Series comparison

-[Qemu-devel] [PATCH 00/36] tcg patch queue
+[PULL v2 0/8] tcg patch queue
-The following changes since commit fec105c2abda8567ec15230429c41429b5ee307c:
+The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:
-  Merge remote-tracking branch 'remotes/kraxel/tags/audio-20190828-pull-request' into staging (2019-09-03 14:03:15 +0100)
+  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20190903
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221
-for you to fetch changes up to c25c283df0f08582df29f1d5d7be1516b851532d:
+for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:
-  tcg: Factor out probe_write() logic into probe_access() (2019-09-03 08:34:18 -0700)
+  sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)
 ----------------------------------------------------------------
-Allow page table bit to swap endianness.
+tcg: Allow first half of insn in ram, and second half in mmio
-Reorganize watchpoints out of i/o path.
+linux-user/sparc: SIGILL for unknown trap vectors
-Return host address from probe_write / probe_access.
+linux-user/microblaze: SIGILL for privileged insns
 linux-user: Fix deadlock while exiting due to signal
 target/microblaze: Add gdbstub xml
 util: Adjust cacheflush for windows-arm64
 include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64
 ----------------------------------------------------------------
-David Hildenbrand (11):
+Ilya Leoshkevich (3):
-      exec: Factor out core logic of check_watchpoint()
+      linux-user: Always exit from exclusive state in fork_end()
-      tcg: Check for watchpoints in probe_write()
+      cpus: Make {start,end}_exclusive() recursive
-      s390x/tcg: Use guest_addr_valid() instead of h2g_valid() in probe_write_access()
+      linux-user/microblaze: Handle privileged exception
       s390x/tcg: Fix length calculation in probe_write_access()
       tcg: Factor out CONFIG_USER_ONLY probe_write() from s390x code
       tcg: Enforce single page access in probe_write()
       mips/tcg: Call probe_write() for CONFIG_USER_ONLY as well
       hppa/tcg: Call probe_write() also for CONFIG_USER_ONLY
       s390x/tcg: Pass a size to probe_write() in do_csst()
       tcg: Make probe_write() return a pointer to the host page
       tcg: Factor out probe_write() logic into probe_access()
-Richard Henderson (6):
+Pierrick Bouvier (2):
-      exec: Move user-only watchpoint stubs inline
+      util/cacheflush: fix cache on windows-arm64
-      cputlb: Fold TLB_RECHECK into TLB_INVALID_MASK
+      sysemu/os-win32: fix setjmp/longjmp on windows-arm64
       exec: Factor out cpu_watchpoint_address_matches
       cputlb: Fix size operand for tlb_fill on unaligned store
       cputlb: Remove double-alignment in store_helper
       cputlb: Handle watchpoints via TLB_WATCHPOINT
-Tony Nguyen (19):
+Richard Henderson (3):
-      tcg: TCGMemOp is now accelerator independent MemOp
+      accel/tcg: Allow the second page of an instruction to be MMIO
-      memory: Introduce size_memop
+      linux-user/sparc: Raise SIGILL for all unhandled software traps
-      target/mips: Access MemoryRegion with MemOp
+      target/microblaze: Add gdbstub xml
       hw/s390x: Access MemoryRegion with MemOp
       hw/intc/armv7m_nic: Access MemoryRegion with MemOp
       hw/virtio: Access MemoryRegion with MemOp
       hw/vfio: Access MemoryRegion with MemOp
       exec: Access MemoryRegion with MemOp
       cputlb: Access MemoryRegion with MemOp
       memory: Access MemoryRegion with MemOp
       hw/s390x: Hard code size with MO_{8|16|32|64}
       target/mips: Hard code size with MO_{8|16|32|64}
       exec: Hard code size with MO_{8|16|32|64}
       memory: Access MemoryRegion with endianness
       cputlb: Replace size and endian operands for MemOp
       memory: Single byte swap along the I/O path
       cputlb: Byte swap memory transaction attribute
       target/sparc: Add TLB entry with attributes
       target/sparc: sun4u Invert Endian TTE bit
- include/exec/cpu-all.h                  |   8 +-
+ include/hw/core/cpu.h                       |  4 +-
- include/exec/exec-all.h                 |  10 +-
+ include/sysemu/os-win32.h                   | 28 ++++++++++--
- include/exec/memattrs.h                 |   2 +
+ target/microblaze/cpu.h                     |  2 +
- include/exec/memop.h                    | 134 +++++++++++
+ accel/tcg/translator.c                      | 12 +++++-
- include/exec/memory.h                   |  12 +-
+ cpus-common.c                               | 12 +++++-
- include/hw/core/cpu.h                   |  37 +++
+ linux-user/main.c                           | 10 +++--
- target/arm/translate-a64.h              |   2 +-
+ linux-user/microblaze/cpu_loop.c            | 10 ++++-
- target/arm/translate.h                  |   2 +-
+ linux-user/sparc/cpu_loop.c                 |  8 ++++
- target/sparc/cpu.h                      |   2 +
+ linux-user/syscall.c                        |  1 +
- tcg/tcg-op.h                            |  80 +++---
+ target/microblaze/cpu.c                     |  7 ++-
- tcg/tcg.h                               | 101 +-------
+ target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
- trace/mem-internal.h                    |   4 +-
+ util/cacheflush.c                           | 14 ++++--
- trace/mem.h                             |   4 +-
+ configs/targets/microblaze-linux-user.mak   |  1 +
- accel/tcg/cputlb.c                      | 414 ++++++++++++++++++--------------
+ configs/targets/microblaze-softmmu.mak      |  1 +
- accel/tcg/user-exec.c                   |  32 +++
+ configs/targets/microblazeel-linux-user.mak |  1 +
- exec.c                                  | 177 +++-----------
+ configs/targets/microblazeel-softmmu.mak    |  1 +
- hw/intc/armv7m_nvic.c                   |  13 +-
+ gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
- hw/s390x/s390-pci-inst.c                |  11 +-
+ gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
- hw/vfio/pci-quirks.c                    |   7 +-
+ meson.build                                 | 21 +++++++++
- hw/virtio/virtio-pci.c                  |  15 +-
+files changed, 229 insertions(+), 34 deletions(-)
- memory.c                                |  58 +++--
+ create mode 100644 gdb-xml/microblaze-core.xml
- memory_ldst.inc.c                       |  81 ++-----
+ create mode 100644 gdb-xml/microblaze-stack-protect.xml
  target/alpha/translate.c                |   2 +-
  target/arm/translate-a64.c              |  48 ++--
  target/arm/translate-sve.c              |   2 +-
  target/arm/translate.c                  |  32 +--
  target/hppa/op_helper.c                 |   2 -
  target/hppa/translate.c                 |  14 +-
  target/i386/translate.c                 | 132 +++++-----
  target/m68k/translate.c                 |   2 +-
  target/microblaze/translate.c           |   4 +-
  target/mips/op_helper.c                 |  13 +-
  target/mips/translate.c                 |   8 +-
  target/openrisc/translate.c             |   4 +-
  target/ppc/translate.c                  |  12 +-
  target/riscv/insn_trans/trans_rva.inc.c |   8 +-
  target/riscv/insn_trans/trans_rvi.inc.c |   4 +-
  target/s390x/mem_helper.c               |  13 +-
  target/s390x/translate.c                |   6 +-
  target/s390x/translate_vx.inc.c         |  10 +-
  target/sparc/mmu_helper.c               |  40 +--
  target/sparc/translate.c                |  14 +-
  target/tilegx/translate.c               |  10 +-
  target/tricore/translate.c              |   8 +-
  tcg/aarch64/tcg-target.inc.c            |  26 +-
  tcg/arm/tcg-target.inc.c                |  26 +-
  tcg/i386/tcg-target.inc.c               |  24 +-
  tcg/mips/tcg-target.inc.c               |  16 +-
  tcg/optimize.c                          |   2 +-
  tcg/ppc/tcg-target.inc.c                |  12 +-
  tcg/riscv/tcg-target.inc.c              |  20 +-
  tcg/s390/tcg-target.inc.c               |  14 +-
  tcg/sparc/tcg-target.inc.c              |   6 +-
  tcg/tcg-op.c                            |  38 +--
  tcg/tcg.c                               |   2 +-
  MAINTAINERS                             |   1 +
  tcg/README                              |   2 +-
 files changed, 918 insertions(+), 865 deletions(-)
  create mode 100644 include/exec/memop.h

-[Qemu-devel] [PATCH 01/36] tcg: TCGMemOp is now accelerator independent MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Preparation for collapsing the two byte swaps, adjust_endianness and
-handle_bswap, along the I/O path.
-Target dependant attributes are conditionalized upon NEED_CPU_H.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Acked-by: David Gibson <david@gibson.dropbear.id.au>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <81d9cd7d7f5aaadfa772d6c48ecee834e9cf7882.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/memop.h                    | 110 ++++++++++++++++++++
- target/arm/translate-a64.h              |   2 +-
- target/arm/translate.h                  |   2 +-
- tcg/tcg-op.h                            |  80 +++++++-------
- tcg/tcg.h                               | 101 ++----------------
- trace/mem-internal.h                    |   4 +-
- trace/mem.h                             |   4 +-
- accel/tcg/cputlb.c                      |   2 +-
- target/alpha/translate.c                |   2 +-
- target/arm/translate-a64.c              |  48 ++++-----
- target/arm/translate-sve.c              |   2 +-
- target/arm/translate.c                  |  32 +++---
- target/hppa/translate.c                 |  14 +--
- target/i386/translate.c                 | 132 ++++++++++++------------
- target/m68k/translate.c                 |   2 +-
- target/microblaze/translate.c           |   4 +-
- target/mips/translate.c                 |   8 +-
- target/openrisc/translate.c             |   4 +-
- target/ppc/translate.c                  |  12 +--
- target/riscv/insn_trans/trans_rva.inc.c |   8 +-
- target/riscv/insn_trans/trans_rvi.inc.c |   4 +-
- target/s390x/translate.c                |   6 +-
- target/s390x/translate_vx.inc.c         |  10 +-
- target/sparc/translate.c                |  14 +--
- target/tilegx/translate.c               |  10 +-
- target/tricore/translate.c              |   8 +-
- tcg/aarch64/tcg-target.inc.c            |  26 ++---
- tcg/arm/tcg-target.inc.c                |  26 ++---
- tcg/i386/tcg-target.inc.c               |  24 ++---
- tcg/mips/tcg-target.inc.c               |  16 +--
- tcg/optimize.c                          |   2 +-
- tcg/ppc/tcg-target.inc.c                |  12 +--
- tcg/riscv/tcg-target.inc.c              |  20 ++--
- tcg/s390/tcg-target.inc.c               |  14 +--
- tcg/sparc/tcg-target.inc.c              |   6 +-
- tcg/tcg-op.c                            |  38 +++----
- tcg/tcg.c                               |   2 +-
- MAINTAINERS                             |   1 +
- tcg/README                              |   2 +-
-files changed, 418 insertions(+), 396 deletions(-)
- create mode 100644 include/exec/memop.h
-diff --git a/include/exec/memop.h b/include/exec/memop.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/exec/memop.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Constants for memory operations
-+ *
-+ * Authors:
-+ *  Richard Henderson <rth@twiddle.net>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ */
-+
-+#ifndef MEMOP_H
-+#define MEMOP_H
-+
-+typedef enum MemOp {
-+    MO_8     = 0,
-+    MO_16    = 1,
-+    MO_32    = 2,
-+    MO_64    = 3,
-+    MO_SIZE  = 3,   /* Mask for the above.  */
-+
-+    MO_SIGN  = 4,   /* Sign-extended, otherwise zero-extended.  */
-+
-+    MO_BSWAP = 8,   /* Host reverse endian.  */
-+#ifdef HOST_WORDS_BIGENDIAN
-+    MO_LE    = MO_BSWAP,
-+    MO_BE    = 0,
-+#else
-+    MO_LE    = 0,
-+    MO_BE    = MO_BSWAP,
-+#endif
-+#ifdef NEED_CPU_H
-+#ifdef TARGET_WORDS_BIGENDIAN
-+    MO_TE    = MO_BE,
-+#else
-+    MO_TE    = MO_LE,
-+#endif
-+#endif
-+
-+    /*
-+     * MO_UNALN accesses are never checked for alignment.
