (TCG_TARGET_HAS_extract2_i32) {
-+            tcg_gen_extract2_i32(TCGV_HIGH(ret),
-+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
-+        } else {
-+            TCGv_i32 t0 = tcg_temp_new_i32();
-+            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
-+            tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
-+                                TCGV_HIGH(arg1), c, 32 - c);
-+            tcg_temp_free_i32(t0);
-+        }
-+        tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
-     }
- }
---
-.17.1

-[Qemu-devel] [PULL 04/15] tcg: Use extract2 in tcg_gen_deposit_{i32, i64}
+Deleted patch
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg-op.c | 34 ++++++++++++++++++++++++++++++----
-file changed, 30 insertions(+), 4 deletions(-)
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
-         return;
-     }
--    mask = (1u << len) - 1;
-     t1 = tcg_temp_new_i32();
-+    if (TCG_TARGET_HAS_extract2_i32) {
-+        if (ofs + len == 32) {
-+            tcg_gen_shli_i32(t1, arg1, len);
-+            tcg_gen_extract2_i32(ret, t1, arg2, len);
-+            goto done;
-+        }
-+        if (ofs == 0) {
-+            tcg_gen_extract2_i32(ret, arg1, arg2, len);
-+            tcg_gen_rotli_i32(ret, ret, len);
-+            goto done;
-+        }
-+    }
-+
-+    mask = (1u << len) - 1;
-     if (ofs + len < 32) {
-         tcg_gen_andi_i32(t1, arg2, mask);
-         tcg_gen_shli_i32(t1, t1, ofs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
-     }
-     tcg_gen_andi_i32(ret, arg1, ~(mask << ofs));
-     tcg_gen_or_i32(ret, ret, t1);
--
-+ done:
-     tcg_temp_free_i32(t1);
- }
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
-         }
-     }
--    mask = (1ull << len) - 1;
-     t1 = tcg_temp_new_i64();
-+    if (TCG_TARGET_HAS_extract2_i64) {
-+        if (ofs + len == 64) {
-+            tcg_gen_shli_i64(t1, arg1, len);
-+            tcg_gen_extract2_i64(ret, t1, arg2, len);
-+            goto done;
-+        }
-+        if (ofs == 0) {
-+            tcg_gen_extract2_i64(ret, arg1, arg2, len);
-+            tcg_gen_rotli_i64(ret, ret, len);
-+            goto done;
-+        }
-+    }
-+
-+    mask = (1ull << len) - 1;
-     if (ofs + len < 64) {
-         tcg_gen_andi_i64(t1, arg2, mask);
-         tcg_gen_shli_i64(t1, t1, ofs);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
-     }
-     tcg_gen_andi_i64(ret, arg1, ~(mask << ofs));
-     tcg_gen_or_i64(ret, ret, t1);
--
-+ done:
-     tcg_temp_free_i64(t1);
- }
---
-.17.1

-[Qemu-devel] [PULL 05/15] tcg/i386: Support INDEX_op_extract2_{i32, i64}
+Deleted patch
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/i386/tcg-target.h     |  4 ++--
- tcg/i386/tcg-target.inc.c | 11 +++++++++++
-files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.h
-+++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
--#define TCG_TARGET_HAS_extract2_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     1
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     0
--#define TCG_TARGET_HAS_extract2_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     1
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.inc.c
-+++ b/tcg/i386/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline int tcg_target_const_match(tcg_target_long val, TCGType type,
- #define OPC_SHUFPS      (0xc6 | P_EXT)
- #define OPC_SHLX        (0xf7 | P_EXT38 | P_DATA16)
- #define OPC_SHRX        (0xf7 | P_EXT38 | P_SIMDF2)
-+#define OPC_SHRD_Ib     (0xac | P_EXT)
- #define OPC_TESTL    (0x85)
- #define OPC_TZCNT       (0xbc | P_EXT | P_SIMDF3)
- #define OPC_UD2         (0x0b | P_EXT)
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         }
-         break;
-+    OP_32_64(extract2):
-+        /* Note that SHRD outputs to the r/m operand.  */
-+        tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
-+        tcg_out8(s, args[3]);
-+        break;
-+
-     case INDEX_op_mb:
-         tcg_out_mb(s, a0);
-         break;
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-     static const TCGTargetOpDef r_0 = { .args_ct_str = { "r", "0" } };
-     static const TCGTargetOpDef r_r_ri = { .args_ct_str = { "r", "r", "ri" } };
-     static const TCGTargetOpDef r_r_re = { .args_ct_str = { "r", "r", "re" } };
-+    static const TCGTargetOpDef r_0_r = { .args_ct_str = { "r", "0", "r" } };
-     static const TCGTargetOpDef r_0_re = { .args_ct_str = { "r", "0", "re" } };
-     static const TCGTargetOpDef r_0_ci = { .args_ct_str = { "r", "0", "ci" } };
-     static const TCGTargetOpDef r_L = { .args_ct_str = { "r", "L" } };
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-     case INDEX_op_ctpop_i32:
-     case INDEX_op_ctpop_i64:
-         return &r_r;
-+    case INDEX_op_extract2_i32:
-+    case INDEX_op_extract2_i64:
-+        return &r_0_r;
-     case INDEX_op_deposit_i32:
-     case INDEX_op_deposit_i64:
---
-.17.1

-[Qemu-devel] [PULL 06/15] tcg/arm: Support INDEX_op_extract2_i32
+Deleted patch
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/arm/tcg-target.h     |  2 +-
- tcg/arm/tcg-target.inc.c | 25 +++++++++++++++++++++++++
-files changed, 26 insertions(+), 1 deletion(-)
-diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.h
-+++ b/tcg/arm/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
- #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
- #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
--#define TCG_TARGET_HAS_extract2_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     1
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_mulu2_i32        1
- #define TCG_TARGET_HAS_muls2_i32        1
-diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.inc.c
-+++ b/tcg/arm/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-     case INDEX_op_sextract_i32:
-         tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
-         break;
-+    case INDEX_op_extract2_i32:
-+        /* ??? These optimization vs zero should be generic.  */
-+        /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
-+        if (const_args[1]) {
-+            if (const_args[2]) {
-+                tcg_out_movi(s, TCG_TYPE_REG, args[0], 0);
-+            } else {
-+                tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
-+                                args[2], SHIFT_IMM_LSL(32 - args[3]));
-+            }
-+        } else if (const_args[2]) {
-+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
-+                            args[1], SHIFT_IMM_LSR(args[3]));
-+        } else {
-+            /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
-+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0,
-+                            args[2], SHIFT_IMM_LSL(32 - args[3]));
-+            tcg_out_dat_reg(s, COND_AL, ARITH_ORR, args[0], TCG_REG_TMP,
-+                            args[1], SHIFT_IMM_LSR(args[3]));
-+        }
-+        break;
-     case INDEX_op_div_i32:
-         tcg_out_sdiv(s, COND_AL, args[0], args[1], args[2]);
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-         = { .args_ct_str = { "s", "s", "s", "s" } };
-     static const TCGTargetOpDef br
-         = { .args_ct_str = { "r", "rIN" } };
-+    static const TCGTargetOpDef ext2
-+        = { .args_ct_str = { "r", "rZ", "rZ" } };
-     static const TCGTargetOpDef dep
-         = { .args_ct_str = { "r", "0", "rZ" } };
-     static const TCGTargetOpDef movc
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-         return &br;
-     case INDEX_op_deposit_i32:
-         return &dep;
-+    case INDEX_op_extract2_i32:
-+        return &ext2;
-     case INDEX_op_movcond_i32:
-         return &movc;
-     case INDEX_op_add2_i32:
---
-.17.1

-[Qemu-devel] [PULL 07/15] tcg/aarch64: Support INDEX_op_extract2_{i32, i64}
+Deleted patch
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/aarch64/tcg-target.h     |  4 ++--
- tcg/aarch64/tcg-target.inc.c | 11 +++++++++++
-files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.h
-+++ b/tcg/aarch64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i32      1
- #define TCG_TARGET_HAS_extract_i32      1
- #define TCG_TARGET_HAS_sextract_i32     1
--#define TCG_TARGET_HAS_extract2_i32     0
-+#define TCG_TARGET_HAS_extract2_i32     1
- #define TCG_TARGET_HAS_movcond_i32      1
- #define TCG_TARGET_HAS_add2_i32         1
- #define TCG_TARGET_HAS_sub2_i32         1
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_deposit_i64      1
- #define TCG_TARGET_HAS_extract_i64      1
- #define TCG_TARGET_HAS_sextract_i64     1
--#define TCG_TARGET_HAS_extract2_i64     0
-+#define TCG_TARGET_HAS_extract2_i64     1
- #define TCG_TARGET_HAS_movcond_i64      1
- #define TCG_TARGET_HAS_add2_i64         1
- #define TCG_TARGET_HAS_sub2_i64         1
-diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.inc.c
-+++ b/tcg/aarch64/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-         tcg_out_sbfm(s, ext, a0, a1, a2, a2 + args[3] - 1);
-         break;
-+    case INDEX_op_extract2_i64:
-+    case INDEX_op_extract2_i32:
-+        tcg_out_extr(s, ext, a0, a1, a2, args[3]);
-+        break;
-+
-     case INDEX_op_add2_i32:
-         tcg_out_addsub2(s, TCG_TYPE_I32, a0, a1, REG0(2), REG0(3),
-                         (int32_t)args[4], args[5], const_args[4],
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-         = { .args_ct_str = { "r", "r", "rAL" } };
-     static const TCGTargetOpDef dep
-         = { .args_ct_str = { "r", "0", "rZ" } };
-+    static const TCGTargetOpDef ext2
-+        = { .args_ct_str = { "r", "rZ", "rZ" } };
-     static const TCGTargetOpDef movc
-         = { .args_ct_str = { "r", "r", "rA", "rZ", "rZ" } };
-     static const TCGTargetOpDef add2
-@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
-     case INDEX_op_deposit_i64:
-         return &dep;
-+    case INDEX_op_extract2_i32:
-+    case INDEX_op_extract2_i64:
-+        return &ext2;
-+
-     case INDEX_op_add2_i32:
-     case INDEX_op_add2_i64:
-     case INDEX_op_sub2_i32:
---
-.17.1