-+     * MO_ALIGN accesses will result in a call to the CPU's
-+     * do_unaligned_access hook if the guest address is not aligned.
-+     * The default depends on whether the target CPU defines
-+     * TARGET_ALIGNED_ONLY.
-+     *
-+     * Some architectures (e.g. ARMv8) need the address which is aligned
-+     * to a size more than the size of the memory access.
-+     * Some architectures (e.g. SPARCv9) need an address which is aligned,
-+     * but less strictly than the natural alignment.
-+     *
-+     * MO_ALIGN supposes the alignment size is the size of a memory access.
-+     *
-+     * There are three options:
-+     * - unaligned access permitted (MO_UNALN).
-+     * - an alignment to the size of an access (MO_ALIGN);
-+     * - an alignment to a specified size, which may be more or less than
-+     *   the access size (MO_ALIGN_x where 'x' is a size in bytes);
-+     */
-+    MO_ASHIFT = 4,
-+    MO_AMASK = 7 << MO_ASHIFT,
-+#ifdef NEED_CPU_H
-+#ifdef TARGET_ALIGNED_ONLY
-+    MO_ALIGN = 0,
-+    MO_UNALN = MO_AMASK,
-+#else
-+    MO_ALIGN = MO_AMASK,
-+    MO_UNALN = 0,
-+#endif
-+#endif
-+    MO_ALIGN_2  = 1 << MO_ASHIFT,
-+    MO_ALIGN_4  = 2 << MO_ASHIFT,
-+    MO_ALIGN_8  = 3 << MO_ASHIFT,
-+    MO_ALIGN_16 = 4 << MO_ASHIFT,
-+    MO_ALIGN_32 = 5 << MO_ASHIFT,
-+    MO_ALIGN_64 = 6 << MO_ASHIFT,
-+
-+    /* Combinations of the above, for ease of use.  */
-+    MO_UB    = MO_8,
-+    MO_UW    = MO_16,
-+    MO_UL    = MO_32,
-+    MO_SB    = MO_SIGN | MO_8,
-+    MO_SW    = MO_SIGN | MO_16,
-+    MO_SL    = MO_SIGN | MO_32,
-+    MO_Q     = MO_64,
-+
-+    MO_LEUW  = MO_LE | MO_UW,
-+    MO_LEUL  = MO_LE | MO_UL,
-+    MO_LESW  = MO_LE | MO_SW,
-+    MO_LESL  = MO_LE | MO_SL,
-+    MO_LEQ   = MO_LE | MO_Q,
-+
-+    MO_BEUW  = MO_BE | MO_UW,
-+    MO_BEUL  = MO_BE | MO_UL,
-+    MO_BESW  = MO_BE | MO_SW,
-+    MO_BESL  = MO_BE | MO_SL,
-+    MO_BEQ   = MO_BE | MO_Q,
-+
-+#ifdef NEED_CPU_H
-+    MO_TEUW  = MO_TE | MO_UW,
-+    MO_TEUL  = MO_TE | MO_UL,
-+    MO_TESW  = MO_TE | MO_SW,
-+    MO_TESL  = MO_TE | MO_SL,
-+    MO_TEQ   = MO_TE | MO_Q,
-+#endif
-+
-+    MO_SSIZE = MO_SIZE | MO_SIGN,
-+} MemOp;
-+
-+#endif
-diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.h
-+++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ static inline void assert_fp_access_checked(DisasContext *s)
-  * the FP/vector register Qn.
-  */
- static inline int vec_reg_offset(DisasContext *s, int regno,
--                                 int element, TCGMemOp size)
-+                                 int element, MemOp size)
- {
-     int element_size = 1 << size;
-     int offs = element * element_size;
-diff --git a/target/arm/translate.h b/target/arm/translate.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
-+++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     int condexec_cond;
-     int thumb;
-     int sctlr_b;
--    TCGMemOp be_data;
-+    MemOp be_data;
- #if !defined(CONFIG_USER_ONLY)
-     int user;
- #endif
-diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.h
-+++ b/tcg/tcg-op.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_lookup_and_goto_ptr(void);
- #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i64
- #endif
--void tcg_gen_qemu_ld_i32(TCGv_i32, TCGv, TCGArg, TCGMemOp);
--void tcg_gen_qemu_st_i32(TCGv_i32, TCGv, TCGArg, TCGMemOp);
--void tcg_gen_qemu_ld_i64(TCGv_i64, TCGv, TCGArg, TCGMemOp);
--void tcg_gen_qemu_st_i64(TCGv_i64, TCGv, TCGArg, TCGMemOp);
-+void tcg_gen_qemu_ld_i32(TCGv_i32, TCGv, TCGArg, MemOp);
-+void tcg_gen_qemu_st_i32(TCGv_i32, TCGv, TCGArg, MemOp);
-+void tcg_gen_qemu_ld_i64(TCGv_i64, TCGv, TCGArg, MemOp);
-+void tcg_gen_qemu_st_i64(TCGv_i64, TCGv, TCGArg, MemOp);
- static inline void tcg_gen_qemu_ld8u(TCGv ret, TCGv addr, int mem_index)
- {
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_qemu_st64(TCGv_i64 arg, TCGv addr, int mem_index)
- }
- void tcg_gen_atomic_cmpxchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGv_i32,
--                                TCGArg, TCGMemOp);
-+                                TCGArg, MemOp);
- void tcg_gen_atomic_cmpxchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGv_i64,
--                                TCGArg, TCGMemOp);
-+                                TCGArg, MemOp);
--void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-+void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
--void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_and_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-+void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_and_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
--void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_and_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
--void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
--void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-+void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_and_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
-+void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
-+void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
- void tcg_gen_mov_vec(TCGv_vec, TCGv_vec);
- void tcg_gen_dup_i32_vec(unsigned vece, TCGv_vec, TCGv_i32);
-diff --git a/tcg/tcg.h b/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.h
-+++ b/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_H
- #include "cpu.h"
-+#include "exec/memop.h"
- #include "exec/tb-context.h"
- #include "qemu/bitops.h"
- #include "qemu/queue.h"
-@@ -XXX,XX +XXX,XX @@ typedef enum TCGType {
- #endif
- } TCGType;
--/* Constants for qemu_ld and qemu_st for the Memory Operation field.  */
--typedef enum TCGMemOp {
--    MO_8     = 0,
--    MO_16    = 1,
--    MO_32    = 2,
--    MO_64    = 3,
--    MO_SIZE  = 3,   /* Mask for the above.  */
--
--    MO_SIGN  = 4,   /* Sign-extended, otherwise zero-extended.  */
--
--    MO_BSWAP = 8,   /* Host reverse endian.  */
--#ifdef HOST_WORDS_BIGENDIAN
--    MO_LE    = MO_BSWAP,
--    MO_BE    = 0,
--#else
--    MO_LE    = 0,
--    MO_BE    = MO_BSWAP,
--#endif
--#ifdef TARGET_WORDS_BIGENDIAN
--    MO_TE    = MO_BE,
--#else
--    MO_TE    = MO_LE,
--#endif
--
--    /*
--     * MO_UNALN accesses are never checked for alignment.
--     * MO_ALIGN accesses will result in a call to the CPU's
--     * do_unaligned_access hook if the guest address is not aligned.
--     * The default depends on whether the target CPU defines
--     * TARGET_ALIGNED_ONLY.
--     *
--     * Some architectures (e.g. ARMv8) need the address which is aligned
--     * to a size more than the size of the memory access.
--     * Some architectures (e.g. SPARCv9) need an address which is aligned,
--     * but less strictly than the natural alignment.
--     *
--     * MO_ALIGN supposes the alignment size is the size of a memory access.
--     *
--     * There are three options:
--     * - unaligned access permitted (MO_UNALN).
--     * - an alignment to the size of an access (MO_ALIGN);
--     * - an alignment to a specified size, which may be more or less than
--     *   the access size (MO_ALIGN_x where 'x' is a size in bytes);
--     */
--    MO_ASHIFT = 4,
--    MO_AMASK = 7 << MO_ASHIFT,
--#ifdef TARGET_ALIGNED_ONLY
--    MO_ALIGN = 0,
--    MO_UNALN = MO_AMASK,
--#else
--    MO_ALIGN = MO_AMASK,
--    MO_UNALN = 0,
--#endif
--    MO_ALIGN_2  = 1 << MO_ASHIFT,
--    MO_ALIGN_4  = 2 << MO_ASHIFT,
--    MO_ALIGN_8  = 3 << MO_ASHIFT,
--    MO_ALIGN_16 = 4 << MO_ASHIFT,
--    MO_ALIGN_32 = 5 << MO_ASHIFT,
--    MO_ALIGN_64 = 6 << MO_ASHIFT,
--
--    /* Combinations of the above, for ease of use.  */
--    MO_UB    = MO_8,
--    MO_UW    = MO_16,
--    MO_UL    = MO_32,
--    MO_SB    = MO_SIGN | MO_8,
--    MO_SW    = MO_SIGN | MO_16,
--    MO_SL    = MO_SIGN | MO_32,
--    MO_Q     = MO_64,
--
--    MO_LEUW  = MO_LE | MO_UW,
--    MO_LEUL  = MO_LE | MO_UL,
--    MO_LESW  = MO_LE | MO_SW,
--    MO_LESL  = MO_LE | MO_SL,
--    MO_LEQ   = MO_LE | MO_Q,
--
--    MO_BEUW  = MO_BE | MO_UW,
--    MO_BEUL  = MO_BE | MO_UL,
--    MO_BESW  = MO_BE | MO_SW,
--    MO_BESL  = MO_BE | MO_SL,
--    MO_BEQ   = MO_BE | MO_Q,
--
--    MO_TEUW  = MO_TE | MO_UW,
--    MO_TEUL  = MO_TE | MO_UL,
--    MO_TESW  = MO_TE | MO_SW,
--    MO_TESL  = MO_TE | MO_SL,
--    MO_TEQ   = MO_TE | MO_Q,
--
--    MO_SSIZE = MO_SIZE | MO_SIGN,
--} TCGMemOp;
--
- /**
-  * get_alignment_bits
-- * @memop: TCGMemOp value
-+ * @memop: MemOp value
-  *
-  * Extract the alignment size from the memop.