-[Qemu-devel] [PULL 08/15] tcg: Hoist max_insns computation to tb_gen_code
+Deleted patch
-In order to handle TB's that translate to too much code, we
-need to place the control of the length of the translation
-in the hands of the code gen master loop.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/exec-all.h       |  4 ++--
- include/exec/translator.h     |  3 ++-
- accel/tcg/translate-all.c     | 15 +++++++++++++--
- accel/tcg/translator.c        | 15 ++-------------
- target/alpha/translate.c      |  4 ++--
- target/arm/translate.c        |  4 ++--
- target/cris/translate.c       | 10 +---------
- target/hppa/translate.c       |  5 ++---
- target/i386/translate.c       |  4 ++--
- target/lm32/translate.c       | 10 +---------
- target/m68k/translate.c       |  4 ++--
- target/microblaze/translate.c | 10 +---------
- target/mips/translate.c       |  4 ++--
- target/moxie/translate.c      | 11 ++---------
- target/nios2/translate.c      | 14 ++------------
- target/openrisc/translate.c   |  4 ++--
- target/ppc/translate.c        |  4 ++--
- target/riscv/translate.c      |  4 ++--
- target/s390x/translate.c      |  4 ++--
- target/sh4/translate.c        |  4 ++--
- target/sparc/translate.c      |  4 ++--
- target/tilegx/translate.c     | 12 +-----------
- target/tricore/translate.c    | 16 ++--------------
- target/unicore32/translate.c  | 10 +---------
- target/xtensa/translate.c     |  4 ++--
-files changed, 56 insertions(+), 127 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
- #include "qemu/log.h"
--void gen_intermediate_code(CPUState *cpu, struct TranslationBlock *tb);
--void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
-+void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
-                           target_ulong *data);
- void cpu_gen_init(void);
-diff --git a/include/exec/translator.h b/include/exec/translator.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/translator.h
-+++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
-  * @db: Disassembly context.
-  * @cpu: Target vCPU.
-  * @tb: Translation block.
-+ * @max_insns: Maximum number of insns to translate.
-  *
-  * Generic translator loop.
-  *
-@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
-  * - When too many instructions have been translated.
-  */
- void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
--                     CPUState *cpu, TranslationBlock *tb);
-+                     CPUState *cpu, TranslationBlock *tb, int max_insns);
- void translator_loop_temp_check(DisasContextBase *db);
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     tb_page_addr_t phys_pc, phys_page2;
-     target_ulong virt_page2;
-     tcg_insn_unit *gen_code_buf;
--    int gen_code_size, search_size;
-+    int gen_code_size, search_size, max_insns;
- #ifdef CONFIG_PROFILER
-     TCGProfile *prof = &tcg_ctx->prof;
-     int64_t ti;
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     cflags &= ~CF_CLUSTER_MASK;
-     cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
-+    max_insns = cflags & CF_COUNT_MASK;
-+    if (max_insns == 0) {
-+        max_insns = CF_COUNT_MASK;
-+    }
-+    if (max_insns > TCG_MAX_INSNS) {
-+        max_insns = TCG_MAX_INSNS;
-+    }
-+    if (cpu->singlestep_enabled || singlestep) {
-+        max_insns = 1;
-+    }
-+
-  buffer_overflow:
-     tb = tb_alloc(pc);
-     if (unlikely(!tb)) {
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     tcg_func_start(tcg_ctx);
-     tcg_ctx->cpu = ENV_GET_CPU(env);
--    gen_intermediate_code(cpu, tb);
-+    gen_intermediate_code(cpu, tb, max_insns);
-     tcg_ctx->cpu = NULL;
-     trace_translate_block(tb, tb->pc, tb->tc.ptr);
-diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translator.c
-+++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ void translator_loop_temp_check(DisasContextBase *db)
- }
- void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
--                     CPUState *cpu, TranslationBlock *tb)
-+                     CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     int bp_insn = 0;
-@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-     db->pc_next = db->pc_first;
-     db->is_jmp = DISAS_NEXT;
-     db->num_insns = 0;
-+    db->max_insns = max_insns;
-     db->singlestep_enabled = cpu->singlestep_enabled;
--    /* Instruction counting */
--    db->max_insns = tb_cflags(db->tb) & CF_COUNT_MASK;
--    if (db->max_insns == 0) {
--        db->max_insns = CF_COUNT_MASK;
--    }
--    if (db->max_insns > TCG_MAX_INSNS) {
--        db->max_insns = TCG_MAX_INSNS;
--    }
--    if (db->singlestep_enabled || singlestep) {
--        db->max_insns = 1;
--    }
--
-     ops->init_disas_context(db, cpu);
-     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-diff --git a/target/alpha/translate.c b/target/alpha/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/translate.c
-+++ b/target/alpha/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
-     .disas_log          = alpha_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc;
--    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb);
-+    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
- }
- void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
- };
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc;
-     const TranslatorOps *ops = &arm_translator_ops;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-     }
- #endif
--    translator_loop(ops, &dc.base, cpu, tb);
-+    translator_loop(ops, &dc.base, cpu, tb, max_insns);
- }
- void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-diff --git a/target/cris/translate.c b/target/cris/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/translate.c
-+++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
-  */
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUCRISState *env = cs->env_ptr;
-     uint32_t pc_start;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     uint32_t page_start;
-     target_ulong npc;
-     int num_insns;
--    int max_insns;
-     if (env->pregs[PR_VR] == 32) {
-         dc->decoder = crisv32_decoder;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     page_start = pc_start & TARGET_PAGE_MASK;
-     num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-     gen_tb_start(tb);
-     do {
-diff --git a/target/hppa/translate.c b/target/hppa/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/translate.c
-+++ b/target/hppa/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
-     .disas_log          = hppa_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
--
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
-diff --git a/target/i386/translate.c b/target/i386/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/translate.c
-+++ b/target/i386/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
- };
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc;
--    translator_loop(&i386_tr_ops, &dc.base, cpu, tb);
-+    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
- }
- void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
-diff --git a/target/lm32/translate.c b/target/lm32/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/lm32/translate.c
-+++ b/target/lm32/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPULM32State *env = cs->env_ptr;
-     LM32CPU *cpu = lm32_env_get_cpu(env);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     uint32_t pc_start;
-     uint32_t page_start;
-     int num_insns;
--    int max_insns;
-     pc_start = tb->pc;
-     dc->features = cpu->features;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     page_start = pc_start & TARGET_PAGE_MASK;
-     num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-     gen_tb_start(tb);
-     do {
-diff --git a/target/m68k/translate.c b/target/m68k/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/translate.c
-+++ b/target/m68k/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
-     .disas_log          = m68k_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc;
--    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb);
-+    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
- }
- static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
-diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/translate.c
-+++ b/target/microblaze/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUMBState *env = cs->env_ptr;
-     MicroBlazeCPU *cpu = mb_env_get_cpu(env);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     uint32_t page_start, org_flags;
-     uint32_t npc;
-     int num_insns;
--    int max_insns;
-     pc_start = tb->pc;
-     dc->cpu = cpu;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     page_start = pc_start & TARGET_PAGE_MASK;
-     num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-     gen_tb_start(tb);
-     do
-diff --git a/target/mips/translate.c b/target/mips/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/translate.c
-+++ b/target/mips/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
-     .disas_log          = mips_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&mips_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- static void fpu_dump_state(CPUMIPSState *env, FILE *f, int flags)
-diff --git a/target/moxie/translate.c b/target/moxie/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/moxie/translate.c
-+++ b/target/moxie/translate.c
-@@ -XXX,XX +XXX,XX @@ static int decode_opc(MoxieCPU *cpu, DisasContext *ctx)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUMoxieState *env = cs->env_ptr;
-     MoxieCPU *cpu = moxie_env_get_cpu(env);
-     DisasContext ctx;
-     target_ulong pc_start;
--    int num_insns, max_insns;
-+    int num_insns;
-     pc_start = tb->pc;
-     ctx.pc = pc_start;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     ctx.singlestep_enabled = 0;
-     ctx.bstate = BS_NONE;
-     num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-     gen_tb_start(tb);
-     do {
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUNios2State *env = cs->env_ptr;
-     DisasContext dc1, *dc = &dc1;
-     int num_insns;
--    int max_insns;
-     /* Initialize DC */
-     dc->cpu_env = cpu_env;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-     /* Set up instruction counts */
-     num_insns = 0;
--    if (cs->singlestep_enabled || singlestep) {
--        max_insns = 1;
--    } else {
-+    if (max_insns > 1) {
-         int page_insns = (TARGET_PAGE_SIZE - (tb->pc & TARGET_PAGE_MASK)) / 4;
--        max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--        if (max_insns == 0) {
--            max_insns = CF_COUNT_MASK;
--        }
-         if (max_insns > page_insns) {
-             max_insns = page_insns;
-         }
--        if (max_insns > TCG_MAX_INSNS) {
--            max_insns = TCG_MAX_INSNS;
--        }
-     }
-     gen_tb_start(tb);
-diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/translate.c
-+++ b/target/openrisc/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
-     .disas_log          = openrisc_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-diff --git a/target/ppc/translate.c b/target/ppc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate.c
-+++ b/target/ppc/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
-     .disas_log          = ppc_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
-     .disas_log          = riscv_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- void riscv_translate_init(void)
-diff --git a/target/s390x/translate.c b/target/s390x/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/translate.c
-+++ b/target/s390x/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
-     .disas_log          = s390x_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc;
--    translator_loop(&s390x_tr_ops, &dc.base, cs, tb);
-+    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
- }
- void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
-diff --git a/target/sh4/translate.c b/target/sh4/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/translate.c
-+++ b/target/sh4/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
-     .disas_log          = sh4_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext ctx;
--    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb);
-+    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
- }
- void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
-diff --git a/target/sparc/translate.c b/target/sparc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/translate.c
-+++ b/target/sparc/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
-     .disas_log          = sparc_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc = {};
--    translator_loop(&sparc_tr_ops, &dc.base, cs, tb);
-+    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
- }
- void sparc_tcg_init(void)
-diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/translate.c
-+++ b/target/tilegx/translate.c
-@@ -XXX,XX +XXX,XX @@ static void translate_one_bundle(DisasContext *dc, uint64_t bundle)
-     }
- }
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUTLGState *env = cs->env_ptr;
-     DisasContext ctx;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-     uint64_t pc_start = tb->pc;
-     uint64_t page_start = pc_start & TARGET_PAGE_MASK;
-     int num_insns = 0;
--    int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-     dc->pc = pc_start;
-     dc->mmuidx = 0;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-         qemu_log_lock();
-         qemu_log("IN: %s\n", lookup_symbol(pc_start));
-     }
--    if (!max_insns) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (cs->singlestep_enabled || singlestep) {
--        max_insns = 1;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-     gen_tb_start(tb);
-     while (1) {
-diff --git a/target/tricore/translate.c b/target/tricore/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/translate.c
-+++ b/target/tricore/translate.c
-@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPUTriCoreState *env, DisasContext *ctx, int *is_branch)
-     }
- }
--void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUTriCoreState *env = cs->env_ptr;
-     DisasContext ctx;
-     target_ulong pc_start;
--    int num_insns, max_insns;
--
--    num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (singlestep) {
--        max_insns = 1;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
-+    int num_insns = 0;
-     pc_start = tb->pc;
-     ctx.pc = pc_start;
-diff --git a/target/unicore32/translate.c b/target/unicore32/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/unicore32/translate.c
-+++ b/target/unicore32/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
- }
- /* generate intermediate code for basic block 'tb'.  */
--void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
- {
-     CPUUniCore32State *env = cs->env_ptr;
-     DisasContext dc1, *dc = &dc1;
-     target_ulong pc_start;
-     uint32_t page_start;
-     int num_insns;
--    int max_insns;
-     /* generate intermediate code */
-     num_temps = 0;
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
-     cpu_F1d = tcg_temp_new_i64();
-     page_start = pc_start & TARGET_PAGE_MASK;
-     num_insns = 0;
--    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
--    if (max_insns == 0) {
--        max_insns = CF_COUNT_MASK;
--    }
--    if (max_insns > TCG_MAX_INSNS) {
--        max_insns = TCG_MAX_INSNS;
--    }
- #ifndef CONFIG_USER_ONLY
-     if ((env->uncached_asr & ASR_M) == ASR_MODE_USER) {
-diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/translate.c
-+++ b/target/xtensa/translate.c
-@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
-     .disas_log          = xtensa_tr_disas_log,
- };
--void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
-+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
- {
-     DisasContext dc = {};
--    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb);
-+    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
- }
- void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
---
-.17.1

-[Qemu-devel] [PULL 09/15] tcg: Restart after TB code generation overflow
+Deleted patch
-If a TB generates too much code, try again with fewer insns.
-Fixes: https://bugs.launchpad.net/bugs/1824853
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/translate-all.c | 38 ++++++++++++++++++++++++++++++++------
- tcg/tcg.c                 |  4 ++++
-files changed, 36 insertions(+), 6 deletions(-)
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     tb->cflags = cflags;
-     tb->trace_vcpu_dstate = *cpu->trace_dstate;
-     tcg_ctx->tb_cflags = cflags;
-+ tb_overflow:
- #ifdef CONFIG_PROFILER
-     /* includes aborted translations because of exceptions */
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     ti = profile_getclock();
- #endif
--    /* ??? Overflow could be handled better here.  In particular, we
--       don't need to re-do gen_intermediate_code, nor should we re-do
--       the tcg optimization currently hidden inside tcg_gen_code.  All
--       that should be required is to flush the TBs, allocate a new TB,
--       re-initialize it per above, and re-do the actual code generation.  */
-     gen_code_size = tcg_gen_code(tcg_ctx, tb);
-     if (unlikely(gen_code_size < 0)) {
--        goto buffer_overflow;
-+        switch (gen_code_size) {
-+        case -1:
-+            /*
-+             * Overflow of code_gen_buffer, or the current slice of it.
-+             *
-+             * TODO: We don't need to re-do gen_intermediate_code, nor
-+             * should we re-do the tcg optimization currently hidden
-+             * inside tcg_gen_code.  All that should be required is to
-+             * flush the TBs, allocate a new TB, re-initialize it per
-+             * above, and re-do the actual code generation.
-+             */
-+            goto buffer_overflow;
-+
-+        case -2:
-+            /*
-+             * The code generated for the TranslationBlock is too large.
-+             * The maximum size allowed by the unwind info is 64k.
-+             * There may be stricter constraints from relocations
-+             * in the tcg backend.
-+             *
-+             * Try again with half as many insns as we attempted this time.
-+             * If a single insn overflows, there's a bug somewhere...
-+             */
-+            max_insns = tb->icount;
-+            assert(max_insns > 1);
-+            max_insns /= 2;
-+            goto tb_overflow;
-+
-+        default:
-+            g_assert_not_reached();
-+        }
-     }
-     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
-     if (unlikely(search_size < 0)) {
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
-             return -1;
-         }
-+        /* Test for TB overflow, as seen by gen_insn_end_off.  */
-+        if (unlikely(tcg_current_code_size(s) > UINT16_MAX)) {
-+            return -2;
-+        }
-     }
-     tcg_debug_assert(num_insns >= 0);
-     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
---
-.17.1

-[Qemu-devel] [PULL 10/15] tcg: Restart TB generation after relocation overflow
+Deleted patch
-If the TB generates too much code, such that backend relocations
-overflow, try again with a smaller TB.  In support of this, move
-relocation processing from a random place within tcg_out_op, in
-the handling of branch opcodes, to a new function at the end of
-tcg_gen_code.
-This is not a complete solution, as there are additional relocs
-generated for out-of-line ldst handling and constant pools.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tcg.h | 15 +++++++-------
- tcg/tcg.c | 61 ++++++++++++++++++++++++++-----------------------------
-files changed, 36 insertions(+), 40 deletions(-)
-diff --git a/tcg/tcg.h b/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.h
-+++ b/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t tcg_insn_unit;
-     do { if (!(X)) { __builtin_unreachable(); } } while (0)
- #endif
--typedef struct TCGRelocation {
--    struct TCGRelocation *next;
--    int type;
-+typedef struct TCGRelocation TCGRelocation;
-+struct TCGRelocation {
-+    QSIMPLEQ_ENTRY(TCGRelocation) next;
-     tcg_insn_unit *ptr;
-     intptr_t addend;
--} TCGRelocation;
-+    int type;
-+};
- typedef struct TCGLabel TCGLabel;
- struct TCGLabel {
-@@ -XXX,XX +XXX,XX @@ struct TCGLabel {
-     union {
-         uintptr_t value;
-         tcg_insn_unit *value_ptr;
--        TCGRelocation *first_reloc;
-     } u;
--#ifdef CONFIG_DEBUG_TCG
-+    QSIMPLEQ_HEAD(, TCGRelocation) relocs;
-     QSIMPLEQ_ENTRY(TCGLabel) next;
--#endif
- };
- typedef struct TCGPool {
-@@ -XXX,XX +XXX,XX @@ struct TCGContext {
- #endif
- #ifdef CONFIG_DEBUG_TCG
--    QSIMPLEQ_HEAD(, TCGLabel) labels;
-     int temps_in_use;
-     int goto_tb_issue_mask;
- #endif
-@@ -XXX,XX +XXX,XX @@ struct TCGContext {
-     TCGTemp temps[TCG_MAX_TEMPS]; /* globals first, temps after */
-     QTAILQ_HEAD(, TCGOp) ops, free_ops;
-+    QSIMPLEQ_HEAD(, TCGLabel) labels;
-     /* Tells which temporary holds a given register.
-        It does not take into account fixed registers */
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static __attribute__((unused)) inline void tcg_patch64(tcg_insn_unit *p,
- static void tcg_out_reloc(TCGContext *s, tcg_insn_unit *code_ptr, int type,
-                           TCGLabel *l, intptr_t addend)
- {
--    TCGRelocation *r;
-+    TCGRelocation *r = tcg_malloc(sizeof(TCGRelocation));
--    if (l->has_value) {
--        /* FIXME: This may break relocations on RISC targets that
--           modify instruction fields in place.  The caller may not have
--           written the initial value.  */
--        bool ok = patch_reloc(code_ptr, type, l->u.value, addend);
--        tcg_debug_assert(ok);
--    } else {
--        /* add a new relocation entry */
--        r = tcg_malloc(sizeof(TCGRelocation));
--        r->type = type;
--        r->ptr = code_ptr;
--        r->addend = addend;
--        r->next = l->u.first_reloc;
--        l->u.first_reloc = r;
--    }
-+    r->type = type;
-+    r->ptr = code_ptr;
-+    r->addend = addend;
-+    QSIMPLEQ_INSERT_TAIL(&l->relocs, r, next);
- }
- static void tcg_out_label(TCGContext *s, TCGLabel *l, tcg_insn_unit *ptr)
- {
--    intptr_t value = (intptr_t)ptr;
--    TCGRelocation *r;
--
-     tcg_debug_assert(!l->has_value);
--
--    for (r = l->u.first_reloc; r != NULL; r = r->next) {
--        bool ok = patch_reloc(r->ptr, r->type, value, r->addend);
--        tcg_debug_assert(ok);
--    }
--
-     l->has_value = 1;
-     l->u.value_ptr = ptr;
- }
-@@ -XXX,XX +XXX,XX @@ TCGLabel *gen_new_label(void)
-     TCGContext *s = tcg_ctx;
-     TCGLabel *l = tcg_malloc(sizeof(TCGLabel));
--    *l = (TCGLabel){
--        .id = s->nb_labels++
--    };
--#ifdef CONFIG_DEBUG_TCG
-+    memset(l, 0, sizeof(TCGLabel));
-+    l->id = s->nb_labels++;
-+    QSIMPLEQ_INIT(&l->relocs);
-+
-     QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
--#endif
-     return l;
- }
-+static bool tcg_resolve_relocs(TCGContext *s)
-+{
-+    TCGLabel *l;
-+
-+    QSIMPLEQ_FOREACH(l, &s->labels, next) {
-+        TCGRelocation *r;
-+        uintptr_t value = l->u.value;
-+
-+        QSIMPLEQ_FOREACH(r, &l->relocs, next) {
-+            if (!patch_reloc(r->ptr, r->type, value, r->addend)) {
-+                return false;
-+            }
-+        }
-+    }
-+    return true;
-+}
-+
- static void set_jmp_reset_offset(TCGContext *s, int which)
- {
-     size_t off = tcg_current_code_size(s);
-@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
-     QTAILQ_INIT(&s->ops);
-     QTAILQ_INIT(&s->free_ops);
--#ifdef CONFIG_DEBUG_TCG
-     QSIMPLEQ_INIT(&s->labels);
--#endif
- }
- static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-         return -1;
-     }
- #endif
-+    if (!tcg_resolve_relocs(s)) {
-+        return -2;
-+    }
-     /* flush instruction cache */
-     flush_icache_range((uintptr_t)s->code_buf, (uintptr_t)s->code_ptr);
---
-.17.1