-  */
--static inline unsigned get_alignment_bits(TCGMemOp memop)
-+static inline unsigned get_alignment_bits(MemOp memop)
- {
-     unsigned a = memop & MO_AMASK;
-@@ -XXX,XX +XXX,XX @@ static inline size_t tcg_current_code_size(TCGContext *s)
-     return tcg_ptr_byte_diff(s->code_ptr, s->code_buf);
- }
--/* Combine the TCGMemOp and mmu_idx parameters into a single value.  */
-+/* Combine the MemOp and mmu_idx parameters into a single value.  */
- typedef uint32_t TCGMemOpIdx;
- /**
-@@ -XXX,XX +XXX,XX @@ typedef uint32_t TCGMemOpIdx;
-  *
-  * Encode these values into a single parameter.
-  */
--static inline TCGMemOpIdx make_memop_idx(TCGMemOp op, unsigned idx)
-+static inline TCGMemOpIdx make_memop_idx(MemOp op, unsigned idx)
- {
-     tcg_debug_assert(idx <= 15);
-     return (op << 4) | idx;
-@@ -XXX,XX +XXX,XX @@ static inline TCGMemOpIdx make_memop_idx(TCGMemOp op, unsigned idx)
-  *
-  * Extract the memory operation from the combined value.
-  */
--static inline TCGMemOp get_memop(TCGMemOpIdx oi)
-+static inline MemOp get_memop(TCGMemOpIdx oi)
- {
-     return oi >> 4;
- }
-diff --git a/trace/mem-internal.h b/trace/mem-internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/trace/mem-internal.h
-+++ b/trace/mem-internal.h
-@@ -XXX,XX +XXX,XX @@
- #define TRACE_MEM_ST (1ULL << 5)    /* store (y/n) */
- static inline uint8_t trace_mem_build_info(
--    int size_shift, bool sign_extend, TCGMemOp endianness, bool store)
-+    int size_shift, bool sign_extend, MemOp endianness, bool store)
- {
-     uint8_t res;
-@@ -XXX,XX +XXX,XX @@ static inline uint8_t trace_mem_build_info(
-     return res;
- }
--static inline uint8_t trace_mem_get_info(TCGMemOp op, bool store)
-+static inline uint8_t trace_mem_get_info(MemOp op, bool store)
- {
-     return trace_mem_build_info(op & MO_SIZE, !!(op & MO_SIGN),
-                                 op & MO_BSWAP, store);
-diff --git a/trace/mem.h b/trace/mem.h
-index XXXXXXX..XXXXXXX 100644
---- a/trace/mem.h
-+++ b/trace/mem.h
-@@ -XXX,XX +XXX,XX @@
-  *
-  * Return a value for the 'info' argument in guest memory access traces.
-  */
--static uint8_t trace_mem_get_info(TCGMemOp op, bool store);
-+static uint8_t trace_mem_get_info(MemOp op, bool store);
- /**
-  * trace_mem_build_info:
-@@ -XXX,XX +XXX,XX @@ static uint8_t trace_mem_get_info(TCGMemOp op, bool store);
-  * Return a value for the 'info' argument in guest memory access traces.
-  */
- static uint8_t trace_mem_build_info(int size_shift, bool sign_extend,
--                                    TCGMemOp endianness, bool store);
-+                                    MemOp endianness, bool store);
- #include "trace/mem-internal.h"
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
-     CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
-     target_ulong tlb_addr = tlb_addr_write(tlbe);
--    TCGMemOp mop = get_memop(oi);
-+    MemOp mop = get_memop(oi);
-     int a_bits = get_alignment_bits(mop);
-     int s_bits = mop & MO_SIZE;
-     void *hostaddr;
-diff --git a/target/alpha/translate.c b/target/alpha/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/translate.c
-+++ b/target/alpha/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void gen_store_mem(DisasContext *ctx,
- static DisasJumpType gen_store_conditional(DisasContext *ctx, int ra, int rb,
-                                            int32_t disp16, int mem_idx,
--                                           TCGMemOp op)
-+                                           MemOp op)
- {
-     TCGLabel *lab_fail, *lab_done;
-     TCGv addr, val;
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
- typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
- typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
- typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
--typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, TCGMemOp);
-+typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
- /* initialize TCG globals.  */
- void a64_translate_init(void)
-@@ -XXX,XX +XXX,XX @@ TCGv_i64 read_cpu_reg_sp(DisasContext *s, int reg, int sf)
-  * Dn, Sn, Hn or Bn).
-  * (Note that this is not the same mapping as for A32; see cpu.h)
-  */
--static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
-+static inline int fp_reg_offset(DisasContext *s, int regno, MemOp size)
- {
-     return vec_reg_offset(s, regno, 0, size);
- }
-@@ -XXX,XX +XXX,XX @@ static void do_gpr_ld_memidx(DisasContext *s,
-                              bool iss_valid, unsigned int iss_srt,
-                              bool iss_sf, bool iss_ar)
- {
--    TCGMemOp memop = s->be_data + size;
-+    MemOp memop = s->be_data + size;
-     g_assert(size <= 3);
-@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
-     TCGv_i64 tmphi;
-     if (size < 4) {
--        TCGMemOp memop = s->be_data + size;
-+        MemOp memop = s->be_data + size;
-         tmphi = tcg_const_i64(0);
-         tcg_gen_qemu_ld_i64(tmplo, tcg_addr, get_mem_index(s), memop);
-     } else {
-@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
- /* Get value of an element within a vector register */
- static void read_vec_element(DisasContext *s, TCGv_i64 tcg_dest, int srcidx,
--                             int element, TCGMemOp memop)
-+                             int element, MemOp memop)
- {
-     int vect_off = vec_reg_offset(s, srcidx, element, memop & MO_SIZE);
-     switch (memop) {
-@@ -XXX,XX +XXX,XX @@ static void read_vec_element(DisasContext *s, TCGv_i64 tcg_dest, int srcidx,
- }
- static void read_vec_element_i32(DisasContext *s, TCGv_i32 tcg_dest, int srcidx,
--                                 int element, TCGMemOp memop)
-+                                 int element, MemOp memop)
- {
-     int vect_off = vec_reg_offset(s, srcidx, element, memop & MO_SIZE);
-     switch (memop) {
-@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i32(DisasContext *s, TCGv_i32 tcg_dest, int srcidx,
- /* Set value of an element within a vector register */
- static void write_vec_element(DisasContext *s, TCGv_i64 tcg_src, int destidx,
--                              int element, TCGMemOp memop)
-+                              int element, MemOp memop)
- {
-     int vect_off = vec_reg_offset(s, destidx, element, memop & MO_SIZE);
-     switch (memop) {
-@@ -XXX,XX +XXX,XX @@ static void write_vec_element(DisasContext *s, TCGv_i64 tcg_src, int destidx,
- }
- static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
--                                  int destidx, int element, TCGMemOp memop)
-+                                  int destidx, int element, MemOp memop)
- {
-     int vect_off = vec_reg_offset(s, destidx, element, memop & MO_SIZE);
-     switch (memop) {
-@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
- /* Store from vector register to memory */
- static void do_vec_st(DisasContext *s, int srcidx, int element,
--                      TCGv_i64 tcg_addr, int size, TCGMemOp endian)
-+                      TCGv_i64 tcg_addr, int size, MemOp endian)
- {
-     TCGv_i64 tcg_tmp = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void do_vec_st(DisasContext *s, int srcidx, int element,
- /* Load from memory to vector register */
- static void do_vec_ld(DisasContext *s, int destidx, int element,
--                      TCGv_i64 tcg_addr, int size, TCGMemOp endian)
-+                      TCGv_i64 tcg_addr, int size, MemOp endian)
- {
-     TCGv_i64 tcg_tmp = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
-                                TCGv_i64 addr, int size, bool is_pair)
- {
-     int idx = get_mem_index(s);
--    TCGMemOp memop = s->be_data;
-+    MemOp memop = s->be_data;
-     g_assert(size <= 3);
-     if (is_pair) {
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
-     bool is_postidx = extract32(insn, 23, 1);
-     bool is_q = extract32(insn, 30, 1);
-     TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
--    TCGMemOp endian = s->be_data;
-+    MemOp endian = s->be_data;
-     int ebytes;   /* bytes per element */
-     int elements; /* elements per vector */
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-     unsigned int mos, type, rm, cond, rn, rd;
-     TCGv_i64 t_true, t_false, t_zero;
-     DisasCompare64 c;
--    TCGMemOp sz;
-+    MemOp sz;
-     mos = extract32(insn, 29, 3);
-     type = extract32(insn, 22, 2);
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-     int mos = extract32(insn, 29, 3);
-     uint64_t imm;
-     TCGv_i64 tcg_res;
--    TCGMemOp sz;
-+    MemOp sz;
-     if (mos || imm5) {
-         unallocated_encoding(s);
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 do_reduction_op(DisasContext *s, int fpopcode, int rn,
- {
-     if (esize == size) {
-         int element;
--        TCGMemOp msize = esize == 16 ? MO_16 : MO_32;
-+        MemOp msize = esize == 16 ? MO_16 : MO_32;
-         TCGv_i32 tcg_elem;
-         /* We should have one register left here */
-@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
-     int shift = (2 * esize) - immhb;
-     int elements = is_scalar ? 1 : (64 / esize);
-     bool round = extract32(opcode, 0, 1);
--    TCGMemOp ldop = (size + 1) | (is_u_shift ? 0 : MO_SIGN);
-+    MemOp ldop = (size + 1) | (is_u_shift ? 0 : MO_SIGN);
-     TCGv_i64 tcg_rn, tcg_rd, tcg_round;
-     TCGv_i32 tcg_rd_narrowed;
-     TCGv_i64 tcg_final;
-@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
-             }
-         };
-         NeonGenTwoOpEnvFn *genfn = fns[src_unsigned][dst_unsigned][size];
--        TCGMemOp memop = scalar ? size : MO_32;
-+        MemOp memop = scalar ? size : MO_32;
-         int maxpass = scalar ? 1 : is_q ? 4 : 2;
-         for (pass = 0; pass < maxpass; pass++) {
-@@ -XXX,XX +XXX,XX @@ static void handle_simd_intfp_conv(DisasContext *s, int rd, int rn,
-     TCGv_ptr tcg_fpst = get_fpstatus_ptr(size == MO_16);
-     TCGv_i32 tcg_shift = NULL;
--    TCGMemOp mop = size | (is_signed ? MO_SIGN : 0);
-+    MemOp mop = size | (is_signed ? MO_SIGN : 0);
-     int pass;
-     if (fracbits || size == MO_64) {
-@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
-     int dsize = is_q ? 128 : 64;
-     int esize = 8 << size;
-     int elements = dsize/esize;
--    TCGMemOp memop = size | (is_u ? 0 : MO_SIGN);
-+    MemOp memop = size | (is_u ? 0 : MO_SIGN);
-     TCGv_i64 tcg_rn = new_tmp_a64(s);
-     TCGv_i64 tcg_rd = new_tmp_a64(s);
-     TCGv_i64 tcg_round;
-@@ -XXX,XX +XXX,XX @@ static void handle_3rd_widening(DisasContext *s, int is_q, int is_u, int size,
-             TCGv_i64 tcg_op1 = tcg_temp_new_i64();
-             TCGv_i64 tcg_op2 = tcg_temp_new_i64();
-             TCGv_i64 tcg_passres;
--            TCGMemOp memop = MO_32 | (is_u ? 0 : MO_SIGN);
-+            MemOp memop = MO_32 | (is_u ? 0 : MO_SIGN);
-             int elt = pass + is_q * 2;
-@@ -XXX,XX +XXX,XX @@ static void handle_2misc_pairwise(DisasContext *s, int opcode, bool u,
-     if (size == 2) {
-         /* 32 + 32 -> 64 op */
--        TCGMemOp memop = size + (u ? 0 : MO_SIGN);
-+        MemOp memop = size + (u ? 0 : MO_SIGN);
-         for (pass = 0; pass < maxpass; pass++) {
-             TCGv_i64 tcg_op1 = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
-     switch (is_fp) {
-     case 1: /* normal fp */
--        /* convert insn encoded size to TCGMemOp size */
-+        /* convert insn encoded size to MemOp size */
-         switch (size) {
-         case 0: /* half-precision */
-             size = MO_16;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
-         return;
-     }
--    /* Given TCGMemOp size, adjust register and indexing.  */
-+    /* Given MemOp size, adjust register and indexing.  */
-     switch (size) {
-     case MO_16:
-         index = h << 2 | l << 1 | m;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
-         TCGv_i64 tcg_res[2];
-         int pass;
-         bool satop = extract32(opcode, 0, 1);
--        TCGMemOp memop = MO_32;
-+        MemOp memop = MO_32;
-         if (satop || !u) {
-             memop |= MO_SIGN;
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_STR_pri(DisasContext *s, arg_rri *a)
-  */
- /* The memory mode of the dtype.  */
--static const TCGMemOp dtype_mop[16] = {
-+static const MemOp dtype_mop[16] = {
-     MO_UB, MO_UB, MO_UB, MO_UB,
-     MO_SL, MO_UW, MO_UW, MO_UW,
-     MO_SW, MO_SW, MO_UL, MO_UL,
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef enum ISSInfo {
- } ISSInfo;
- /* Save the syndrome information for a Data Abort */
--static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
-+static void disas_set_da_iss(DisasContext *s, MemOp memop, ISSInfo issinfo)
- {
-     uint32_t syn;
-     int sas = memop & MO_SIZE;
-@@ -XXX,XX +XXX,XX @@ static inline void store_reg_from_load(DisasContext *s, int reg, TCGv_i32 var)
-  * that the address argument is TCGv_i32 rather than TCGv.