-[Qemu-devel] [PULL 11/15] tcg: Restart TB generation after constant pool overflow
+[PULL 1/4] tcg: Reset free_temps before tcg_optimize
-This is part b of relocation overflow handling.
+When allocating new temps during tcg_optmize, do not re-use
 any EBB temps that were used within the TB.  We do not have
 any idea what span of the TB in which the temp was live.
+Introduce tcg_temp_ebb_reset_freed and use before tcg_optimize,
+as well as replacing the equivalent in plugin_gen_inject and
+tcg_func_start.
+Cc: qemu-stable@nongnu.org
+Fixes: fb04ab7ddd8 ("tcg/optimize: Lower TCG_COND_TST{EQ,NE} if unsupported")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2711
+Reported-by: wannacu <wannacu2049@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 ---
- tcg/tcg-pool.inc.c | 12 +++++++-----
+ include/tcg/tcg-temp-internal.h | 6 ++++++
- tcg/tcg.c          |  9 +++++----
+ accel/tcg/plugin-gen.c          | 2 +-
-files changed, 12 insertions(+), 9 deletions(-)
+ tcg/tcg.c                       | 5 ++++-
 files changed, 11 insertions(+), 2 deletions(-)
-diff --git a/tcg/tcg-pool.inc.c b/tcg/tcg-pool.inc.c
+diff --git a/include/tcg/tcg-temp-internal.h b/include/tcg/tcg-temp-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-pool.inc.c
+--- a/include/tcg/tcg-temp-internal.h
-+++ b/tcg/tcg-pool.inc.c
++++ b/include/tcg/tcg-temp-internal.h
-@@ -XXX,XX +XXX,XX @@ static inline void new_pool_l8(TCGContext *s, int rtype, tcg_insn_unit *label,
+@@ -XXX,XX +XXX,XX @@ TCGv_i64 tcg_temp_ebb_new_i64(void);
- /* To be provided by cpu/tcg-target.inc.c.  */
+ TCGv_ptr tcg_temp_ebb_new_ptr(void);
- static void tcg_out_nop_fill(tcg_insn_unit *p, int count);
+ TCGv_i128 tcg_temp_ebb_new_i128(void);
--static bool tcg_out_pool_finalize(TCGContext *s)
++/* Forget all freed EBB temps, so that new allocations produce new temps. */
-+static int tcg_out_pool_finalize(TCGContext *s)
++static inline void tcg_temp_ebb_reset_freed(TCGContext *s)
- {
++{
-     TCGLabelPoolData *p = s->pool_labels;
++    memset(s->free_temps, 0, sizeof(s->free_temps));
-     TCGLabelPoolData *l = NULL;
++}
-     void *a;
++
+ #endif /* TCG_TEMP_FREE_H */
-     if (p == NULL) {
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
--        return true;
+index XXXXXXX..XXXXXXX 100644
-+        return 0;
+--- a/accel/tcg/plugin-gen.c
-     }
++++ b/accel/tcg/plugin-gen.c
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
-     /* ??? Round up to qemu_icache_linesize, but then do not round
+      * that might be live within the existing opcode stream.
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_pool_finalize(TCGContext *s)
+      * The simplest solution is to release them all and create new.
-         size_t size = sizeof(tcg_target_ulong) * p->nlong;
+      */
-         if (!l || l->nlong != p->nlong || memcmp(l->data, p->data, size)) {
+-    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
-             if (unlikely(a > s->code_gen_highwater)) {
++    tcg_temp_ebb_reset_freed(tcg_ctx);
--                return false;
-+                return -1;
+     QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
-             }
+         switch (op->opc) {
              memcpy(a, p->data, size);
              a += size;
              l = p;
          }
 -        patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend);
 +        if (!patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend)) {
 +            return -2;
 +        }
      }
      s->code_ptr = a;
 -    return true;
 +    return 0;
  }
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
- #ifdef TCG_TARGET_NEED_POOL_LABELS
+     s->nb_temps = s->nb_globals;
-     /* Allow the prologue to put e.g. guest_base into a pool entry.  */
-     {
+     /* No temps have been previously allocated for size or locality.  */
--        bool ok = tcg_out_pool_finalize(s);
+-    memset(s->free_temps, 0, sizeof(s->free_temps));
--        tcg_debug_assert(ok);
++    tcg_temp_ebb_reset_freed(s);
-+        int result = tcg_out_pool_finalize(s);
-+        tcg_debug_assert(result == 0);
+     /* No constant temps have been previously allocated. */
      for (int i = 0; i < TCG_TYPE_COUNT; ++i) {
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
      }
  #endif
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
++    /* Do not reuse any EBB that may be allocated within the TB. */
-     }
++    tcg_temp_ebb_reset_freed(s);
- #endif
++
- #ifdef TCG_TARGET_NEED_POOL_LABELS
+     tcg_optimize(s);
--    if (!tcg_out_pool_finalize(s)) {
--        return -1;
+     reachable_code_pass(s);
 +    i = tcg_out_pool_finalize(s);
 +    if (i < 0) {
 +        return i;
      }
  #endif
      if (!tcg_resolve_relocs(s)) {
 --
-.17.1
+.43.0

-[Qemu-devel] [PULL 14/15] tcg/arm: Restrict constant pool displacement to 12 bits
+[PULL 2/4] tcg/riscv: Fix StoreStore barrier generation
-This will not necessarily restrict the size of the TB, since for v7
+From: Roman Artemev <roman.artemev@syntacore.com>
 the majority of constant pool usage is for calls from the out-of-line
 ldst code, which is already at the end of the TB.  But this does
 allow us to save one insn per reference on the off-chance.
+On RISC-V to StoreStore barrier corresponds
+`fence w, w` not `fence r, r`
+Cc: qemu-stable@nongnu.org
+Fixes: efbea94c76b ("tcg/riscv: Add slowpath load and store instructions")
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Denis Tomashev <denis.tomashev@syntacore.com>
+Signed-off-by: Roman Artemev <roman.artemev@syntacore.com>
+Message-ID: <e2f2131e294a49e79959d4fa9ec02cf4@syntacore.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/arm/tcg-target.inc.c | 57 +++++++++++++++-------------------------
+ tcg/riscv/tcg-target.c.inc | 2 +-
-file changed, 21 insertions(+), 36 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.inc.c
+--- a/tcg/riscv/tcg-target.c.inc
-+++ b/tcg/arm/tcg-target.inc.c
++++ b/tcg/riscv/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline bool reloc_pc24(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
-     return false;
+         insn |= 0x02100000;
  }
 +static inline bool reloc_pc13(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
 +{
 +    ptrdiff_t offset = tcg_ptr_byte_diff(target, code_ptr) - 8;
 +
 +    if (offset >= -0xfff && offset <= 0xfff) {
 +        tcg_insn_unit insn = *code_ptr;
 +        bool u = (offset >= 0);
 +        if (!u) {
 +            offset = -offset;
 +        }
 +        insn = deposit32(insn, 23, 1, u);
 +        insn = deposit32(insn, 0, 12, offset);
 +        *code_ptr = insn;
 +        return true;
 +    }
 +    return false;
 +}
 +
  static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                          intptr_t value, intptr_t addend)
  {
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
      if (type == R_ARM_PC24) {
          return reloc_pc24(code_ptr, (tcg_insn_unit *)value);
      } else if (type == R_ARM_PC13) {
 -        intptr_t diff = value - (uintptr_t)(code_ptr + 2);
 -        tcg_insn_unit insn = *code_ptr;
 -        bool u;
 -
 -        if (diff >= -0xfff && diff <= 0xfff) {
 -            u = (diff >= 0);
 -            if (!u) {
 -                diff = -diff;
 -            }
 -        } else {
 -            int rd = extract32(insn, 12, 4);
 -            int rt = rd == TCG_REG_PC ? TCG_REG_TMP : rd;
 -
 -            if (diff < 0x1000 || diff >= 0x100000) {
 -                return false;
 -            }
 -
 -            /* add rt, pc, #high */
 -            *code_ptr++ = ((insn & 0xf0000000) | (1 << 25) | ARITH_ADD
 -                           | (TCG_REG_PC << 16) | (rt << 12)
 -                           | (20 << 7) | (diff >> 12));
 -            /* ldr rd, [rt, #low] */
 -            insn = deposit32(insn, 12, 4, rt);
 -            diff &= 0xfff;
 -            u = 1;
 -        }
 -        insn = deposit32(insn, 23, 1, u);
 -        insn = deposit32(insn, 0, 12, diff);
 -        *code_ptr = insn;
 +        return reloc_pc13(code_ptr, (tcg_insn_unit *)value);
      } else {
          g_assert_not_reached();
      }
--    return true;
+     if (a0 & TCG_MO_ST_ST) {
- }
+-        insn |= 0x02200000;
++        insn |= 0x01100000;
  #define TCG_CT_CONST_ARM  0x100
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld8s_r(TCGContext *s, int cond, TCGReg rt,
  static void tcg_out_movi_pool(TCGContext *s, int cond, int rd, uint32_t arg)
  {
 -    /* The 12-bit range on the ldr insn is sometimes a bit too small.
 -       In order to get around that we require two insns, one of which
 -       will usually be a nop, but may be replaced in patch_reloc.  */
      new_pool_label(s, arg, R_ARM_PC13, s->code_ptr, 0);
      tcg_out_ld32_12(s, cond, rd, TCG_REG_PC, 0);
 -    tcg_out_nop(s);
  }
  static void tcg_out_movi32(TCGContext *s, int cond, int rd, uint32_t arg)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *addr)
          tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
          tcg_out_blx(s, COND_AL, TCG_REG_TMP);
      } else {
 -        /* ??? Know that movi_pool emits exactly 2 insns.  */
 -        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 4);
 +        /* ??? Know that movi_pool emits exactly 1 insn.  */
 +        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 0);
          tcg_out_movi_pool(s, COND_AL, TCG_REG_PC, addri);
      }
+     tcg_out32(s, insn);
  }
 --
-.17.1
+.43.0

-[Qemu-devel] [PULL 15/15] cputlb: Fix io_readx() to respect the access_type
+[PULL 3/4] include/exec: Introduce fpst alias in helper-head.h.inc
-From: Shahab Vahedi <shahab.vahedi@gmail.com>
+This allows targets to declare that the helper requires a
 float_status pointer and instead of a generic void pointer.
-This change adapts io_readx() to its input access_type. Currently
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 io_readx() treats any memory access as a read, although it has an
 input argument "MMUAccessType access_type". This results in:
 ) Calling the tlb_fill() only with MMU_DATA_LOAD
 ) Considering only entry->addr_read as the tlb_addr
 Buglink: https://bugs.launchpad.net/qemu/+bug/1825359
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Shahab Vahedi <shahab.vahedi@gmail.com>
 Message-Id: <20190420072236.12347-1-shahab.vahedi@gmail.com>
 [rth: Remove assert; fix expression formatting.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 +++--
+ include/exec/helper-head.h.inc | 3 +++
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 3 insertions(+)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/exec/helper-head.h.inc
-+++ b/accel/tcg/cputlb.c
++++ b/include/exec/helper-head.h.inc
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+@@ -XXX,XX +XXX,XX @@
-         CPUTLBEntry *entry;
+ #define dh_alias_ptr ptr
-         target_ulong tlb_addr;
+ #define dh_alias_cptr ptr
+ #define dh_alias_env ptr
--        tlb_fill(cpu, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
++#define dh_alias_fpst ptr
-+        tlb_fill(cpu, addr, size, access_type, mmu_idx, retaddr);
+ #define dh_alias_void void
+ #define dh_alias_noreturn noreturn
-         entry = tlb_entry(env, mmu_idx, addr);
+ #define dh_alias(t) glue(dh_alias_, t)
--        tlb_addr = entry->addr_read;
+@@ -XXX,XX +XXX,XX @@
-+        tlb_addr = (access_type == MMU_DATA_LOAD ?
+ #define dh_ctype_ptr void *
-+                    entry->addr_read : entry->addr_code);
+ #define dh_ctype_cptr const void *
-         if (!(tlb_addr & ~(TARGET_PAGE_MASK | TLB_RECHECK))) {
+ #define dh_ctype_env CPUArchState *
-             /* RAM access */
++#define dh_ctype_fpst float_status *
-             uintptr_t haddr = addr + entry->addend;
+ #define dh_ctype_void void
  #define dh_ctype_noreturn G_NORETURN void
  #define dh_ctype(t) dh_ctype_##t
@@ -XXX,XX +XXX,XX @@
  #define dh_typecode_f64 dh_typecode_i64
  #define dh_typecode_cptr dh_typecode_ptr
  #define dh_typecode_env dh_typecode_ptr
 +#define dh_typecode_fpst dh_typecode_ptr
  #define dh_typecode(t) dh_typecode_##t
  #define dh_callflag_i32  0
 --
-.17.1
+.43.0

-[Qemu-devel] [PULL 12/15] tcg: Restart TB generation after out-of-line ldst overflow
+[PULL 4/4] target/sparc: Use memcpy() and remove memcpy32()
-This is part c of relocation overflow handling.
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Rather than manually copying each register, use
+the libc memcpy(), which is well optimized nowadays.
+Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20241205205418.67613-1-philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.inc.c | 16 ++++++++++------
+ target/sparc/win_helper.c | 26 ++++++++------------------
- tcg/arm/tcg-target.inc.c     | 16 ++++++++++------
+file changed, 8 insertions(+), 18 deletions(-)
  tcg/i386/tcg-target.inc.c    |  6 ++++--
  tcg/mips/tcg-target.inc.c    |  6 ++++--
  tcg/ppc/tcg-target.inc.c     | 14 ++++++++++----
  tcg/riscv/tcg-target.inc.c   | 16 ++++++++++++----
  tcg/s390/tcg-target.inc.c    | 20 ++++++++++++--------
  tcg/tcg-ldst.inc.c           | 18 +++++++++---------
  tcg/tcg.c                    |  7 ++++---
 files changed, 75 insertions(+), 44 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
+diff --git a/target/sparc/win_helper.c b/target/sparc/win_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.inc.c
+--- a/target/sparc/win_helper.c
-+++ b/tcg/aarch64/tcg-target.inc.c
++++ b/target/sparc/win_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
+@@ -XXX,XX +XXX,XX @@
-     tcg_out_insn(s, 3406, ADR, rd, offset);
+ #include "exec/helper-proto.h"
  #include "trace.h"
 -static inline void memcpy32(target_ulong *dst, const target_ulong *src)
 -{
 -    dst[0] = src[0];
 -    dst[1] = src[1];
 -    dst[2] = src[2];
 -    dst[3] = src[3];
 -    dst[4] = src[4];
 -    dst[5] = src[5];
 -    dst[6] = src[6];
 -    dst[7] = src[7];
 -}
 -
  void cpu_set_cwp(CPUSPARCState *env, int new_cwp)
  {
      /* put the modified wrap registers at their proper location */
      if (env->cwp == env->nwindows - 1) {
 -        memcpy32(env->regbase, env->regbase + env->nwindows * 16);
 +        memcpy(env->regbase, env->regbase + env->nwindows * 16,
 +               sizeof(env->gregs));
      }
      env->cwp = new_cwp;
      /* put the wrap registers at their temporary location */
      if (new_cwp == env->nwindows - 1) {
 -        memcpy32(env->regbase + env->nwindows * 16, env->regbase);
 +        memcpy(env->regbase + env->nwindows * 16, env->regbase,
 +               sizeof(env->gregs));
      }
      env->regwptr = env->regbase + (new_cwp * 16);
  }
+@@ -XXX,XX +XXX,XX @@ void cpu_gl_switch_gregs(CPUSPARCState *env, uint32_t new_gl)
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     dst = get_gl_gregset(env, env->gl);
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
+     if (src != dst) {
-     TCGMemOpIdx oi = lb->oi;
+-        memcpy32(dst, env->gregs);
-     TCGMemOp opc = get_memop(oi);
+-        memcpy32(env->gregs, src);
-     TCGMemOp size = opc & MO_SIZE;
++        memcpy(dst, env->gregs, sizeof(env->gregs));
++        memcpy(env->gregs, src, sizeof(env->gregs));
 -    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
      tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      }
      tcg_out_goto(s, lb->raddr);
 +    return true;
  }
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
      TCGMemOp size = opc & MO_SIZE;
 -    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
      tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      tcg_out_adr(s, TCG_REG_X4, lb->raddr);
      tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
      tcg_out_goto(s, lb->raddr);
 +    return true;
  }
  static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
 diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.inc.c
 +++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
      label->label_ptr[0] = label_ptr;
  }
 -static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGReg argreg, datalo, datahi;
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
      void *func;
 -    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      argreg = tcg_out_arg_reg32(s, TCG_REG_R0, TCG_AREG0);
      if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      }
      tcg_out_goto(s, COND_AL, lb->raddr);
 +    return true;
  }
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      TCGReg argreg, datalo, datahi;
      TCGMemOpIdx oi = lb->oi;
      TCGMemOp opc = get_memop(oi);
 -    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
 -    tcg_debug_assert(ok);
 +    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
 +        return false;
 +    }
      argreg = TCG_REG_R0;
      argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
      /* Tail-call to the helper, which will return to the fast path.  */
      tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    return true;
  }
  #endif /* SOFTMMU */
 diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.inc.c
 +++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
  /*
   * Generate code for the slow path for a load at the end of block
   */
 -static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* Jump to the code corresponding to next IR of qemu_st */
      tcg_out_jmp(s, l->raddr);
 +    return true;
  }
  /*
   * Generate code for the slow path for a store at the end of block
   */
 -static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  {
      TCGMemOpIdx oi = l->oi;
      TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      /* "Tail call" to the helper, with the return address back inline.  */
      tcg_out_push(s, retaddr);
      tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 +    return true;
  }
  #elif TCG_TARGET_REG_BITS == 32
  # define x86_guest_base_seg     0
 diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.inc.c
 +++ b/tcg/mips/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
      }
  }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+@@ -XXX,XX +XXX,XX @@ void cpu_change_pstate(CPUSPARCState *env, uint32_t new_pstate)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+         /* Switch global register bank */
- {
+         src = get_gregset(env, new_pstate_regs);
-     TCGMemOpIdx oi = l->oi;
+         dst = get_gregset(env, pstate_regs);
-     TCGMemOp opc = get_memop(oi);
+-        memcpy32(dst, env->gregs);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+-        memcpy32(env->gregs, src);
 +        memcpy(dst, env->gregs, sizeof(env->gregs));
 +        memcpy(env->gregs, src, sizeof(env->gregs));
      } else {
-         tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
+         trace_win_helper_no_switch_pstate(new_pstate_regs);
      }
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
-     TCGMemOp opc = get_memop(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)], true);
-     /* delay slot */
-     tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
-+    return true;
- }
- #endif
-diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.inc.c
-+++ b/tcg/ppc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = lptr;
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
-     TCGReg hi, lo, arg = TCG_REG_R3;
--    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
-+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     }
-     tcg_out_b(s, 0, lb->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
-     TCGMemOp s_bits = opc & MO_SIZE;
-     TCGReg hi, lo, arg = TCG_REG_R3;
--    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
-+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
-     tcg_out_b(s, 0, lb->raddr);
-+    return true;
- }
- #endif /* SOFTMMU */
-diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.inc.c
-+++ b/tcg/riscv/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = label_ptr[0];
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
-     TCGMemOp opc = get_memop(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     }
-     /* resolve label address */
--    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
-+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
-+                     (intptr_t) s->code_ptr, 0)) {
-+        return false;
-+    }
-     /* call load helper */
-     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
-     tcg_out_goto(s, l->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
-     TCGMemOp opc = get_memop(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     }
-     /* resolve label address */
--    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
-+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
-+                     (intptr_t) s->code_ptr, 0)) {
-+        return false;
-+    }
-     /* call store helper */
-     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
-     tcg_out_goto(s, l->raddr);
-+    return true;
- }
- #endif /* CONFIG_SOFTMMU */
-diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.inc.c
-+++ b/tcg/s390/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
-     label->label_ptr[0] = label_ptr;
- }
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
--    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
--                          (intptr_t)s->code_ptr, 2);
--    tcg_debug_assert(ok);
-+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-+                     (intptr_t)s->code_ptr, 2)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
-     if (TARGET_LONG_BITS == 64) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_R2);
-     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
-+    return true;
- }
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
-     TCGMemOp opc = get_memop(oi);
--    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
--                          (intptr_t)s->code_ptr, 2);
--    tcg_debug_assert(ok);
-+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-+                     (intptr_t)s->code_ptr, 2)) {
-+        return false;
-+    }
-     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
-     if (TARGET_LONG_BITS == 64) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
-     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
-+    return true;
- }
- #else
- static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
-diff --git a/tcg/tcg-ldst.inc.c b/tcg/tcg-ldst.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-ldst.inc.c
-+++ b/tcg/tcg-ldst.inc.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGLabelQemuLdst {
-  * Generate TB finalization at the end of block
-  */
--static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
--static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
--static bool tcg_out_ldst_finalize(TCGContext *s)
-+static int tcg_out_ldst_finalize(TCGContext *s)
- {
-     TCGLabelQemuLdst *lb;
-     /* qemu_ld/st slow paths */
-     QSIMPLEQ_FOREACH(lb, &s->ldst_labels, next) {
--        if (lb->is_ld) {
--            tcg_out_qemu_ld_slow_path(s, lb);
--        } else {
--            tcg_out_qemu_st_slow_path(s, lb);
-+        if (lb->is_ld
-+            ? !tcg_out_qemu_ld_slow_path(s, lb)
-+            : !tcg_out_qemu_st_slow_path(s, lb)) {
-+            return -2;
-         }
-         /* Test for (pending) buffer overflow.  The assumption is that any
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_ldst_finalize(TCGContext *s)
-            the buffer completely.  Thus we can test for overflow after
-            generating code without having to check during generation.  */
-         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
--            return false;
-+            return -1;
-         }
-     }
--    return true;
-+    return 0;
- }
- /*
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *target);
- static int tcg_target_const_match(tcg_target_long val, TCGType type,
-                                   const TCGArgConstraint *arg_ct);
- #ifdef TCG_TARGET_NEED_LDST_LABELS
--static bool tcg_out_ldst_finalize(TCGContext *s);
-+static int tcg_out_ldst_finalize(TCGContext *s);
- #endif
- #define TCG_HIGHWATER 1024
-@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
-     /* Generate TB finalization at the end of block */
- #ifdef TCG_TARGET_NEED_LDST_LABELS
--    if (!tcg_out_ldst_finalize(s)) {
--        return -1;
-+    i = tcg_out_ldst_finalize(s);
-+    if (i < 0) {
-+        return i;
-     }
- #endif
- #ifdef TCG_TARGET_NEED_POOL_LABELS
 --
-.17.1
+.43.0

-[Qemu-devel] [PULL 13/15] tcg/ppc: Allow the constant pool to overflow at 32k
+Deleted patch
-There is no point in coding for a 2GB offset when the max TB size
-is already limited to 64k.  If we further restrict to 32k then we
-can eliminate the extra ADDIS instruction.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/ppc/tcg-target.inc.c | 28 ++++++++++------------------
-file changed, 10 insertions(+), 18 deletions(-)
-diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.inc.c
-+++ b/tcg/ppc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-                         intptr_t value, intptr_t addend)
- {
-     tcg_insn_unit *target;
--    tcg_insn_unit old;
-     value += addend;
-     target = (tcg_insn_unit *)value;
-@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-     case R_PPC_REL24:
-         return reloc_pc24(code_ptr, target);
-     case R_PPC_ADDR16:
--        /* We are abusing this relocation type.  This points to a pair
--           of insns, addis + load.  If the displacement is small, we
--           can nop out the addis.  */
--        if (value == (int16_t)value) {
--            code_ptr[0] = NOP;
--            old = deposit32(code_ptr[1], 0, 16, value);
--            code_ptr[1] = deposit32(old, 16, 5, TCG_REG_TB);
--        } else {
--            int16_t lo = value;
--            int hi = value - lo;
--            if (hi + lo != value) {
--                return false;
--            }
--            code_ptr[0] = deposit32(code_ptr[0], 0, 16, hi >> 16);
--            code_ptr[1] = deposit32(code_ptr[1], 0, 16, lo);
-+        /*
-+         * We are (slightly) abusing this relocation type.  In particular,
-+         * assert that the low 2 bits are zero, and do not modify them.
-+         * That way we can use this with LD et al that have opcode bits
-+         * in the low 2 bits of the insn.
-+         */
-+        if ((value & 3) || value != (int16_t)value) {
-+            return false;
-         }
-+        *code_ptr = (*code_ptr & ~0xfffc) | (value & 0xfffc);
-         break;
-     default:
-         g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
-     if (!in_prologue && USE_REG_TB) {
-         new_pool_label(s, arg, R_PPC_ADDR16, s->code_ptr,
-                        -(intptr_t)s->code_gen_ptr);
--        tcg_out32(s, ADDIS | TAI(ret, TCG_REG_TB, 0));
--        tcg_out32(s, LD | TAI(ret, ret, 0));
-+        tcg_out32(s, LD | TAI(ret, TCG_REG_TB, 0));
-         return;
-     }
---
-.17.1

The following changes since commit 3284aa128153750f14a61e8a96fd085e6f2999b6:

Merge remote-tracking branch 'remotes/lersek/tags/edk2-pull-2019-04-22' into staging (2019-04-24 13:19:41 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20190426

for you to fetch changes up to ef5dae6805cce7b59d129d801bdc5db71bcbd60d:

cputlb: Fix io_readx() to respect the access_type (2019-04-25 10:40:06 -0700)

----------------------------------------------------------------
Add tcg_gen_extract2_*.
Deal with overflow of TranslationBlocks.
Respect access_type in io_readx.