-  */
--static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, TCGMemOp op)
-+static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
- {
-     TCGv addr = tcg_temp_new();
-     tcg_gen_extu_i32_tl(addr, a32);
-@@ -XXX,XX +XXX,XX @@ static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, TCGMemOp op)
- }
- static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
--                            int index, TCGMemOp opc)
-+                            int index, MemOp opc)
- {
-     TCGv addr;
-@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
- }
- static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
--                            int index, TCGMemOp opc)
-+                            int index, MemOp opc)
- {
-     TCGv addr;
-@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_frob64(DisasContext *s, TCGv_i64 val)
- }
- static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
--                            int index, TCGMemOp opc)
-+                            int index, MemOp opc)
- {
-     TCGv addr = gen_aa32_addr(s, a32, opc);
-     tcg_gen_qemu_ld_i64(val, addr, index, opc);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
- }
- static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
--                            int index, TCGMemOp opc)
-+                            int index, MemOp opc)
- {
-     TCGv addr = gen_aa32_addr(s, a32, opc);
-@@ -XXX,XX +XXX,XX @@ neon_reg_offset (int reg, int n)
-  * where 0 is the least significant end of the register.
-  */
- static inline long
--neon_element_offset(int reg, int element, TCGMemOp size)
-+neon_element_offset(int reg, int element, MemOp size)
- {
-     int element_size = 1 << size;
-     int ofs = element * element_size;
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 neon_load_reg(int reg, int pass)
-     return tmp;
- }
--static void neon_load_element(TCGv_i32 var, int reg, int ele, TCGMemOp mop)
-+static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
- {
-     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void neon_load_element(TCGv_i32 var, int reg, int ele, TCGMemOp mop)
-     }
- }
--static void neon_load_element64(TCGv_i64 var, int reg, int ele, TCGMemOp mop)
-+static void neon_load_element64(TCGv_i64 var, int reg, int ele, MemOp mop)
- {
-     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void neon_store_reg(int reg, int pass, TCGv_i32 var)
-     tcg_temp_free_i32(var);
- }
--static void neon_store_element(int reg, int ele, TCGMemOp size, TCGv_i32 var)
-+static void neon_store_element(int reg, int ele, MemOp size, TCGv_i32 var)
- {
-     long offset = neon_element_offset(reg, ele, size);
-@@ -XXX,XX +XXX,XX @@ static void neon_store_element(int reg, int ele, TCGMemOp size, TCGv_i32 var)
-     }
- }
--static void neon_store_element64(int reg, int ele, TCGMemOp size, TCGv_i64 var)
-+static void neon_store_element64(int reg, int ele, MemOp size, TCGv_i64 var)
- {
-     long offset = neon_element_offset(reg, ele, size);
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
-     int n;
-     int vec_size;
-     int mmu_idx;
--    TCGMemOp endian;
-+    MemOp endian;
-     TCGv_i32 addr;
-     TCGv_i32 tmp;
-     TCGv_i32 tmp2;
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-             } else if ((insn & 0x380) == 0) {
-                 /* VDUP */
-                 int element;
--                TCGMemOp size;
-+                MemOp size;
-                 if ((insn & (7 << 16)) == 0 || (q && (rd & 1))) {
-                     return 1;
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
-                                TCGv_i32 addr, int size)
- {
-     TCGv_i32 tmp = tcg_temp_new_i32();
--    TCGMemOp opc = size | MO_ALIGN | s->be_data;
-+    MemOp opc = size | MO_ALIGN | s->be_data;
-     s->is_ldex = true;
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-     TCGv taddr;
-     TCGLabel *done_label;
-     TCGLabel *fail_label;
--    TCGMemOp opc = size | MO_ALIGN | s->be_data;
-+    MemOp opc = size | MO_ALIGN | s->be_data;
-     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]) {
-          [addr] = {Rt};
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-                         */
-                         TCGv taddr;
--                        TCGMemOp opc = s->be_data;
-+                        MemOp opc = s->be_data;
-                         rm = (insn) & 0xf;
-diff --git a/target/hppa/translate.c b/target/hppa/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/translate.c
-+++ b/target/hppa/translate.c
-@@ -XXX,XX +XXX,XX @@ static void form_gva(DisasContext *ctx, TCGv_tl *pgva, TCGv_reg *pofs,
-  */
- static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
-                        unsigned rx, int scale, target_sreg disp,
--                       unsigned sp, int modify, TCGMemOp mop)
-+                       unsigned sp, int modify, MemOp mop)
- {
-     TCGv_reg ofs;
-     TCGv_tl addr;
-@@ -XXX,XX +XXX,XX @@ static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
- static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
-                        unsigned rx, int scale, target_sreg disp,
--                       unsigned sp, int modify, TCGMemOp mop)
-+                       unsigned sp, int modify, MemOp mop)
- {
-     TCGv_reg ofs;
-     TCGv_tl addr;
-@@ -XXX,XX +XXX,XX @@ static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
- static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
-                         unsigned rx, int scale, target_sreg disp,
--                        unsigned sp, int modify, TCGMemOp mop)
-+                        unsigned sp, int modify, MemOp mop)
- {
-     TCGv_reg ofs;
-     TCGv_tl addr;
-@@ -XXX,XX +XXX,XX @@ static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
- static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
-                         unsigned rx, int scale, target_sreg disp,
--                        unsigned sp, int modify, TCGMemOp mop)
-+                        unsigned sp, int modify, MemOp mop)
- {
-     TCGv_reg ofs;
-     TCGv_tl addr;
-@@ -XXX,XX +XXX,XX @@ static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
- static bool do_load(DisasContext *ctx, unsigned rt, unsigned rb,
-                     unsigned rx, int scale, target_sreg disp,
--                    unsigned sp, int modify, TCGMemOp mop)
-+                    unsigned sp, int modify, MemOp mop)
- {
-     TCGv_reg dest;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fldd(DisasContext *ctx, arg_ldst *a)
- static bool do_store(DisasContext *ctx, unsigned rt, unsigned rb,
-                      target_sreg disp, unsigned sp,
--                     int modify, TCGMemOp mop)
-+                     int modify, MemOp mop)
- {
-     nullify_over(ctx);
-     do_store_reg(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, mop);
-@@ -XXX,XX +XXX,XX @@ static bool trans_st(DisasContext *ctx, arg_ldst *a)
- static bool trans_ldc(DisasContext *ctx, arg_ldst *a)
- {
--    TCGMemOp mop = MO_TEUL | MO_ALIGN_16 | a->size;
-+    MemOp mop = MO_TEUL | MO_ALIGN_16 | a->size;
-     TCGv_reg zero, dest, ofs;
-     TCGv_tl addr;
-diff --git a/target/i386/translate.c b/target/i386/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/translate.c
-+++ b/target/i386/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     /* current insn context */
-     int override; /* -1 if no override */
-     int prefix;
--    TCGMemOp aflag;
--    TCGMemOp dflag;
-+    MemOp aflag;
-+    MemOp dflag;
-     target_ulong pc_start;
-     target_ulong pc; /* pc = eip + cs_base */
-     /* current block context */
-@@ -XXX,XX +XXX,XX @@ static void gen_eob(DisasContext *s);
- static void gen_jr(DisasContext *s, TCGv dest);
- static void gen_jmp(DisasContext *s, target_ulong eip);
- static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num);
--static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d);
-+static void gen_op(DisasContext *s1, int op, MemOp ot, int d);
- /* i386 arith/logic operations */
- enum {
-@@ -XXX,XX +XXX,XX @@ static inline bool byte_reg_is_xH(DisasContext *s, int reg)
- }
- /* Select the size of a push/pop operation.  */
--static inline TCGMemOp mo_pushpop(DisasContext *s, TCGMemOp ot)
-+static inline MemOp mo_pushpop(DisasContext *s, MemOp ot)
- {
-     if (CODE64(s)) {
-         return ot == MO_16 ? MO_16 : MO_64;
-@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp mo_pushpop(DisasContext *s, TCGMemOp ot)
- }
- /* Select the size of the stack pointer.  */
--static inline TCGMemOp mo_stacksize(DisasContext *s)
-+static inline MemOp mo_stacksize(DisasContext *s)
- {
-     return CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
- }
- /* Select only size 64 else 32.  Used for SSE operand sizes.  */
--static inline TCGMemOp mo_64_32(TCGMemOp ot)
-+static inline MemOp mo_64_32(MemOp ot)
- {
- #ifdef TARGET_X86_64
-     return ot == MO_64 ? MO_64 : MO_32;
-@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp mo_64_32(TCGMemOp ot)
- /* Select size 8 if lsb of B is clear, else OT.  Used for decoding
-    byte vs word opcodes.  */
--static inline TCGMemOp mo_b_d(int b, TCGMemOp ot)
-+static inline MemOp mo_b_d(int b, MemOp ot)
- {
-     return b & 1 ? ot : MO_8;
- }
- /* Select size 8 if lsb of B is clear, else OT capped at 32.