----------------------------------------------------------------
David Hildenbrand (1):
      tcg: Implement tcg_gen_extract2_{i32,i64}

Richard Henderson (13):
      tcg: Add INDEX_op_extract2_{i32,i64}
      tcg: Use deposit and extract2 in tcg_gen_shifti_i64
      tcg: Use extract2 in tcg_gen_deposit_{i32,i64}
      tcg/i386: Support INDEX_op_extract2_{i32,i64}
      tcg/arm: Support INDEX_op_extract2_i32
      tcg/aarch64: Support INDEX_op_extract2_{i32,i64}
      tcg: Hoist max_insns computation to tb_gen_code
      tcg: Restart after TB code generation overflow
      tcg: Restart TB generation after relocation overflow
      tcg: Restart TB generation after constant pool overflow
      tcg: Restart TB generation after out-of-line ldst overflow
      tcg/ppc: Allow the constant pool to overflow at 32k
      tcg/arm: Restrict constant pool displacement to 12 bits

Shahab Vahedi (1):
      cputlb: Fix io_readx() to respect the access_type

From: David Hildenbrand <david@redhat.com>

Will be helpful for s390x. Input 128 bit and output 64 bit only,
which is sufficient for now.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190225154204.26751-1-david@redhat.com>
[rth: Add matching tcg_gen_extract2_i32.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.h |  6 ++++++
 tcg/tcg-op.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
                          unsigned int ofs, unsigned int len);
 void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
                           unsigned int ofs, unsigned int len);
+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
+                          unsigned int ofs);
 void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, TCGLabel *);
 void tcg_gen_brcondi_i32(TCGCond cond, TCGv_i32 arg1, int32_t arg2, TCGLabel *);
 void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
                          unsigned int ofs, unsigned int len);
 void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
                           unsigned int ofs, unsigned int len);
+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
+                          unsigned int ofs);
 void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, TCGLabel *);
 void tcg_gen_brcondi_i64(TCGCond cond, TCGv_i64 arg1, int64_t arg2, TCGLabel *);
 void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i64
 #define tcg_gen_extract_tl tcg_gen_extract_i64
 #define tcg_gen_sextract_tl tcg_gen_sextract_i64
+#define tcg_gen_extract2_tl tcg_gen_extract2_i64
 #define tcg_const_tl tcg_const_i64
 #define tcg_const_local_tl tcg_const_local_i64
 #define tcg_gen_movcond_tl tcg_gen_movcond_i64
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_deposit_z_tl tcg_gen_deposit_z_i32
 #define tcg_gen_extract_tl tcg_gen_extract_i32
 #define tcg_gen_sextract_tl tcg_gen_sextract_i32
+#define tcg_gen_extract2_tl tcg_gen_extract2_i32
 #define tcg_const_tl tcg_const_i32
 #define tcg_const_local_tl tcg_const_local_i32
 #define tcg_gen_movcond_tl tcg_gen_movcond_i32
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
     tcg_gen_sari_i32(ret, ret, 32 - len);
 }
 
+/*
+ * Extract 32-bits from a 64-bit input, ah:al, starting from ofs.
+ * Unlike tcg_gen_extract_i32 above, len is fixed at 32.
+ */
+void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
+                          unsigned int ofs)
+{
+    tcg_debug_assert(ofs <= 32);
+    if (ofs == 0) {
+        tcg_gen_mov_i32(ret, al);
+    } else if (ofs == 32) {
+        tcg_gen_mov_i32(ret, ah);
+    } else if (al == ah) {
+        tcg_gen_rotri_i32(ret, al, ofs);
+    } else {
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        tcg_gen_shri_i32(t0, al, ofs);
+        tcg_gen_deposit_i32(ret, t0, ah, 32 - ofs, ofs);
+        tcg_temp_free_i32(t0);
+    }
+}
+
 void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
                          TCGv_i32 c2, TCGv_i32 v1, TCGv_i32 v2)
 {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
     tcg_gen_sari_i64(ret, ret, 64 - len);
 }
 
+/*
+ * Extract 64 bits from a 128-bit input, ah:al, starting from ofs.
+ * Unlike tcg_gen_extract_i64 above, len is fixed at 64.
+ */
+void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
+                          unsigned int ofs)
+{
+    tcg_debug_assert(ofs <= 64);
+    if (ofs == 0) {
+        tcg_gen_mov_i64(ret, al);
+    } else if (ofs == 64) {
+        tcg_gen_mov_i64(ret, ah);
+    } else if (al == ah) {
+        tcg_gen_rotri_i64(ret, al, ofs);
+    } else {
+        TCGv_i64 t0 = tcg_temp_new_i64();
+        tcg_gen_shri_i64(t0, al, ofs);
+        tcg_gen_deposit_i64(ret, t0, ah, 64 - ofs, ofs);
+        tcg_temp_free_i64(t0);
+    }
+}
+
 void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
                          TCGv_i64 c2, TCGv_i64 v1, TCGv_i64 v2)
 {
-- 
2.17.1

This will let backends implement the double-word shift operation.

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     1
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_mips32r2_instructions
 #define TCG_TARGET_HAS_extract_i32      use_mips32r2_instructions
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_ext8s_i32        use_mips32r2_instructions
 #define TCG_TARGET_HAS_ext16s_i32       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_deposit_i64      use_mips32r2_instructions
 #define TCG_TARGET_HAS_extract_i64      use_mips32r2_instructions
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_ext8s_i64        use_mips32r2_instructions
 #define TCG_TARGET_HAS_ext16s_i64       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
@@ -XXX,XX +XXX,XX @@ extern bool have_isa_3_00;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i32      0
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extrl_i64_i32    1
 #define TCG_TARGET_HAS_extrh_i64_i32    1
 #define TCG_TARGET_HAS_ext8s_i64        1
diff --git a/tcg/s390/tcg-target.h b/tcg/s390/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.h
+++ b/tcg/s390/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
 #define TCG_TARGET_HAS_deposit_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_extract_i32    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_sextract_i32   0
+#define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_movcond_i32    1
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities;
 #define TCG_TARGET_HAS_deposit_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_extract_i64    (s390_facilities & FACILITY_GEN_INST_EXT)
 #define TCG_TARGET_HAS_sextract_i64   0
+#define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_movcond_i64    1
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.h
+++ b/tcg/sparc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_deposit_i32      0
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-opc.h
+++ b/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(rotr_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rot_i32))
 DEF(deposit_i32, 1, 2, 2, IMPL(TCG_TARGET_HAS_deposit_i32))
 DEF(extract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_extract_i32))
 DEF(sextract_i32, 1, 1, 2, IMPL(TCG_TARGET_HAS_sextract_i32))
+DEF(extract2_i32, 1, 2, 1, IMPL(TCG_TARGET_HAS_extract2_i32))
 
 DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END)
 
@@ -XXX,XX +XXX,XX @@ DEF(rotr_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rot_i64))
 DEF(deposit_i64, 1, 2, 2, IMPL64 | IMPL(TCG_TARGET_HAS_deposit_i64))
 DEF(extract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_extract_i64))
 DEF(sextract_i64, 1, 1, 2, IMPL64 | IMPL(TCG_TARGET_HAS_sextract_i64))
+DEF(extract2_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_extract2_i64))
 
 /* size changing ops */
 DEF(ext_i32_i64, 1, 1, 0, IMPL64)
diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_deposit_i64      0
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      0
 #define TCG_TARGET_HAS_sextract_i32     0
+#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
+#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          0
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        1
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        CASE_OP_32_64(extract2):
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                TCGArg v1 = arg_info(op->args[1])->val;
+                TCGArg v2 = arg_info(op->args[2])->val;
+
+                if (opc == INDEX_op_extract2_i64) {
+                    tmp = (v1 >> op->args[3]) | (v2 << (64 - op->args[3]));
+                } else {
+                    tmp = (v1 >> op->args[3]) | (v2 << (32 - op->args[3]));
+                    tmp = (int32_t)tmp;
+                }
+                tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                break;
+            }
+            goto do_default;
+
         CASE_OP_32_64(setcond):
             tmp = do_constant_folding_cond(opc, op->args[1],
                                            op->args[2], op->args[3]);
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
         tcg_gen_mov_i32(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i32(ret, al, ofs);
+    } else if (TCG_TARGET_HAS_extract2_i32) {
+        tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
     } else {
         TCGv_i32 t0 = tcg_temp_new_i32();
         tcg_gen_shri_i32(t0, al, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
         tcg_gen_mov_i64(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i64(ret, al, ofs);
+    } else if (TCG_TARGET_HAS_extract2_i64) {
+        tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
     } else {
         TCGv_i64 t0 = tcg_temp_new_i64();
         tcg_gen_shri_i64(t0, al, ofs);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
         return TCG_TARGET_HAS_extract_i32;
     case INDEX_op_sextract_i32:
         return TCG_TARGET_HAS_sextract_i32;
+    case INDEX_op_extract2_i32:
+        return TCG_TARGET_HAS_extract2_i32;
     case INDEX_op_add2_i32:
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
         return TCG_TARGET_HAS_extract_i64;
     case INDEX_op_sextract_i64:
         return TCG_TARGET_HAS_sextract_i64;
+    case INDEX_op_extract2_i64:
+        return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_extrl_i64_i32:
         return TCG_TARGET_HAS_extrl_i64_i32;
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/README b/tcg/README
index XXXXXXX..XXXXXXX 100644
--- a/tcg/README
+++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ at bit 8.  This operation would be equivalent to
 
 (using an arithmetic right shift).
 
+* extract2_i32/i64 dest, t1, t2, pos
+
+For N = {32,64}, extract an N-bit quantity from the concatenation
+of t2:t1, beginning at pos.  The tcg_gen_extract2_{i32,i64} expander
+accepts 0 <= pos <= N as inputs.  The backend code generator will
+not see either 0 or N as inputs for these opcodes.
+
 * extrl_i64_i32 t0, t1
 
 For 64-bit hosts only, extract the low 32-bits of input T1 and place it
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 47 ++++++++++++++++++++++++-----------------------
 1 file changed, 24 insertions(+), 23 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_LOW(arg1), c);
             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
         }
-    } else {
-        TCGv_i32 t0, t1;
-
-        t0 = tcg_temp_new_i32();
-        t1 = tcg_temp_new_i32();
-        if (right) {
-            tcg_gen_shli_i32(t0, TCGV_HIGH(arg1), 32 - c);
-            if (arith) {
-                tcg_gen_sari_i32(t1, TCGV_HIGH(arg1), c);
-            } else {
-                tcg_gen_shri_i32(t1, TCGV_HIGH(arg1), c);
-            }
-            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
-            tcg_gen_or_i32(TCGV_LOW(ret), TCGV_LOW(ret), t0);
-            tcg_gen_mov_i32(TCGV_HIGH(ret), t1);
+    } else if (right) {
+        if (TCG_TARGET_HAS_extract2_i32) {
+            tcg_gen_extract2_i32(TCGV_LOW(ret),
+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
         } else {
-            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
-            /* Note: ret can be the same as arg1, so we use t1 */
-            tcg_gen_shli_i32(t1, TCGV_LOW(arg1), c);
-            tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
-            tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), t0);
-            tcg_gen_mov_i32(TCGV_LOW(ret), t1);
+            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
+            tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
+                                TCGV_HIGH(arg1), 32 - c, c);
         }
-        tcg_temp_free_i32(t0);
-        tcg_temp_free_i32(t1);
+        if (arith) {
+            tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
+        } else {
+            tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
+        }
+    } else {
+        if (TCG_TARGET_HAS_extract2_i32) {
+            tcg_gen_extract2_i32(TCGV_HIGH(ret),
+                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
+        } else {
+            TCGv_i32 t0 = tcg_temp_new_i32();
+            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
+            tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
+                                TCGV_HIGH(arg1), c, 32 - c);
+            tcg_temp_free_i32(t0);
+        }
+        tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
     }
 }
 
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
         return;
     }
 
-    mask = (1u << len) - 1;
     t1 = tcg_temp_new_i32();
 
+    if (TCG_TARGET_HAS_extract2_i32) {
+        if (ofs + len == 32) {
+            tcg_gen_shli_i32(t1, arg1, len);
+            tcg_gen_extract2_i32(ret, t1, arg2, len);
+            goto done;
+        }
+        if (ofs == 0) {
+            tcg_gen_extract2_i32(ret, arg1, arg2, len);
+            tcg_gen_rotli_i32(ret, ret, len);
+            goto done;
+        }
+    }
+
+    mask = (1u << len) - 1;
     if (ofs + len < 32) {
         tcg_gen_andi_i32(t1, arg2, mask);
         tcg_gen_shli_i32(t1, t1, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
     }
     tcg_gen_andi_i32(ret, arg1, ~(mask << ofs));
     tcg_gen_or_i32(ret, ret, t1);
-
+ done:
     tcg_temp_free_i32(t1);
 }
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
         }
     }
 
-    mask = (1ull << len) - 1;
     t1 = tcg_temp_new_i64();
 
+    if (TCG_TARGET_HAS_extract2_i64) {
+        if (ofs + len == 64) {
+            tcg_gen_shli_i64(t1, arg1, len);
+            tcg_gen_extract2_i64(ret, t1, arg2, len);
+            goto done;
+        }
+        if (ofs == 0) {
+            tcg_gen_extract2_i64(ret, arg1, arg2, len);
+            tcg_gen_rotli_i64(ret, ret, len);
+            goto done;
+        }
+    }
+
+    mask = (1ull << len) - 1;
     if (ofs + len < 64) {
         tcg_gen_andi_i64(t1, arg2, mask);
         tcg_gen_shli_i64(t1, t1, ofs);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
     }
     tcg_gen_andi_i64(ret, arg1, ~(mask << ofs));
     tcg_gen_or_i64(ret, ret, t1);
-
+ done:
     tcg_temp_free_i64(t1);
 }
 
-- 
2.17.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |  4 ++--
 tcg/i386/tcg-target.inc.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_extract_i32      1
 #define TCG_TARGET_HAS_sextract_i32     1
-#define TCG_TARGET_HAS_extract2_i32     0
+#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_deposit_i64      1
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
-#define TCG_TARGET_HAS_extract2_i64     0
+#define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline int tcg_target_const_match(tcg_target_long val, TCGType type,
 #define OPC_SHUFPS      (0xc6 | P_EXT)
 #define OPC_SHLX        (0xf7 | P_EXT38 | P_DATA16)
 #define OPC_SHRX        (0xf7 | P_EXT38 | P_SIMDF2)
+#define OPC_SHRD_Ib     (0xac | P_EXT)
 #define OPC_TESTL	(0x85)
 #define OPC_TZCNT       (0xbc | P_EXT | P_SIMDF3)
 #define OPC_UD2         (0x0b | P_EXT)
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
+    OP_32_64(extract2):
+        /* Note that SHRD outputs to the r/m operand.  */
+        tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
+        tcg_out8(s, args[3]);
+        break;
+
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
     static const TCGTargetOpDef r_0 = { .args_ct_str = { "r", "0" } };
     static const TCGTargetOpDef r_r_ri = { .args_ct_str = { "r", "r", "ri" } };
     static const TCGTargetOpDef r_r_re = { .args_ct_str = { "r", "r", "re" } };
+    static const TCGTargetOpDef r_0_r = { .args_ct_str = { "r", "0", "r" } };
     static const TCGTargetOpDef r_0_re = { .args_ct_str = { "r", "0", "re" } };
     static const TCGTargetOpDef r_0_ci = { .args_ct_str = { "r", "0", "ci" } };
     static const TCGTargetOpDef r_L = { .args_ct_str = { "r", "L" } };
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
     case INDEX_op_ctpop_i32:
     case INDEX_op_ctpop_i64:
         return &r_r;
+    case INDEX_op_extract2_i32:
+    case INDEX_op_extract2_i64:
+        return &r_0_r;
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-- 
2.17.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |  2 +-
 tcg/arm/tcg-target.inc.c | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_idiv_instructions;
 #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_extract_i32      use_armv7_instructions
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
-#define TCG_TARGET_HAS_extract2_i32     0
+#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_sextract_i32:
         tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
+    case INDEX_op_extract2_i32:
+        /* ??? These optimization vs zero should be generic.  */
+        /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
+        if (const_args[1]) {
+            if (const_args[2]) {
+                tcg_out_movi(s, TCG_TYPE_REG, args[0], 0);
+            } else {
+                tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
+                                args[2], SHIFT_IMM_LSL(32 - args[3]));
+            }
+        } else if (const_args[2]) {
+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
+                            args[1], SHIFT_IMM_LSR(args[3]));
+        } else {
+            /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
+            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0,
+                            args[2], SHIFT_IMM_LSL(32 - args[3]));
+            tcg_out_dat_reg(s, COND_AL, ARITH_ORR, args[0], TCG_REG_TMP,
+                            args[1], SHIFT_IMM_LSR(args[3]));
+        }
+        break;
 
     case INDEX_op_div_i32:
         tcg_out_sdiv(s, COND_AL, args[0], args[1], args[2]);
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
         = { .args_ct_str = { "s", "s", "s", "s" } };
     static const TCGTargetOpDef br
         = { .args_ct_str = { "r", "rIN" } };
+    static const TCGTargetOpDef ext2
+        = { .args_ct_str = { "r", "rZ", "rZ" } };
     static const TCGTargetOpDef dep
         = { .args_ct_str = { "r", "0", "rZ" } };
     static const TCGTargetOpDef movc
@@ -XXX,XX +XXX,XX @@ static const TCGTargetOpDef *tcg_target_op_def(TCGOpcode op)
         return &br;
     case INDEX_op_deposit_i32:
         return &dep;
+    case INDEX_op_extract2_i32:
+        return &ext2;
     case INDEX_op_movcond_i32:
         return &movc;
     case INDEX_op_add2_i32:
-- 
2.17.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h     |  4 ++--
 tcg/aarch64/tcg-target.inc.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

In order to handle TB's that translate to too much code, we
need to place the control of the length of the translation
in the hands of the code gen master loop.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  4 ++--
 include/exec/translator.h     |  3 ++-
 accel/tcg/translate-all.c     | 15 +++++++++++++--
 accel/tcg/translator.c        | 15 ++-------------
 target/alpha/translate.c      |  4 ++--
 target/arm/translate.c        |  4 ++--
 target/cris/translate.c       | 10 +---------
 target/hppa/translate.c       |  5 ++---
 target/i386/translate.c       |  4 ++--
 target/lm32/translate.c       | 10 +---------
 target/m68k/translate.c       |  4 ++--
 target/microblaze/translate.c | 10 +---------
 target/mips/translate.c       |  4 ++--
 target/moxie/translate.c      | 11 ++---------
 target/nios2/translate.c      | 14 ++------------
 target/openrisc/translate.c   |  4 ++--
 target/ppc/translate.c        |  4 ++--
 target/riscv/translate.c      |  4 ++--
 target/s390x/translate.c      |  4 ++--
 target/sh4/translate.c        |  4 ++--
 target/sparc/translate.c      |  4 ++--
 target/tilegx/translate.c     | 12 +-----------
 target/tricore/translate.c    | 16 ++--------------
 target/unicore32/translate.c  | 10 +---------
 target/xtensa/translate.c     |  4 ++--
 25 files changed, 56 insertions(+), 127 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 
 #include "qemu/log.h"
 
-void gen_intermediate_code(CPUState *cpu, struct TranslationBlock *tb);
-void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
+void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
 void cpu_gen_init(void);
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
+ * @max_insns: Maximum number of insns to translate.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When too many instructions have been translated.
  */
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb);
+                     CPUState *cpu, TranslationBlock *tb, int max_insns);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb_page_addr_t phys_pc, phys_page2;
     target_ulong virt_page2;
     tcg_insn_unit *gen_code_buf;
-    int gen_code_size, search_size;
+    int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     cflags &= ~CF_CLUSTER_MASK;
     cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
 
+    max_insns = cflags & CF_COUNT_MASK;
+    if (max_insns == 0) {
+        max_insns = CF_COUNT_MASK;
+    }
+    if (max_insns > TCG_MAX_INSNS) {
+        max_insns = TCG_MAX_INSNS;
+    }
+    if (cpu->singlestep_enabled || singlestep) {
+        max_insns = 1;
+    }
+
  buffer_overflow:
     tb = tb_alloc(pc);
     if (unlikely(!tb)) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = ENV_GET_CPU(env);
-    gen_intermediate_code(cpu, tb);
+    gen_intermediate_code(cpu, tb, max_insns);
     tcg_ctx->cpu = NULL;
 
     trace_translate_block(tb, tb->pc, tb->tc.ptr);
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ void translator_loop_temp_check(DisasContextBase *db)
 }
 
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb)
+                     CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     int bp_insn = 0;
 
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     db->pc_next = db->pc_first;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
+    db->max_insns = max_insns;
     db->singlestep_enabled = cpu->singlestep_enabled;
 
-    /* Instruction counting */
-    db->max_insns = tb_cflags(db->tb) & CF_COUNT_MASK;
-    if (db->max_insns == 0) {
-        db->max_insns = CF_COUNT_MASK;
-    }
-    if (db->max_insns > TCG_MAX_INSNS) {
-        db->max_insns = TCG_MAX_INSNS;
-    }
-    if (db->singlestep_enabled || singlestep) {
-        db->max_insns = 1;
-    }
-
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb);
+    translator_loop(ops, &dc.base, cpu, tb, max_insns);
 }
 
 void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
  */
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUCRISState *env = cs->env_ptr;
     uint32_t pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t page_start;
     target_ulong npc;
     int num_insns;
-    int max_insns;
 
     if (env->pregs[PR_VR] == 32) {
         dc->decoder = crisv32_decoder;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
-
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/translate.c b/target/i386/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/translate.c
+++ b/target/i386/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/lm32/translate.c b/target/lm32/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/translate.c
+++ b/target/lm32/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPULM32State *env = cs->env_ptr;
     LM32CPU *cpu = lm32_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t pc_start;
     uint32_t page_start;
     int num_insns;
-    int max_insns;
 
     pc_start = tb->pc;
     dc->features = cpu->features;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb);
+    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void decode(DisasContext *dc, uint32_t ir)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUMBState *env = cs->env_ptr;
     MicroBlazeCPU *cpu = mb_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint32_t page_start, org_flags;
     uint32_t npc;
     int num_insns;
-    int max_insns;
 
     pc_start = tb->pc;
     dc->cpu = cpu;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
 
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do
diff --git a/target/mips/translate.c b/target/mips/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 static void fpu_dump_state(CPUMIPSState *env, FILE *f, int flags)
diff --git a/target/moxie/translate.c b/target/moxie/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/translate.c
+++ b/target/moxie/translate.c
@@ -XXX,XX +XXX,XX @@ static int decode_opc(MoxieCPU *cpu, DisasContext *ctx)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUMoxieState *env = cs->env_ptr;
     MoxieCPU *cpu = moxie_env_get_cpu(env);
     DisasContext ctx;
     target_ulong pc_start;
-    int num_insns, max_insns;
+    int num_insns;
 
     pc_start = tb->pc;
     ctx.pc = pc_start;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     ctx.singlestep_enabled = 0;
     ctx.bstate = BS_NONE;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
     gen_tb_start(tb);
     do {
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUNios2State *env = cs->env_ptr;
     DisasContext dc1, *dc = &dc1;
     int num_insns;
-    int max_insns;
 
     /* Initialize DC */
     dc->cpu_env = cpu_env;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
 
     /* Set up instruction counts */
     num_insns = 0;
-    if (cs->singlestep_enabled || singlestep) {
-        max_insns = 1;
-    } else {
+    if (max_insns > 1) {
         int page_insns = (TARGET_PAGE_SIZE - (tb->pc & TARGET_PAGE_MASK)) / 4;
-        max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-        if (max_insns == 0) {
-            max_insns = CF_COUNT_MASK;
-        }
         if (max_insns > page_insns) {
             max_insns = page_insns;
         }
-        if (max_insns > TCG_MAX_INSNS) {
-            max_insns = TCG_MAX_INSNS;
-        }
     }
 
     gen_tb_start(tb);
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void riscv_translate_init(void)
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb);
+    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb);
+    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb);
+    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/translate.c
+++ b/target/tilegx/translate.c
@@ -XXX,XX +XXX,XX @@ static void translate_one_bundle(DisasContext *dc, uint64_t bundle)
     }
 }
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUTLGState *env = cs->env_ptr;
     DisasContext ctx;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
     uint64_t pc_start = tb->pc;
     uint64_t page_start = pc_start & TARGET_PAGE_MASK;
     int num_insns = 0;
-    int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
 
     dc->pc = pc_start;
     dc->mmuidx = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
         qemu_log_lock();
         qemu_log("IN: %s\n", lookup_symbol(pc_start));
     }
-    if (!max_insns) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (cs->singlestep_enabled || singlestep) {
-        max_insns = 1;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
     gen_tb_start(tb);
 
     while (1) {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPUTriCoreState *env, DisasContext *ctx, int *is_branch)
     }
 }
 
-void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUTriCoreState *env = cs->env_ptr;
     DisasContext ctx;
     target_ulong pc_start;
-    int num_insns, max_insns;
-
-    num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (singlestep) {
-        max_insns = 1;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
+    int num_insns = 0;
 
     pc_start = tb->pc;
     ctx.pc = pc_start;
diff --git a/target/unicore32/translate.c b/target/unicore32/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/translate.c
+++ b/target/unicore32/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 {
     CPUUniCore32State *env = cs->env_ptr;
     DisasContext dc1, *dc = &dc1;
     target_ulong pc_start;
     uint32_t page_start;
     int num_insns;
-    int max_insns;
 
     /* generate intermediate code */
     num_temps = 0;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb)
     cpu_F1d = tcg_temp_new_i64();
     page_start = pc_start & TARGET_PAGE_MASK;
     num_insns = 0;
-    max_insns = tb_cflags(tb) & CF_COUNT_MASK;
-    if (max_insns == 0) {
-        max_insns = CF_COUNT_MASK;
-    }
-    if (max_insns > TCG_MAX_INSNS) {
-        max_insns = TCG_MAX_INSNS;
-    }
 
 #ifndef CONFIG_USER_ONLY
     if ((env->uncached_asr & ASR_M) == ASR_MODE_USER) {
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb);
+    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.17.1

If a TB generates too much code, try again with fewer insns.

Fixes: https://bugs.launchpad.net/bugs/1824853
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 38 ++++++++++++++++++++++++++++++++------
 tcg/tcg.c                 |  4 ++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
     tcg_ctx->tb_cflags = cflags;
+ tb_overflow:
 
 #ifdef CONFIG_PROFILER
     /* includes aborted translations because of exceptions */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     ti = profile_getclock();
 #endif
 
-    /* ??? Overflow could be handled better here.  In particular, we
-       don't need to re-do gen_intermediate_code, nor should we re-do
-       the tcg optimization currently hidden inside tcg_gen_code.  All
-       that should be required is to flush the TBs, allocate a new TB,
-       re-initialize it per above, and re-do the actual code generation.  */
     gen_code_size = tcg_gen_code(tcg_ctx, tb);
     if (unlikely(gen_code_size < 0)) {
-        goto buffer_overflow;
+        switch (gen_code_size) {
+        case -1:
+            /*
+             * Overflow of code_gen_buffer, or the current slice of it.
+             *
+             * TODO: We don't need to re-do gen_intermediate_code, nor
+             * should we re-do the tcg optimization currently hidden
+             * inside tcg_gen_code.  All that should be required is to
+             * flush the TBs, allocate a new TB, re-initialize it per
+             * above, and re-do the actual code generation.
+             */
+            goto buffer_overflow;
+
+        case -2:
+            /*
+             * The code generated for the TranslationBlock is too large.
+             * The maximum size allowed by the unwind info is 64k.
+             * There may be stricter constraints from relocations
+             * in the tcg backend.
+             *
+             * Try again with half as many insns as we attempted this time.
+             * If a single insn overflows, there's a bug somewhere...
+             */
+            max_insns = tb->icount;
+            assert(max_insns > 1);
+            max_insns /= 2;
+            goto tb_overflow;
+
+        default:
+            g_assert_not_reached();
+        }
     }
     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
     if (unlikely(search_size < 0)) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
             return -1;
         }
+        /* Test for TB overflow, as seen by gen_insn_end_off.  */
+        if (unlikely(tcg_current_code_size(s) > UINT16_MAX)) {
+            return -2;
+        }
     }
     tcg_debug_assert(num_insns >= 0);
     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
-- 
2.17.1

If the TB generates too much code, such that backend relocations
overflow, try again with a smaller TB.  In support of this, move
relocation processing from a random place within tcg_out_op, in
the handling of branch opcodes, to a new function at the end of
tcg_gen_code.