-    Used for decoding operand size of port opcodes.  */
--static inline TCGMemOp mo_b_d32(int b, TCGMemOp ot)
-+static inline MemOp mo_b_d32(int b, MemOp ot)
- {
-     return b & 1 ? (ot == MO_16 ? MO_16 : MO_32) : MO_8;
- }
--static void gen_op_mov_reg_v(DisasContext *s, TCGMemOp ot, int reg, TCGv t0)
-+static void gen_op_mov_reg_v(DisasContext *s, MemOp ot, int reg, TCGv t0)
- {
-     switch(ot) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static void gen_op_mov_reg_v(DisasContext *s, TCGMemOp ot, int reg, TCGv t0)
- }
- static inline
--void gen_op_mov_v_reg(DisasContext *s, TCGMemOp ot, TCGv t0, int reg)
-+void gen_op_mov_v_reg(DisasContext *s, MemOp ot, TCGv t0, int reg)
- {
-     if (ot == MO_8 && byte_reg_is_xH(s, reg)) {
-         tcg_gen_extract_tl(t0, cpu_regs[reg - 4], 8, 8);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_op_jmp_v(TCGv dest)
- }
- static inline
--void gen_op_add_reg_im(DisasContext *s, TCGMemOp size, int reg, int32_t val)
-+void gen_op_add_reg_im(DisasContext *s, MemOp size, int reg, int32_t val)
- {
-     tcg_gen_addi_tl(s->tmp0, cpu_regs[reg], val);
-     gen_op_mov_reg_v(s, size, reg, s->tmp0);
- }
--static inline void gen_op_add_reg_T0(DisasContext *s, TCGMemOp size, int reg)
-+static inline void gen_op_add_reg_T0(DisasContext *s, MemOp size, int reg)
- {
-     tcg_gen_add_tl(s->tmp0, cpu_regs[reg], s->T0);
-     gen_op_mov_reg_v(s, size, reg, s->tmp0);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp_im(DisasContext *s, target_ulong pc)
- /* Compute SEG:REG into A0.  SEG is selected from the override segment
-    (OVR_SEG) and the default segment (DEF_SEG).  OVR_SEG may be -1 to
-    indicate no override.  */
--static void gen_lea_v_seg(DisasContext *s, TCGMemOp aflag, TCGv a0,
-+static void gen_lea_v_seg(DisasContext *s, MemOp aflag, TCGv a0,
-                           int def_seg, int ovr_seg)
- {
-     switch (aflag) {
-@@ -XXX,XX +XXX,XX @@ static inline void gen_string_movl_A0_EDI(DisasContext *s)
-     gen_lea_v_seg(s, s->aflag, cpu_regs[R_EDI], R_ES, -1);
- }
--static inline void gen_op_movl_T0_Dshift(DisasContext *s, TCGMemOp ot)
-+static inline void gen_op_movl_T0_Dshift(DisasContext *s, MemOp ot)
- {
-     tcg_gen_ld32s_tl(s->T0, cpu_env, offsetof(CPUX86State, df));
-     tcg_gen_shli_tl(s->T0, s->T0, ot);
- };
--static TCGv gen_ext_tl(TCGv dst, TCGv src, TCGMemOp size, bool sign)
-+static TCGv gen_ext_tl(TCGv dst, TCGv src, MemOp size, bool sign)
- {
-     switch (size) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static TCGv gen_ext_tl(TCGv dst, TCGv src, TCGMemOp size, bool sign)
-     }
- }
--static void gen_extu(TCGMemOp ot, TCGv reg)
-+static void gen_extu(MemOp ot, TCGv reg)
- {
-     gen_ext_tl(reg, reg, ot, false);
- }
--static void gen_exts(TCGMemOp ot, TCGv reg)
-+static void gen_exts(MemOp ot, TCGv reg)
- {
-     gen_ext_tl(reg, reg, ot, true);
- }
- static inline
--void gen_op_jnz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
-+void gen_op_jnz_ecx(DisasContext *s, MemOp size, TCGLabel *label1)
- {
-     tcg_gen_mov_tl(s->tmp0, cpu_regs[R_ECX]);
-     gen_extu(size, s->tmp0);
-@@ -XXX,XX +XXX,XX @@ void gen_op_jnz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
- }
- static inline
--void gen_op_jz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
-+void gen_op_jz_ecx(DisasContext *s, MemOp size, TCGLabel *label1)
- {
-     tcg_gen_mov_tl(s->tmp0, cpu_regs[R_ECX]);
-     gen_extu(size, s->tmp0);
-     tcg_gen_brcondi_tl(TCG_COND_EQ, s->tmp0, 0, label1);
- }
--static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
-+static void gen_helper_in_func(MemOp ot, TCGv v, TCGv_i32 n)
- {
-     switch (ot) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
-     }
- }
--static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
-+static void gen_helper_out_func(MemOp ot, TCGv_i32 v, TCGv_i32 n)
- {
-     switch (ot) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
-     }
- }
--static void gen_check_io(DisasContext *s, TCGMemOp ot, target_ulong cur_eip,
-+static void gen_check_io(DisasContext *s, MemOp ot, target_ulong cur_eip,
-                          uint32_t svm_flags)
- {
-     target_ulong next_eip;
-@@ -XXX,XX +XXX,XX @@ static void gen_check_io(DisasContext *s, TCGMemOp ot, target_ulong cur_eip,
-     }
- }
--static inline void gen_movs(DisasContext *s, TCGMemOp ot)
-+static inline void gen_movs(DisasContext *s, MemOp ot)
- {
-     gen_string_movl_A0_ESI(s);
-     gen_op_ld_v(s, ot, s->T0, s->A0);
-@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_s(DisasContext *s, TCGv reg)
-         return (CCPrepare) { .cond = TCG_COND_NEVER, .mask = -1 };
-     default:
-         {
--            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
-+            MemOp size = (s->cc_op - CC_OP_ADDB) & 3;
-             TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, true);
-             return (CCPrepare) { .cond = TCG_COND_LT, .reg = t0, .mask = -1 };
-         }
-@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_z(DisasContext *s, TCGv reg)
-                              .mask = -1 };
-     default:
-         {
--            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
-+            MemOp size = (s->cc_op - CC_OP_ADDB) & 3;
-             TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, false);
-             return (CCPrepare) { .cond = TCG_COND_EQ, .reg = t0, .mask = -1 };
-         }
-@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_z(DisasContext *s, TCGv reg)
- static CCPrepare gen_prepare_cc(DisasContext *s, int b, TCGv reg)
- {
-     int inv, jcc_op, cond;
--    TCGMemOp size;
-+    MemOp size;
-     CCPrepare cc;
-     TCGv t0;
-@@ -XXX,XX +XXX,XX @@ static TCGLabel *gen_jz_ecx_string(DisasContext *s, target_ulong next_eip)
-     return l2;
- }
--static inline void gen_stos(DisasContext *s, TCGMemOp ot)
-+static inline void gen_stos(DisasContext *s, MemOp ot)
- {
-     gen_op_mov_v_reg(s, MO_32, s->T0, R_EAX);
-     gen_string_movl_A0_EDI(s);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_stos(DisasContext *s, TCGMemOp ot)
-     gen_op_add_reg_T0(s, s->aflag, R_EDI);
- }
--static inline void gen_lods(DisasContext *s, TCGMemOp ot)
-+static inline void gen_lods(DisasContext *s, MemOp ot)
- {
-     gen_string_movl_A0_ESI(s);
-     gen_op_ld_v(s, ot, s->T0, s->A0);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_lods(DisasContext *s, TCGMemOp ot)
-     gen_op_add_reg_T0(s, s->aflag, R_ESI);
- }
--static inline void gen_scas(DisasContext *s, TCGMemOp ot)
-+static inline void gen_scas(DisasContext *s, MemOp ot)
- {
-     gen_string_movl_A0_EDI(s);
-     gen_op_ld_v(s, ot, s->T1, s->A0);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_scas(DisasContext *s, TCGMemOp ot)
-     gen_op_add_reg_T0(s, s->aflag, R_EDI);
- }
--static inline void gen_cmps(DisasContext *s, TCGMemOp ot)
-+static inline void gen_cmps(DisasContext *s, MemOp ot)
- {
-     gen_string_movl_A0_EDI(s);
-     gen_op_ld_v(s, ot, s->T1, s->A0);
-@@ -XXX,XX +XXX,XX @@ static void gen_bpt_io(DisasContext *s, TCGv_i32 t_port, int ot)
- }
--static inline void gen_ins(DisasContext *s, TCGMemOp ot)
-+static inline void gen_ins(DisasContext *s, MemOp ot)
- {
-     if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
-         gen_io_start();
-@@ -XXX,XX +XXX,XX @@ static inline void gen_ins(DisasContext *s, TCGMemOp ot)
-     }
- }
--static inline void gen_outs(DisasContext *s, TCGMemOp ot)
-+static inline void gen_outs(DisasContext *s, MemOp ot)
- {
-     if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
-         gen_io_start();
-@@ -XXX,XX +XXX,XX @@ static inline void gen_outs(DisasContext *s, TCGMemOp ot)
- /* same method as Valgrind : we generate jumps to current or next
-    instruction */
- #define GEN_REPZ(op)                                                          \
--static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
-+static inline void gen_repz_ ## op(DisasContext *s, MemOp ot,              \
-                                  target_ulong cur_eip, target_ulong next_eip) \
- {                                                                             \
-     TCGLabel *l2;                                                             \
-@@ -XXX,XX +XXX,XX @@ static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
- }
- #define GEN_REPZ2(op)                                                         \
--static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
-+static inline void gen_repz_ ## op(DisasContext *s, MemOp ot,              \
-                                    target_ulong cur_eip,                      \
-                                    target_ulong next_eip,                     \
-                                    int nz)                                    \
-@@ -XXX,XX +XXX,XX @@ static void gen_illegal_opcode(DisasContext *s)
- }
- /* if d == OR_TMP0, it means memory operand (address in A0) */
--static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d)
-+static void gen_op(DisasContext *s1, int op, MemOp ot, int d)
- {
-     if (d != OR_TMP0) {
-         if (s1->prefix & PREFIX_LOCK) {
-@@ -XXX,XX +XXX,XX @@ static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d)
- }
- /* if d == OR_TMP0, it means memory operand (address in A0) */
--static void gen_inc(DisasContext *s1, TCGMemOp ot, int d, int c)
-+static void gen_inc(DisasContext *s1, MemOp ot, int d, int c)
- {
-     if (s1->prefix & PREFIX_LOCK) {
-         if (d != OR_TMP0) {
-@@ -XXX,XX +XXX,XX @@ static void gen_inc(DisasContext *s1, TCGMemOp ot, int d, int c)
-     set_cc_op(s1, (c > 0 ? CC_OP_INCB : CC_OP_DECB) + ot);
- }
--static void gen_shift_flags(DisasContext *s, TCGMemOp ot, TCGv result,
-+static void gen_shift_flags(DisasContext *s, MemOp ot, TCGv result,
-                             TCGv shm1, TCGv count, bool is_right)
- {
-     TCGv_i32 z32, s32, oldop;
-@@ -XXX,XX +XXX,XX @@ static void gen_shift_flags(DisasContext *s, TCGMemOp ot, TCGv result,
-     set_cc_op(s, CC_OP_DYNAMIC);
- }
--static void gen_shift_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
-+static void gen_shift_rm_T1(DisasContext *s, MemOp ot, int op1,
-                             int is_right, int is_arith)
- {
-     target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
-@@ -XXX,XX +XXX,XX @@ static void gen_shift_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
-     gen_shift_flags(s, ot, s->T0, s->tmp0, s->T1, is_right);
- }
--static void gen_shift_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
-+static void gen_shift_rm_im(DisasContext *s, MemOp ot, int op1, int op2,
-                             int is_right, int is_arith)
- {
-     int mask = (ot == MO_64 ? 0x3f : 0x1f);
-@@ -XXX,XX +XXX,XX @@ static void gen_shift_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
-     }
- }
--static void gen_rot_rm_T1(DisasContext *s, TCGMemOp ot, int op1, int is_right)
-+static void gen_rot_rm_T1(DisasContext *s, MemOp ot, int op1, int is_right)
- {
-     target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
-     TCGv_i32 t0, t1;
-@@ -XXX,XX +XXX,XX @@ static void gen_rot_rm_T1(DisasContext *s, TCGMemOp ot, int op1, int is_right)
-     set_cc_op(s, CC_OP_DYNAMIC);
- }
--static void gen_rot_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
-+static void gen_rot_rm_im(DisasContext *s, MemOp ot, int op1, int op2,
-                           int is_right)
- {
-     int mask = (ot == MO_64 ? 0x3f : 0x1f);
-@@ -XXX,XX +XXX,XX @@ static void gen_rot_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
- }
- /* XXX: add faster immediate = 1 case */
--static void gen_rotc_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
-+static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
-                            int is_right)
- {
-     gen_compute_eflags(s);
-@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
- }
- /* XXX: add faster immediate case */
--static void gen_shiftd_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
-+static void gen_shiftd_rm_T1(DisasContext *s, MemOp ot, int op1,
-                              bool is_right, TCGv count_in)
- {
-     target_ulong mask = (ot == MO_64 ? 63 : 31);
-@@ -XXX,XX +XXX,XX @@ static void gen_shiftd_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
-     tcg_temp_free(count);
- }
--static void gen_shift(DisasContext *s1, int op, TCGMemOp ot, int d, int s)
-+static void gen_shift(DisasContext *s1, int op, MemOp ot, int d, int s)
- {
-     if (s != OR_TMP1)
-         gen_op_mov_v_reg(s1, ot, s1->T1, s);
-@@ -XXX,XX +XXX,XX @@ static void gen_shift(DisasContext *s1, int op, TCGMemOp ot, int d, int s)
-     }
- }
--static void gen_shifti(DisasContext *s1, int op, TCGMemOp ot, int d, int c)
-+static void gen_shifti(DisasContext *s1, int op, MemOp ot, int d, int c)
- {
-     switch(op) {
-     case OP_ROL:
-@@ -XXX,XX +XXX,XX @@ static void gen_add_A0_ds_seg(DisasContext *s)
- /* generate modrm memory load or store of 'reg'. TMP0 is used if reg ==
-    OR_TMP0 */
- static void gen_ldst_modrm(CPUX86State *env, DisasContext *s, int modrm,
--                           TCGMemOp ot, int reg, int is_store)
-+                           MemOp ot, int reg, int is_store)
- {
-     int mod, rm;
-@@ -XXX,XX +XXX,XX @@ static void gen_ldst_modrm(CPUX86State *env, DisasContext *s, int modrm,
-     }
- }
--static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, TCGMemOp ot)
-+static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, MemOp ot)
- {
-     uint32_t ret;
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, TCGMemOp ot)
-     return ret;
- }
--static inline int insn_const_size(TCGMemOp ot)
-+static inline int insn_const_size(MemOp ot)
- {
-     if (ot <= MO_32) {
-         return 1 << ot;
-@@ -XXX,XX +XXX,XX @@ static inline void gen_jcc(DisasContext *s, int b,
-     }
- }
--static void gen_cmovcc1(CPUX86State *env, DisasContext *s, TCGMemOp ot, int b,
-+static void gen_cmovcc1(CPUX86State *env, DisasContext *s, MemOp ot, int b,
-                         int modrm, int reg)
- {
-     CCPrepare cc;
-@@ -XXX,XX +XXX,XX @@ static inline void gen_stack_update(DisasContext *s, int addend)
- /* Generate a push. It depends on ss32, addseg and dflag.  */
- static void gen_push_v(DisasContext *s, TCGv val)
- {
--    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
--    TCGMemOp a_ot = mo_stacksize(s);
-+    MemOp d_ot = mo_pushpop(s, s->dflag);
-+    MemOp a_ot = mo_stacksize(s);
-     int size = 1 << d_ot;
-     TCGv new_esp = s->A0;
-@@ -XXX,XX +XXX,XX @@ static void gen_push_v(DisasContext *s, TCGv val)
- }
- /* two step pop is necessary for precise exceptions */
--static TCGMemOp gen_pop_T0(DisasContext *s)
-+static MemOp gen_pop_T0(DisasContext *s)
- {
--    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
-+    MemOp d_ot = mo_pushpop(s, s->dflag);
-     gen_lea_v_seg(s, mo_stacksize(s), cpu_regs[R_ESP], R_SS, -1);
-     gen_op_ld_v(s, d_ot, s->T0, s->A0);
-@@ -XXX,XX +XXX,XX @@ static TCGMemOp gen_pop_T0(DisasContext *s)
-     return d_ot;
- }
--static inline void gen_pop_update(DisasContext *s, TCGMemOp ot)
-+static inline void gen_pop_update(DisasContext *s, MemOp ot)
- {
-     gen_stack_update(s, 1 << ot);
- }
-@@ -XXX,XX +XXX,XX @@ static inline void gen_stack_A0(DisasContext *s)
- static void gen_pusha(DisasContext *s)
- {
--    TCGMemOp s_ot = s->ss32 ? MO_32 : MO_16;
--    TCGMemOp d_ot = s->dflag;
-+    MemOp s_ot = s->ss32 ? MO_32 : MO_16;
-+    MemOp d_ot = s->dflag;
-     int size = 1 << d_ot;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void gen_pusha(DisasContext *s)
- static void gen_popa(DisasContext *s)
- {
--    TCGMemOp s_ot = s->ss32 ? MO_32 : MO_16;
--    TCGMemOp d_ot = s->dflag;
-+    MemOp s_ot = s->ss32 ? MO_32 : MO_16;
-+    MemOp d_ot = s->dflag;
-     int size = 1 << d_ot;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void gen_popa(DisasContext *s)
- static void gen_enter(DisasContext *s, int esp_addend, int level)
- {
--    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
--    TCGMemOp a_ot = CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
-+    MemOp d_ot = mo_pushpop(s, s->dflag);
-+    MemOp a_ot = CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
-     int size = 1 << d_ot;
-     /* Push BP; compute FrameTemp into T1.  */
-@@ -XXX,XX +XXX,XX @@ static void gen_enter(DisasContext *s, int esp_addend, int level)
- static void gen_leave(DisasContext *s)
- {
--    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
--    TCGMemOp a_ot = mo_stacksize(s);
-+    MemOp d_ot = mo_pushpop(s, s->dflag);
-+    MemOp a_ot = mo_stacksize(s);
-     gen_lea_v_seg(s, a_ot, cpu_regs[R_EBP], R_SS, -1);
-     gen_op_ld_v(s, d_ot, s->T0, s->A0);
-@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
-     SSEFunc_0_eppi sse_fn_eppi;
-     SSEFunc_0_ppi sse_fn_ppi;
-     SSEFunc_0_eppt sse_fn_eppt;
--    TCGMemOp ot;
-+    MemOp ot;
-     b &= 0xff;
-     if (s->prefix & PREFIX_DATA)
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
-     CPUX86State *env = cpu->env_ptr;
-     int b, prefixes;
-     int shift;
--    TCGMemOp ot, aflag, dflag;
-+    MemOp ot, aflag, dflag;
-     int modrm, reg, rm, mod, op, opreg, val;
-     target_ulong next_eip, tval;
-     int rex_w, rex_r;
-@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
-     case 0x1be: /* movsbS Gv, Eb */
-     case 0x1bf: /* movswS Gv, Eb */
-         {
--            TCGMemOp d_ot;
--            TCGMemOp s_ot;
-+            MemOp d_ot;
-+            MemOp s_ot;
-             /* d_ot is the size of destination */
-             d_ot = dflag;
-diff --git a/target/m68k/translate.c b/target/m68k/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/translate.c
-+++ b/target/m68k/translate.c
-@@ -XXX,XX +XXX,XX @@ DISAS_INSN(cas)
-     uint16_t ext;
-     TCGv load;
-     TCGv cmp;
--    TCGMemOp opc;
-+    MemOp opc;
-     switch ((insn >> 9) & 3) {
-     case 1:
-diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/translate.c
-+++ b/target/microblaze/translate.c
-@@ -XXX,XX +XXX,XX @@ static void dec_load(DisasContext *dc)
-     unsigned int size;
-     bool rev = false, ex = false, ea = false;
-     int mem_index = cpu_mmu_index(&dc->cpu->env, false);
--    TCGMemOp mop;
-+    MemOp mop;
-     mop = dc->opcode & 3;
-     size = 1 << mop;
-@@ -XXX,XX +XXX,XX @@ static void dec_store(DisasContext *dc)
-     unsigned int size;
-     bool rev = false, ex = false, ea = false;
-     int mem_index = cpu_mmu_index(&dc->cpu->env, false);
--    TCGMemOp mop;
-+    MemOp mop;
-     mop = dc->opcode & 3;
-     size = 1 << mop;
-diff --git a/target/mips/translate.c b/target/mips/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/translate.c
-+++ b/target/mips/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     int32_t CP0_Config5;
-     /* Routine used to access memory */
-     int mem_idx;
--    TCGMemOp default_tcg_memop_mask;
-+    MemOp default_tcg_memop_mask;
-     uint32_t hflags, saved_hflags;
-     target_ulong btarget;
-     bool ulri;
-@@ -XXX,XX +XXX,XX @@ static void gen_st(DisasContext *ctx, uint32_t opc, int rt,
- /* Store conditional */
- static void gen_st_cond(DisasContext *ctx, int rt, int base, int offset,
--                        TCGMemOp tcg_mo, bool eva)
-+                        MemOp tcg_mo, bool eva)
- {
-     TCGv addr, t0, val;
-     TCGLabel *l1 = gen_new_label();
-@@ -XXX,XX +XXX,XX @@ static void gen_HILO(DisasContext *ctx, uint32_t opc, int acc, int reg)
- }
- static inline void gen_r6_ld(target_long addr, int reg, int memidx,
--                             TCGMemOp memop)
-+                             MemOp memop)
- {
-     TCGv t0 = tcg_const_tl(addr);
-     tcg_gen_qemu_ld_tl(t0, t0, memidx, memop);
-@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
-                              extract32(ctx->opcode, 0, 8);
-                     TCGv va = tcg_temp_new();
-                     TCGv t1 = tcg_temp_new();
--                    TCGMemOp memop = (extract32(ctx->opcode, 8, 3)) ==
-+                    MemOp memop = (extract32(ctx->opcode, 8, 3)) ==
-                                       NM_P_LS_UAWM ? MO_UNALN : 0;
-                     count = (count == 0) ? 8 : count;
-diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/translate.c
-+++ b/target/openrisc/translate.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_l_lwa(DisasContext *dc, arg_load *a)
-     return true;
- }
--static void do_load(DisasContext *dc, arg_load *a, TCGMemOp mop)
-+static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
- {
-     TCGv ea;
-@@ -XXX,XX +XXX,XX @@ static bool trans_l_swa(DisasContext *dc, arg_store *a)
-     return true;
- }
--static void do_store(DisasContext *dc, arg_store *a, TCGMemOp mop)
-+static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
- {
-     TCGv t0 = tcg_temp_new();
-     tcg_gen_addi_tl(t0, cpu_R[a->a], a->i);
-diff --git a/target/ppc/translate.c b/target/ppc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate.c
-+++ b/target/ppc/translate.c
-@@ -XXX,XX +XXX,XX @@ struct DisasContext {
-     int mem_idx;
-     int access_type;
-     /* Translation flags */
--    TCGMemOp default_tcg_memop_mask;
-+    MemOp default_tcg_memop_mask;
- #if defined(TARGET_PPC64)
-     bool sf_mode;
-     bool has_cfar;
-@@ -XXX,XX +XXX,XX @@ static void gen_isync(DisasContext *ctx)
- #define MEMOP_GET_SIZE(x)  (1 << ((x) & MO_SIZE))
--static void gen_load_locked(DisasContext *ctx, TCGMemOp memop)
-+static void gen_load_locked(DisasContext *ctx, MemOp memop)
- {
-     TCGv gpr = cpu_gpr[rD(ctx->opcode)];
-     TCGv t0 = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ LARX(lbarx, DEF_MEMOP(MO_UB))
- LARX(lharx, DEF_MEMOP(MO_UW))
- LARX(lwarx, DEF_MEMOP(MO_UL))
--static void gen_fetch_inc_conditional(DisasContext *ctx, TCGMemOp memop,
-+static void gen_fetch_inc_conditional(DisasContext *ctx, MemOp memop,
-                                       TCGv EA, TCGCond cond, int addend)
- {
-     TCGv t = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static void gen_fetch_inc_conditional(DisasContext *ctx, TCGMemOp memop,
-     tcg_temp_free(u);
- }
--static void gen_ld_atomic(DisasContext *ctx, TCGMemOp memop)
-+static void gen_ld_atomic(DisasContext *ctx, MemOp memop)
- {
-     uint32_t gpr_FC = FC(ctx->opcode);
-     TCGv EA = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static void gen_ldat(DisasContext *ctx)
- }
- #endif
--static void gen_st_atomic(DisasContext *ctx, TCGMemOp memop)
-+static void gen_st_atomic(DisasContext *ctx, MemOp memop)
- {
-     uint32_t gpr_FC = FC(ctx->opcode);
-     TCGv EA = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static void gen_stdat(DisasContext *ctx)
- }
- #endif
--static void gen_conditional_store(DisasContext *ctx, TCGMemOp memop)
-+static void gen_conditional_store(DisasContext *ctx, MemOp memop)
- {
-     TCGLabel *l1 = gen_new_label();
-     TCGLabel *l2 = gen_new_label();
-diff --git a/target/riscv/insn_trans/trans_rva.inc.c b/target/riscv/insn_trans/trans_rva.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rva.inc.c
-+++ b/target/riscv/insn_trans/trans_rva.inc.c
-@@ -XXX,XX +XXX,XX @@
-  * this program.  If not, see <http://www.gnu.org/licenses/>.