This is not a complete solution, as there are additional relocs
generated for out-of-line ldst handling and constant pools.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.h | 15 +++++++-------
 tcg/tcg.c | 61 ++++++++++++++++++++++++++-----------------------------
 2 files changed, 36 insertions(+), 40 deletions(-)

diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t tcg_insn_unit;
     do { if (!(X)) { __builtin_unreachable(); } } while (0)
 #endif
 
-typedef struct TCGRelocation {
-    struct TCGRelocation *next;
-    int type;
+typedef struct TCGRelocation TCGRelocation;
+struct TCGRelocation {
+    QSIMPLEQ_ENTRY(TCGRelocation) next;
     tcg_insn_unit *ptr;
     intptr_t addend;
-} TCGRelocation; 
+    int type;
+};
 
 typedef struct TCGLabel TCGLabel;
 struct TCGLabel {
@@ -XXX,XX +XXX,XX @@ struct TCGLabel {
     union {
         uintptr_t value;
         tcg_insn_unit *value_ptr;
-        TCGRelocation *first_reloc;
     } u;
-#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_HEAD(, TCGRelocation) relocs;
     QSIMPLEQ_ENTRY(TCGLabel) next;
-#endif
 };
 
 typedef struct TCGPool {
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
 #endif
 
 #ifdef CONFIG_DEBUG_TCG
-    QSIMPLEQ_HEAD(, TCGLabel) labels;
     int temps_in_use;
     int goto_tb_issue_mask;
 #endif
@@ -XXX,XX +XXX,XX @@ struct TCGContext {
     TCGTemp temps[TCG_MAX_TEMPS]; /* globals first, temps after */
 
     QTAILQ_HEAD(, TCGOp) ops, free_ops;
+    QSIMPLEQ_HEAD(, TCGLabel) labels;
 
     /* Tells which temporary holds a given register.
        It does not take into account fixed registers */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static __attribute__((unused)) inline void tcg_patch64(tcg_insn_unit *p,
 static void tcg_out_reloc(TCGContext *s, tcg_insn_unit *code_ptr, int type,
                           TCGLabel *l, intptr_t addend)
 {
-    TCGRelocation *r;
+    TCGRelocation *r = tcg_malloc(sizeof(TCGRelocation));
 
-    if (l->has_value) {
-        /* FIXME: This may break relocations on RISC targets that
-           modify instruction fields in place.  The caller may not have 
-           written the initial value.  */
-        bool ok = patch_reloc(code_ptr, type, l->u.value, addend);
-        tcg_debug_assert(ok);
-    } else {
-        /* add a new relocation entry */
-        r = tcg_malloc(sizeof(TCGRelocation));
-        r->type = type;
-        r->ptr = code_ptr;
-        r->addend = addend;
-        r->next = l->u.first_reloc;
-        l->u.first_reloc = r;
-    }
+    r->type = type;
+    r->ptr = code_ptr;
+    r->addend = addend;
+    QSIMPLEQ_INSERT_TAIL(&l->relocs, r, next);
 }
 
 static void tcg_out_label(TCGContext *s, TCGLabel *l, tcg_insn_unit *ptr)
 {
-    intptr_t value = (intptr_t)ptr;
-    TCGRelocation *r;
-
     tcg_debug_assert(!l->has_value);
-
-    for (r = l->u.first_reloc; r != NULL; r = r->next) {
-        bool ok = patch_reloc(r->ptr, r->type, value, r->addend);
-        tcg_debug_assert(ok);
-    }
-
     l->has_value = 1;
     l->u.value_ptr = ptr;
 }
@@ -XXX,XX +XXX,XX @@ TCGLabel *gen_new_label(void)
     TCGContext *s = tcg_ctx;
     TCGLabel *l = tcg_malloc(sizeof(TCGLabel));
 
-    *l = (TCGLabel){
-        .id = s->nb_labels++
-    };
-#ifdef CONFIG_DEBUG_TCG
+    memset(l, 0, sizeof(TCGLabel));
+    l->id = s->nb_labels++;
+    QSIMPLEQ_INIT(&l->relocs);
+
     QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
-#endif
 
     return l;
 }
 
+static bool tcg_resolve_relocs(TCGContext *s)
+{
+    TCGLabel *l;
+
+    QSIMPLEQ_FOREACH(l, &s->labels, next) {
+        TCGRelocation *r;
+        uintptr_t value = l->u.value;
+
+        QSIMPLEQ_FOREACH(r, &l->relocs, next) {
+            if (!patch_reloc(r->ptr, r->type, value, r->addend)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
 static void set_jmp_reset_offset(TCGContext *s, int which)
 {
     size_t off = tcg_current_code_size(s);
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
 
     QTAILQ_INIT(&s->ops);
     QTAILQ_INIT(&s->free_ops);
-#ifdef CONFIG_DEBUG_TCG
     QSIMPLEQ_INIT(&s->labels);
-#endif
 }
 
 static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
         return -1;
     }
 #endif
+    if (!tcg_resolve_relocs(s)) {
+        return -2;
+    }
 
     /* flush instruction cache */
     flush_icache_range((uintptr_t)s->code_buf, (uintptr_t)s->code_ptr);
-- 
2.17.1

This is part b of relocation overflow handling.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-pool.inc.c | 12 +++++++-----
 tcg/tcg.c          |  9 +++++----
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/tcg/tcg-pool.inc.c b/tcg/tcg-pool.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-pool.inc.c
+++ b/tcg/tcg-pool.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void new_pool_l8(TCGContext *s, int rtype, tcg_insn_unit *label,
 /* To be provided by cpu/tcg-target.inc.c.  */
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count);
 
-static bool tcg_out_pool_finalize(TCGContext *s)
+static int tcg_out_pool_finalize(TCGContext *s)
 {
     TCGLabelPoolData *p = s->pool_labels;
     TCGLabelPoolData *l = NULL;
     void *a;
 
     if (p == NULL) {
-        return true;
+        return 0;
     }
 
     /* ??? Round up to qemu_icache_linesize, but then do not round
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_pool_finalize(TCGContext *s)
         size_t size = sizeof(tcg_target_ulong) * p->nlong;
         if (!l || l->nlong != p->nlong || memcmp(l->data, p->data, size)) {
             if (unlikely(a > s->code_gen_highwater)) {
-                return false;
+                return -1;
             }
             memcpy(a, p->data, size);
             a += size;
             l = p;
         }
-        patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend);
+        if (!patch_reloc(p->label, p->rtype, (intptr_t)a - size, p->addend)) {
+            return -2;
+        }
     }
 
     s->code_ptr = a;
-    return true;
+    return 0;
 }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
 #ifdef TCG_TARGET_NEED_POOL_LABELS
     /* Allow the prologue to put e.g. guest_base into a pool entry.  */
     {
-        bool ok = tcg_out_pool_finalize(s);
-        tcg_debug_assert(ok);
+        int result = tcg_out_pool_finalize(s);
+        tcg_debug_assert(result == 0);
     }
 #endif
 
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     }
 #endif
 #ifdef TCG_TARGET_NEED_POOL_LABELS
-    if (!tcg_out_pool_finalize(s)) {
-        return -1;
+    i = tcg_out_pool_finalize(s);
+    if (i < 0) {
+        return i;
     }
 #endif
     if (!tcg_resolve_relocs(s)) {
-- 
2.17.1

This is part c of relocation overflow handling.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.inc.c | 16 ++++++++++------
 tcg/arm/tcg-target.inc.c     | 16 ++++++++++------
 tcg/i386/tcg-target.inc.c    |  6 ++++--
 tcg/mips/tcg-target.inc.c    |  6 ++++--
 tcg/ppc/tcg-target.inc.c     | 14 ++++++++++----
 tcg/riscv/tcg-target.inc.c   | 16 ++++++++++++----
 tcg/s390/tcg-target.inc.c    | 20 ++++++++++++--------
 tcg/tcg-ldst.inc.c           | 18 +++++++++---------
 tcg/tcg.c                    |  7 ++++---
 9 files changed, 75 insertions(+), 44 deletions(-)

diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.inc.c
+++ b/tcg/aarch64/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
     tcg_out_insn(s, 3406, ADR, rd, offset);
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp size = opc & MO_SIZE;
 
-    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
     tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_goto(s, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp size = opc & MO_SIZE;
 
-    bool ok = reloc_pc19(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
     tcg_out_mov(s, TARGET_LONG_BITS == 64, TCG_REG_X1, lb->addrlo_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_adr(s, TCG_REG_X4, lb->raddr);
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
     tcg_out_goto(s, lb->raddr);
+    return true;
 }
 
 static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     void *func;
 
-    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     argreg = tcg_out_arg_reg32(s, TCG_REG_R0, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_goto(s, COND_AL, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = reloc_pc24(lb->label_ptr[0], s->code_ptr);
-    tcg_debug_assert(ok);
+    if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     argreg = TCG_REG_R0;
     argreg = tcg_out_arg_reg32(s, argreg, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 
     /* Tail-call to the helper, which will return to the fast path.  */
     tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    return true;
 }
 #endif /* SOFTMMU */
 
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
 /*
  * Generate code for the slow path for a load at the end of block
  */
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
     /* Jump to the code corresponding to next IR of qemu_st */
     tcg_out_jmp(s, l->raddr);
+    return true;
 }
 
 /*
  * Generate code for the slow path for a store at the end of block
  */
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     /* "Tail call" to the helper, with the return address back inline.  */
     tcg_out_push(s, retaddr);
     tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
+    return true;
 }
 #elif TCG_TARGET_REG_BITS == 32
 # define x86_guest_base_seg     0
diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.inc.c
+++ b/tcg/mips/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
     }
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     } else {
         tcg_out_opc_reg(s, OPC_OR, v0, TCG_REG_V0, TCG_REG_ZERO);
     }
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_call_int(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)], true);
     /* delay slot */
     tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
+    return true;
 }
 #endif
 
diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = lptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGReg hi, lo, arg = TCG_REG_R3;
 
-    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     }
 
     tcg_out_b(s, 0, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
     TCGMemOp s_bits = opc & MO_SIZE;
     TCGReg hi, lo, arg = TCG_REG_R3;
 
-    **lb->label_ptr |= reloc_pc14_val(*lb->label_ptr, s->code_ptr);
+    if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, arg++, TCG_AREG0);
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 
     tcg_out_b(s, 0, lb->raddr);
+    return true;
 }
 #endif /* SOFTMMU */
 
diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.inc.c
+++ b/tcg/riscv/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr[0];
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     }
 
     /* resolve label address */
-    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
+                     (intptr_t) s->code_ptr, 0)) {
+        return false;
+    }
 
     /* call load helper */
     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_mov(s, (opc & MO_SIZE) == MO_64, l->datalo_reg, a0);
 
     tcg_out_goto(s, l->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
     TCGMemOp opc = get_memop(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     }
 
     /* resolve label address */
-    patch_reloc(l->label_ptr[0], R_RISCV_BRANCH, (intptr_t) s->code_ptr, 0);
+    if (!patch_reloc(l->label_ptr[0], R_RISCV_BRANCH,
+                     (intptr_t) s->code_ptr, 0)) {
+        return false;
+    }
 
     /* call store helper */
     tcg_out_mov(s, TCG_TYPE_PTR, a0, TCG_AREG0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SSIZE)]);
 
     tcg_out_goto(s, l->raddr);
+    return true;
 }
 #endif /* CONFIG_SOFTMMU */
 
diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.inc.c
+++ b/tcg/s390/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
     label->label_ptr[0] = label_ptr;
 }
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                          (intptr_t)s->code_ptr, 2);
-    tcg_debug_assert(ok);
+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
+                     (intptr_t)s->code_ptr, 2)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_mov(s, TCG_TYPE_I64, data_reg, TCG_REG_R2);
 
     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
+    return true;
 }
 
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
     TCGMemOp opc = get_memop(oi);
 
-    bool ok = patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                          (intptr_t)s->code_ptr, 2);
-    tcg_debug_assert(ok);
+    if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
+                     (intptr_t)s->code_ptr, 2)) {
+        return false;
+    }
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
     if (TARGET_LONG_BITS == 64) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_call(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
 
     tgen_gotoi(s, S390_CC_ALWAYS, lb->raddr);
+    return true;
 }
 #else
 static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
diff --git a/tcg/tcg-ldst.inc.c b/tcg/tcg-ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-ldst.inc.c
+++ b/tcg/tcg-ldst.inc.c
@@ -XXX,XX +XXX,XX @@ typedef struct TCGLabelQemuLdst {
  * Generate TB finalization at the end of block
  */
 
-static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
-static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l);
 
-static bool tcg_out_ldst_finalize(TCGContext *s)
+static int tcg_out_ldst_finalize(TCGContext *s)
 {
     TCGLabelQemuLdst *lb;
 
     /* qemu_ld/st slow paths */
     QSIMPLEQ_FOREACH(lb, &s->ldst_labels, next) {
-        if (lb->is_ld) {
-            tcg_out_qemu_ld_slow_path(s, lb);
-        } else {
-            tcg_out_qemu_st_slow_path(s, lb);
+        if (lb->is_ld
+            ? !tcg_out_qemu_ld_slow_path(s, lb)
+            : !tcg_out_qemu_st_slow_path(s, lb)) {
+            return -2;
         }
 
         /* Test for (pending) buffer overflow.  The assumption is that any
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_ldst_finalize(TCGContext *s)
            the buffer completely.  Thus we can test for overflow after
            generating code without having to check during generation.  */
         if (unlikely((void *)s->code_ptr > s->code_gen_highwater)) {
-            return false;
+            return -1;
         }
     }
-    return true;
+    return 0;
 }
 
 /*
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *target);
 static int tcg_target_const_match(tcg_target_long val, TCGType type,
                                   const TCGArgConstraint *arg_ct);
 #ifdef TCG_TARGET_NEED_LDST_LABELS
-static bool tcg_out_ldst_finalize(TCGContext *s);
+static int tcg_out_ldst_finalize(TCGContext *s);
 #endif
 
 #define TCG_HIGHWATER 1024
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
     /* Generate TB finalization at the end of block */
 #ifdef TCG_TARGET_NEED_LDST_LABELS
-    if (!tcg_out_ldst_finalize(s)) {
-        return -1;
+    i = tcg_out_ldst_finalize(s);
+    if (i < 0) {
+        return i;
     }
 #endif
 #ifdef TCG_TARGET_NEED_POOL_LABELS
-- 
2.17.1