-  */
--static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
-+static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
- {
-     TCGv src1 = tcg_temp_new();
-     /* Put addr in load_res, data in load_val.  */
-@@ -XXX,XX +XXX,XX @@ static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
-     return true;
- }
--static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
-+static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
- {
-     TCGv src1 = tcg_temp_new();
-     TCGv src2 = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
- }
- static bool gen_amo(DisasContext *ctx, arg_atomic *a,
--                    void(*func)(TCGv, TCGv, TCGv, TCGArg, TCGMemOp),
--                    TCGMemOp mop)
-+                    void(*func)(TCGv, TCGv, TCGv, TCGArg, MemOp),
-+                    MemOp mop)
- {
-     TCGv src1 = tcg_temp_new();
-     TCGv src2 = tcg_temp_new();
-diff --git a/target/riscv/insn_trans/trans_rvi.inc.c b/target/riscv/insn_trans/trans_rvi.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.inc.c
-+++ b/target/riscv/insn_trans/trans_rvi.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_bgeu(DisasContext *ctx, arg_bgeu *a)
-     return gen_branch(ctx, a, TCG_COND_GEU);
- }
--static bool gen_load(DisasContext *ctx, arg_lb *a, TCGMemOp memop)
-+static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
- {
-     TCGv t0 = tcg_temp_new();
-     TCGv t1 = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static bool trans_lhu(DisasContext *ctx, arg_lhu *a)
-     return gen_load(ctx, a, MO_TEUW);
- }
--static bool gen_store(DisasContext *ctx, arg_sb *a, TCGMemOp memop)
-+static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
- {
-     TCGv t0 = tcg_temp_new();
-     TCGv dat = tcg_temp_new();
-diff --git a/target/s390x/translate.c b/target/s390x/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/translate.c
-+++ b/target/s390x/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_offset(uint8_t reg)
-     return offsetof(CPUS390XState, vregs[reg][0]);
- }
--static inline int vec_reg_offset(uint8_t reg, uint8_t enr, TCGMemOp es)
-+static inline int vec_reg_offset(uint8_t reg, uint8_t enr, MemOp es)
- {
-     /* Convert element size (es) - e.g. MO_8 - to bytes */
-     const uint8_t bytes = 1 << es;
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_csst(DisasContext *s, DisasOps *o)
- #ifndef CONFIG_USER_ONLY
- static DisasJumpType op_csp(DisasContext *s, DisasOps *o)
- {
--    TCGMemOp mop = s->insn->data;
-+    MemOp mop = s->insn->data;
-     TCGv_i64 addr, old, cc;
-     TCGLabel *lab = gen_new_label();
-@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_lm64(DisasContext *s, DisasOps *o)
- static DisasJumpType op_lpd(DisasContext *s, DisasOps *o)
- {
-     TCGv_i64 a1, a2;
--    TCGMemOp mop = s->insn->data;
-+    MemOp mop = s->insn->data;
-     /* In a parallel context, stop the world and single step.  */
-     if (tb_cflags(s->base.tb) & CF_PARALLEL) {
-diff --git a/target/s390x/translate_vx.inc.c b/target/s390x/translate_vx.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/translate_vx.inc.c
-+++ b/target/s390x/translate_vx.inc.c
-@@ -XXX,XX +XXX,XX @@
- #define FPF_LONG        3
- #define FPF_EXT         4
--static inline bool valid_vec_element(uint8_t enr, TCGMemOp es)
-+static inline bool valid_vec_element(uint8_t enr, MemOp es)
- {
-     return !(enr & ~(NUM_VEC_ELEMENTS(es) - 1));
- }
- static void read_vec_element_i64(TCGv_i64 dst, uint8_t reg, uint8_t enr,
--                                 TCGMemOp memop)
-+                                 MemOp memop)
- {
-     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i64(TCGv_i64 dst, uint8_t reg, uint8_t enr,
- }
- static void read_vec_element_i32(TCGv_i32 dst, uint8_t reg, uint8_t enr,
--                                 TCGMemOp memop)
-+                                 MemOp memop)
- {
-     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i32(TCGv_i32 dst, uint8_t reg, uint8_t enr,
- }
- static void write_vec_element_i64(TCGv_i64 src, int reg, uint8_t enr,
--                                  TCGMemOp memop)
-+                                  MemOp memop)
- {
-     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i64(TCGv_i64 src, int reg, uint8_t enr,
- }
- static void write_vec_element_i32(TCGv_i32 src, int reg, uint8_t enr,
--                                  TCGMemOp memop)
-+                                  MemOp memop)
- {
-     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
-diff --git a/target/sparc/translate.c b/target/sparc/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/translate.c
-+++ b/target/sparc/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void gen_ne_fop_QD(DisasContext *dc, int rd, int rs,
- }
- static void gen_swap(DisasContext *dc, TCGv dst, TCGv src,
--                     TCGv addr, int mmu_idx, TCGMemOp memop)
-+                     TCGv addr, int mmu_idx, MemOp memop)
- {
-     gen_address_mask(dc, addr);
-     tcg_gen_atomic_xchg_tl(dst, addr, src, mmu_idx, memop);
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     ASIType type;
-     int asi;
-     int mem_idx;
--    TCGMemOp memop;
-+    MemOp memop;
- } DisasASI;
--static DisasASI get_asi(DisasContext *dc, int insn, TCGMemOp memop)
-+static DisasASI get_asi(DisasContext *dc, int insn, MemOp memop)
- {
-     int asi = GET_FIELD(insn, 19, 26);
-     ASIType type = GET_ASI_HELPER;
-@@ -XXX,XX +XXX,XX @@ static DisasASI get_asi(DisasContext *dc, int insn, TCGMemOp memop)
- }
- static void gen_ld_asi(DisasContext *dc, TCGv dst, TCGv addr,
--                       int insn, TCGMemOp memop)
-+                       int insn, MemOp memop)
- {
-     DisasASI da = get_asi(dc, insn, memop);
-@@ -XXX,XX +XXX,XX @@ static void gen_ld_asi(DisasContext *dc, TCGv dst, TCGv addr,
- }
- static void gen_st_asi(DisasContext *dc, TCGv src, TCGv addr,
--                       int insn, TCGMemOp memop)
-+                       int insn, MemOp memop)
- {
-     DisasASI da = get_asi(dc, insn, memop);
-@@ -XXX,XX +XXX,XX @@ static void gen_ldf_asi(DisasContext *dc, TCGv addr,
-     case GET_ASI_BLOCK:
-         /* Valid for lddfa on aligned registers only.  */
-         if (size == 8 && (rd & 7) == 0) {
--            TCGMemOp memop;
-+            MemOp memop;
-             TCGv eight;
-             int i;
-@@ -XXX,XX +XXX,XX @@ static void gen_stf_asi(DisasContext *dc, TCGv addr,
-     case GET_ASI_BLOCK:
-         /* Valid for stdfa on aligned registers only.  */
-         if (size == 8 && (rd & 7) == 0) {
--            TCGMemOp memop;
-+            MemOp memop;
-             TCGv eight;
-             int i;
-diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/translate.c
-+++ b/target/tilegx/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_cmul2(TCGv tdest, TCGv tsrca, TCGv tsrcb, int sh, int rd)
- }
- static TileExcp gen_st_opcode(DisasContext *dc, unsigned dest, unsigned srca,
--                              unsigned srcb, TCGMemOp memop, const char *name)
-+                              unsigned srcb, MemOp memop, const char *name)
- {
-     if (dest) {
-         return TILEGX_EXCP_OPCODE_UNKNOWN;
-@@ -XXX,XX +XXX,XX @@ static TileExcp gen_st_opcode(DisasContext *dc, unsigned dest, unsigned srca,
- }
- static TileExcp gen_st_add_opcode(DisasContext *dc, unsigned srca, unsigned srcb,
--                                  int imm, TCGMemOp memop, const char *name)
-+                                  int imm, MemOp memop, const char *name)
- {
-     TCGv tsrca = load_gr(dc, srca);
-     TCGv tsrcb = load_gr(dc, srcb);
-@@ -XXX,XX +XXX,XX @@ static TileExcp gen_rr_opcode(DisasContext *dc, unsigned opext,
- {
-     TCGv tdest, tsrca;
-     const char *mnemonic;
--    TCGMemOp memop;
-+    MemOp memop;
-     TileExcp ret = TILEGX_EXCP_NONE;
-     bool prefetch_nofault = false;
-@@ -XXX,XX +XXX,XX @@ static TileExcp gen_rri_opcode(DisasContext *dc, unsigned opext,
-     TCGv tsrca = load_gr(dc, srca);
-     bool prefetch_nofault = false;
-     const char *mnemonic;
--    TCGMemOp memop;
-+    MemOp memop;
-     int i2, i3;
-     TCGv t0;
-@@ -XXX,XX +XXX,XX @@ static TileExcp decode_y2(DisasContext *dc, tilegx_bundle_bits bundle)
-     unsigned srca = get_SrcA_Y2(bundle);
-     unsigned srcbdest = get_SrcBDest_Y2(bundle);
-     const char *mnemonic;
--    TCGMemOp memop;
-+    MemOp memop;
-     bool prefetch_nofault = false;
-     switch (OEY2(opc, mode)) {
-diff --git a/target/tricore/translate.c b/target/tricore/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/translate.c
-+++ b/target/tricore/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void generate_trap(DisasContext *ctx, int class, int tin);
- /* Functions for load/save to/from memory */
- static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
--                                 int16_t con, TCGMemOp mop)
-+                                 int16_t con, MemOp mop)
- {
-     TCGv temp = tcg_temp_new();
-     tcg_gen_addi_tl(temp, r2, con);
-@@ -XXX,XX +XXX,XX @@ static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
- }
- static inline void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
--                                 int16_t con, TCGMemOp mop)
-+                                 int16_t con, MemOp mop)
- {
-     TCGv temp = tcg_temp_new();
-     tcg_gen_addi_tl(temp, r2, con);
-@@ -XXX,XX +XXX,XX @@ static void gen_offset_ld_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
- }
- static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
--                           TCGMemOp mop)
-+                           MemOp mop)
- {
-     TCGv temp = tcg_temp_new();
-     tcg_gen_addi_tl(temp, r2, off);
-@@ -XXX,XX +XXX,XX @@ static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
- }
- static void gen_ld_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
--                           TCGMemOp mop)
-+                           MemOp mop)
- {
-     TCGv temp = tcg_temp_new();
-     tcg_gen_addi_tl(temp, r2, off);
-diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.inc.c
-+++ b/tcg/aarch64/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rev16(TCGContext *s, TCGReg rd, TCGReg rn)
-     tcg_out_insn(s, 3507, REV16, TCG_TYPE_I32, rd, rn);
- }
--static inline void tcg_out_sxt(TCGContext *s, TCGType ext, TCGMemOp s_bits,
-+static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
-                                TCGReg rd, TCGReg rn)
- {
-     /* Using ALIASes SXTB, SXTH, SXTW, of SBFM Xd, Xn, #0, #7|15|31 */
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sxt(TCGContext *s, TCGType ext, TCGMemOp s_bits,
-     tcg_out_sbfm(s, ext, rd, rn, 0, bits);
- }
--static inline void tcg_out_uxt(TCGContext *s, TCGMemOp s_bits,
-+static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
-                                TCGReg rd, TCGReg rn)
- {