There is no point in coding for a 2GB offset when the max TB size
is already limited to 64k.  If we further restrict to 32k then we
can eliminate the extra ADDIS instruction.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.inc.c | 28 ++++++++++------------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                         intptr_t value, intptr_t addend)
 {
     tcg_insn_unit *target;
-    tcg_insn_unit old;
 
     value += addend;
     target = (tcg_insn_unit *)value;
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
     case R_PPC_REL24:
         return reloc_pc24(code_ptr, target);
     case R_PPC_ADDR16:
-        /* We are abusing this relocation type.  This points to a pair
-           of insns, addis + load.  If the displacement is small, we
-           can nop out the addis.  */
-        if (value == (int16_t)value) {
-            code_ptr[0] = NOP;
-            old = deposit32(code_ptr[1], 0, 16, value);
-            code_ptr[1] = deposit32(old, 16, 5, TCG_REG_TB);
-        } else {
-            int16_t lo = value;
-            int hi = value - lo;
-            if (hi + lo != value) {
-                return false;
-            }
-            code_ptr[0] = deposit32(code_ptr[0], 0, 16, hi >> 16);
-            code_ptr[1] = deposit32(code_ptr[1], 0, 16, lo);
+        /*
+         * We are (slightly) abusing this relocation type.  In particular,
+         * assert that the low 2 bits are zero, and do not modify them.
+         * That way we can use this with LD et al that have opcode bits
+         * in the low 2 bits of the insn.
+         */
+        if ((value & 3) || value != (int16_t)value) {
+            return false;
         }
+        *code_ptr = (*code_ptr & ~0xfffc) | (value & 0xfffc);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     if (!in_prologue && USE_REG_TB) {
         new_pool_label(s, arg, R_PPC_ADDR16, s->code_ptr,
                        -(intptr_t)s->code_gen_ptr);
-        tcg_out32(s, ADDIS | TAI(ret, TCG_REG_TB, 0));
-        tcg_out32(s, LD | TAI(ret, ret, 0));
+        tcg_out32(s, LD | TAI(ret, TCG_REG_TB, 0));
         return;
     }
 
-- 
2.17.1

This will not necessarily restrict the size of the TB, since for v7
the majority of constant pool usage is for calls from the out-of-line
ldst code, which is already at the end of the TB.  But this does
allow us to save one insn per reference on the off-chance.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.inc.c | 57 +++++++++++++++-------------------------
 1 file changed, 21 insertions(+), 36 deletions(-)

diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline bool reloc_pc24(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
     return false;
 }
 
+static inline bool reloc_pc13(tcg_insn_unit *code_ptr, tcg_insn_unit *target)
+{
+    ptrdiff_t offset = tcg_ptr_byte_diff(target, code_ptr) - 8;
+
+    if (offset >= -0xfff && offset <= 0xfff) {
+        tcg_insn_unit insn = *code_ptr;
+        bool u = (offset >= 0);
+        if (!u) {
+            offset = -offset;
+        }
+        insn = deposit32(insn, 23, 1, u);
+        insn = deposit32(insn, 0, 12, offset);
+        *code_ptr = insn;
+        return true;
+    }
+    return false;
+}
+
 static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
                         intptr_t value, intptr_t addend)
 {
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
     if (type == R_ARM_PC24) {
         return reloc_pc24(code_ptr, (tcg_insn_unit *)value);
     } else if (type == R_ARM_PC13) {
-        intptr_t diff = value - (uintptr_t)(code_ptr + 2);
-        tcg_insn_unit insn = *code_ptr;
-        bool u;
-
-        if (diff >= -0xfff && diff <= 0xfff) {
-            u = (diff >= 0);
-            if (!u) {
-                diff = -diff;
-            }
-        } else {
-            int rd = extract32(insn, 12, 4);
-            int rt = rd == TCG_REG_PC ? TCG_REG_TMP : rd;
-
-            if (diff < 0x1000 || diff >= 0x100000) {
-                return false;
-            }
-
-            /* add rt, pc, #high */
-            *code_ptr++ = ((insn & 0xf0000000) | (1 << 25) | ARITH_ADD
-                           | (TCG_REG_PC << 16) | (rt << 12)
-                           | (20 << 7) | (diff >> 12));
-            /* ldr rd, [rt, #low] */
-            insn = deposit32(insn, 12, 4, rt);
-            diff &= 0xfff;
-            u = 1;
-        }
-        insn = deposit32(insn, 23, 1, u);
-        insn = deposit32(insn, 0, 12, diff);
-        *code_ptr = insn;
+        return reloc_pc13(code_ptr, (tcg_insn_unit *)value);
     } else {
         g_assert_not_reached();
     }
-    return true;
 }
 
 #define TCG_CT_CONST_ARM  0x100
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld8s_r(TCGContext *s, int cond, TCGReg rt,
 
 static void tcg_out_movi_pool(TCGContext *s, int cond, int rd, uint32_t arg)
 {
-    /* The 12-bit range on the ldr insn is sometimes a bit too small.
-       In order to get around that we require two insns, one of which
-       will usually be a nop, but may be replaced in patch_reloc.  */
     new_pool_label(s, arg, R_ARM_PC13, s->code_ptr, 0);
     tcg_out_ld32_12(s, cond, rd, TCG_REG_PC, 0);
-    tcg_out_nop(s);
 }
 
 static void tcg_out_movi32(TCGContext *s, int cond, int rd, uint32_t arg)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *addr)
         tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
         tcg_out_blx(s, COND_AL, TCG_REG_TMP);
     } else {
-        /* ??? Know that movi_pool emits exactly 2 insns.  */
-        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 4);
+        /* ??? Know that movi_pool emits exactly 1 insn.  */
+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, TCG_REG_R14, TCG_REG_PC, 0);
         tcg_out_movi_pool(s, COND_AL, TCG_REG_PC, addri);
     }
 }
-- 
2.17.1

From: Shahab Vahedi <shahab.vahedi@gmail.com>

This change adapts io_readx() to its input access_type. Currently
io_readx() treats any memory access as a read, although it has an
input argument "MMUAccessType access_type". This results in:

1) Calling the tlb_fill() only with MMU_DATA_LOAD
2) Considering only entry->addr_read as the tlb_addr

Buglink: https://bugs.launchpad.net/qemu/+bug/1825359
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Shahab Vahedi <shahab.vahedi@gmail.com>
Message-Id: <20190420072236.12347-1-shahab.vahedi@gmail.com>
[rth: Remove assert; fix expression formatting.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         CPUTLBEntry *entry;
         target_ulong tlb_addr;
 
-        tlb_fill(cpu, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
+        tlb_fill(cpu, addr, size, access_type, mmu_idx, retaddr);
 
         entry = tlb_entry(env, mmu_idx, addr);
-        tlb_addr = entry->addr_read;
+        tlb_addr = (access_type == MMU_DATA_LOAD ?
+                    entry->addr_read : entry->addr_code);
         if (!(tlb_addr & ~(TARGET_PAGE_MASK | TLB_RECHECK))) {
             /* RAM access */
             uintptr_t haddr = addr + entry->addend;
-- 
2.17.1

Pretty small still, but there are two patches that ought
to get backported to stable, so no point in delaying.

The following changes since commit a5ba0a7e4e150d1350a041f0d0ef9ca6c8d7c307:

Merge tag 'pull-aspeed-20241211' of https://github.com/legoater/qemu into staging (2024-12-11 15:16:47 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20241212

for you to fetch changes up to 7ac87b14a92234b6a89b701b4043ad6cf8bdcccf:

target/sparc: Use memcpy() and remove memcpy32() (2024-12-12 14:28:38 -0600)

----------------------------------------------------------------
tcg: Reset free_temps before tcg_optimize
tcg/riscv: Fix StoreStore barrier generation
include/exec: Introduce fpst alias in helper-head.h.inc
target/sparc: Use memcpy() and remove memcpy32()

----------------------------------------------------------------
Philippe Mathieu-Daudé (1):
      target/sparc: Use memcpy() and remove memcpy32()

Richard Henderson (2):
      tcg: Reset free_temps before tcg_optimize
      include/exec: Introduce fpst alias in helper-head.h.inc

Roman Artemev (1):
      tcg/riscv: Fix StoreStore barrier generation

When allocating new temps during tcg_optmize, do not re-use
any EBB temps that were used within the TB.  We do not have
any idea what span of the TB in which the temp was live.

Introduce tcg_temp_ebb_reset_freed and use before tcg_optimize,
as well as replacing the equivalent in plugin_gen_inject and
tcg_func_start.

Cc: qemu-stable@nongnu.org
Fixes: fb04ab7ddd8 ("tcg/optimize: Lower TCG_COND_TST{EQ,NE} if unsupported")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2711
Reported-by: wannacu <wannacu2049@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/tcg/tcg-temp-internal.h | 6 ++++++
 accel/tcg/plugin-gen.c          | 2 +-
 tcg/tcg.c                       | 5 ++++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/include/tcg/tcg-temp-internal.h b/include/tcg/tcg-temp-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-temp-internal.h
+++ b/include/tcg/tcg-temp-internal.h
@@ -XXX,XX +XXX,XX @@ TCGv_i64 tcg_temp_ebb_new_i64(void);
 TCGv_ptr tcg_temp_ebb_new_ptr(void);
 TCGv_i128 tcg_temp_ebb_new_i128(void);
 
+/* Forget all freed EBB temps, so that new allocations produce new temps. */
+static inline void tcg_temp_ebb_reset_freed(TCGContext *s)
+{
+    memset(s->free_temps, 0, sizeof(s->free_temps));
+}
+
 #endif /* TCG_TEMP_FREE_H */
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
      * that might be live within the existing opcode stream.
      * The simplest solution is to release them all and create new.
      */
-    memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
+    tcg_temp_ebb_reset_freed(tcg_ctx);
 
     QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
         switch (op->opc) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
     s->nb_temps = s->nb_globals;
 
     /* No temps have been previously allocated for size or locality.  */
-    memset(s->free_temps, 0, sizeof(s->free_temps));
+    tcg_temp_ebb_reset_freed(s);
 
     /* No constant temps have been previously allocated. */
     for (int i = 0; i < TCG_TYPE_COUNT; ++i) {
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     }
 #endif
 
+    /* Do not reuse any EBB that may be allocated within the TB. */
+    tcg_temp_ebb_reset_freed(s);
+
     tcg_optimize(s);
 
     reachable_code_pass(s);
-- 
2.43.0

From: Roman Artemev <roman.artemev@syntacore.com>

On RISC-V to StoreStore barrier corresponds
`fence w, w` not `fence r, r`

Cc: qemu-stable@nongnu.org
Fixes: efbea94c76b ("tcg/riscv: Add slowpath load and store instructions")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Denis Tomashev <denis.tomashev@syntacore.com>
Signed-off-by: Roman Artemev <roman.artemev@syntacore.com>
Message-ID: <e2f2131e294a49e79959d4fa9ec02cf4@syntacore.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
         insn |= 0x02100000;
     }
     if (a0 & TCG_MO_ST_ST) {
-        insn |= 0x02200000;
+        insn |= 0x01100000;
     }
     tcg_out32(s, insn);
 }
-- 
2.43.0

This allows targets to declare that the helper requires a
float_status pointer and instead of a generic void pointer.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-head.h.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h.inc
+++ b/include/exec/helper-head.h.inc
@@ -XXX,XX +XXX,XX @@
 #define dh_alias_ptr ptr
 #define dh_alias_cptr ptr
 #define dh_alias_env ptr
+#define dh_alias_fpst ptr
 #define dh_alias_void void
 #define dh_alias_noreturn noreturn
 #define dh_alias(t) glue(dh_alias_, t)
@@ -XXX,XX +XXX,XX @@
 #define dh_ctype_ptr void *
 #define dh_ctype_cptr const void *
 #define dh_ctype_env CPUArchState *
+#define dh_ctype_fpst float_status *
 #define dh_ctype_void void
 #define dh_ctype_noreturn G_NORETURN void
 #define dh_ctype(t) dh_ctype_##t
@@ -XXX,XX +XXX,XX @@
 #define dh_typecode_f64 dh_typecode_i64
 #define dh_typecode_cptr dh_typecode_ptr
 #define dh_typecode_env dh_typecode_ptr
+#define dh_typecode_fpst dh_typecode_ptr
 #define dh_typecode(t) dh_typecode_##t
 
 #define dh_callflag_i32  0
-- 
2.43.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Rather than manually copying each register, use
the libc memcpy(), which is well optimized nowadays.

Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241205205418.67613-1-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/win_helper.c | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/target/sparc/win_helper.c b/target/sparc/win_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/win_helper.c
+++ b/target/sparc/win_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "trace.h"
 
-static inline void memcpy32(target_ulong *dst, const target_ulong *src)
-{
-    dst[0] = src[0];
-    dst[1] = src[1];
-    dst[2] = src[2];
-    dst[3] = src[3];
-    dst[4] = src[4];
-    dst[5] = src[5];
-    dst[6] = src[6];
-    dst[7] = src[7];
-}
-
 void cpu_set_cwp(CPUSPARCState *env, int new_cwp)
 {
     /* put the modified wrap registers at their proper location */
     if (env->cwp == env->nwindows - 1) {
-        memcpy32(env->regbase, env->regbase + env->nwindows * 16);
+        memcpy(env->regbase, env->regbase + env->nwindows * 16,
+               sizeof(env->gregs));
     }
     env->cwp = new_cwp;
 
     /* put the wrap registers at their temporary location */
     if (new_cwp == env->nwindows - 1) {
-        memcpy32(env->regbase + env->nwindows * 16, env->regbase);
+        memcpy(env->regbase + env->nwindows * 16, env->regbase,
+               sizeof(env->gregs));
     }
     env->regwptr = env->regbase + (new_cwp * 16);
 }
@@ -XXX,XX +XXX,XX @@ void cpu_gl_switch_gregs(CPUSPARCState *env, uint32_t new_gl)
     dst = get_gl_gregset(env, env->gl);
 
     if (src != dst) {
-        memcpy32(dst, env->gregs);
-        memcpy32(env->gregs, src);
+        memcpy(dst, env->gregs, sizeof(env->gregs));
+        memcpy(env->gregs, src, sizeof(env->gregs));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void cpu_change_pstate(CPUSPARCState *env, uint32_t new_pstate)
         /* Switch global register bank */
         src = get_gregset(env, new_pstate_regs);
         dst = get_gregset(env, pstate_regs);
-        memcpy32(dst, env->gregs);
-        memcpy32(env->gregs, src);
+        memcpy(dst, env->gregs, sizeof(env->gregs));
+        memcpy(env->gregs, src, sizeof(env->gregs));
     } else {
         trace_win_helper_no_switch_pstate(new_pstate_regs);
     }
-- 
2.43.0