-     /* Using ALIASes UXTB, UXTH of UBFM Wd, Wn, #0, #7|15 */
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
- static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp size = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp size = opc & MO_SIZE;
-     if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
-         return false;
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp size = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp size = opc & MO_SIZE;
-     if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
-         return false;
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 8);
-    slow path for the failure case, which will be patched later when finalizing
-    the slow path. Generated code returns the host addend in X1,
-    clobbers X0,X2,X3,TMP. */
--static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, TCGMemOp opc,
-+static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
-                              tcg_insn_unit **label_ptr, int mem_index,
-                              bool is_read)
- {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, TCGMemOp opc,
- #endif /* CONFIG_SOFTMMU */
--static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp memop, TCGType ext,
-+static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
-                                    TCGReg data_r, TCGReg addr_r,
-                                    TCGType otype, TCGReg off_r)
- {
--    const TCGMemOp bswap = memop & MO_BSWAP;
-+    const MemOp bswap = memop & MO_BSWAP;
-     switch (memop & MO_SSIZE) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp memop, TCGType ext,
-     }
- }
--static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp memop,
-+static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
-                                    TCGReg data_r, TCGReg addr_r,
-                                    TCGType otype, TCGReg off_r)
- {
--    const TCGMemOp bswap = memop & MO_BSWAP;
-+    const MemOp bswap = memop & MO_BSWAP;
-     switch (memop & MO_SIZE) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp memop,
- static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                             TCGMemOpIdx oi, TCGType ext)
- {
--    TCGMemOp memop = get_memop(oi);
-+    MemOp memop = get_memop(oi);
-     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
- #ifdef CONFIG_SOFTMMU
-     unsigned mem_index = get_mmuidx(oi);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
- static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                             TCGMemOpIdx oi)
- {
--    TCGMemOp memop = get_memop(oi);
-+    MemOp memop = get_memop(oi);
-     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
- #ifdef CONFIG_SOFTMMU
-     unsigned mem_index = get_mmuidx(oi);
-diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.inc.c
-+++ b/tcg/arm/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 4);
-    containing the addend of the tlb entry.  Clobbers R0, R1, R2, TMP.  */
- static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
--                               TCGMemOp opc, int mem_index, bool is_load)
-+                               MemOp opc, int mem_index, bool is_load)
- {
-     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
-                    : offsetof(CPUTLBEntry, addr_write));
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg argreg, datalo, datahi;
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     void *func;
-     if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGReg argreg, datalo, datahi;
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
-         return false;
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- }
- #endif /* SOFTMMU */
--static inline void tcg_out_qemu_ld_index(TCGContext *s, TCGMemOp opc,
-+static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
-                                          TCGReg datalo, TCGReg datahi,
-                                          TCGReg addrlo, TCGReg addend)
- {
--    TCGMemOp bswap = opc & MO_BSWAP;
-+    MemOp bswap = opc & MO_BSWAP;
-     switch (opc & MO_SSIZE) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, TCGMemOp opc,
-     }
- }
--static inline void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc,
-+static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
-                                           TCGReg datalo, TCGReg datahi,
-                                           TCGReg addrlo)
- {
--    TCGMemOp bswap = opc & MO_BSWAP;
-+    MemOp bswap = opc & MO_BSWAP;
-     switch (opc & MO_SSIZE) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
- {
-     TCGReg addrlo, datalo, datahi, addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #ifdef CONFIG_SOFTMMU
-     int mem_index;
-     TCGReg addend;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
- #endif
- }
--static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, TCGMemOp opc,
-+static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
-                                          TCGReg datalo, TCGReg datahi,
-                                          TCGReg addrlo, TCGReg addend)
- {
--    TCGMemOp bswap = opc & MO_BSWAP;
-+    MemOp bswap = opc & MO_BSWAP;
-     switch (opc & MO_SIZE) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, TCGMemOp opc,
-     }
- }
--static inline void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp opc,
-+static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
-                                           TCGReg datalo, TCGReg datahi,
-                                           TCGReg addrlo)
- {
--    TCGMemOp bswap = opc & MO_BSWAP;
-+    MemOp bswap = opc & MO_BSWAP;
-     switch (opc & MO_SIZE) {
-     case MO_8:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
- {
-     TCGReg addrlo, datalo, datahi, addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #ifdef CONFIG_SOFTMMU
-     int mem_index;
-     TCGReg addend;
-diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.inc.c
-+++ b/tcg/i386/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void * const qemu_st_helpers[16] = {
-    First argument register is clobbered.  */
- static inline void tcg_out_tlb_load(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
--                                    int mem_index, TCGMemOp opc,
-+                                    int mem_index, MemOp opc,
-                                     tcg_insn_unit **label_ptr, int which)
- {
-     const TCGReg r0 = TCG_REG_L0;
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
- static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     TCGReg data_reg;
-     tcg_insn_unit **label_ptr = &l->label_ptr[0];
-     int rexw = (l->type == TCG_TYPE_I64 ? P_REXW : 0);
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp s_bits = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp s_bits = opc & MO_SIZE;
-     tcg_insn_unit **label_ptr = &l->label_ptr[0];
-     TCGReg retaddr;
-@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
- static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                                    TCGReg base, int index, intptr_t ofs,
--                                   int seg, bool is64, TCGMemOp memop)
-+                                   int seg, bool is64, MemOp memop)
- {
--    const TCGMemOp real_bswap = memop & MO_BSWAP;
--    TCGMemOp bswap = real_bswap;
-+    const MemOp real_bswap = memop & MO_BSWAP;
-+    MemOp bswap = real_bswap;
-     int rexw = is64 * P_REXW;
-     int movop = OPC_MOVL_GvEv;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
-     TCGReg datalo, datahi, addrlo;
-     TCGReg addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     int mem_index;
-     tcg_insn_unit *label_ptr[2];
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
- static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                                    TCGReg base, int index, intptr_t ofs,
--                                   int seg, TCGMemOp memop)
-+                                   int seg, MemOp memop)
- {
-     /* ??? Ideally we wouldn't need a scratch register.  For user-only,
-        we could perform the bswap twice to restore the original value
-        instead of moving to the scratch.  But as it is, the L constraint
-        means that TCG_REG_L0 is definitely free here.  */
-     const TCGReg scratch = TCG_REG_L0;
--    const TCGMemOp real_bswap = memop & MO_BSWAP;
--    TCGMemOp bswap = real_bswap;
-+    const MemOp real_bswap = memop & MO_BSWAP;
-+    MemOp bswap = real_bswap;
-     int movop = OPC_MOVL_EvGv;
-     if (have_movbe && real_bswap) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
-     TCGReg datalo, datahi, addrlo;
-     TCGReg addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     int mem_index;
-     tcg_insn_unit *label_ptr[2];
-diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.inc.c
-+++ b/tcg/mips/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
-                              TCGReg addrh, TCGMemOpIdx oi,
-                              tcg_insn_unit *label_ptr[2], bool is_load)
- {
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     unsigned s_bits = opc & MO_SIZE;
-     unsigned a_bits = get_alignment_bits(opc);
-     int mem_index = get_mmuidx(oi);
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
- static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     TCGReg v0;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp s_bits = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp s_bits = opc & MO_SIZE;
-     int i;
-     /* resolve label address */
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- #endif
- static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
--                                   TCGReg base, TCGMemOp opc, bool is_64)
-+                                   TCGReg base, MemOp opc, bool is_64)
- {
-     switch (opc & (MO_SSIZE | MO_BSWAP)) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg addr_regl, addr_regh __attribute__((unused));
-     TCGReg data_regl, data_regh;
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     tcg_insn_unit *label_ptr[2];
- #endif
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
- }
- static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
--                                   TCGReg base, TCGMemOp opc)
-+                                   TCGReg base, MemOp opc)
- {
-     /* Don't clutter the code below with checks to avoid bswapping ZERO.  */
-     if ((lo | hi) == 0) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg addr_regl, addr_regh __attribute__((unused));
-     TCGReg data_regl, data_regh;
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     tcg_insn_unit *label_ptr[2];
- #endif
-diff --git a/tcg/optimize.c b/tcg/optimize.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/optimize.c
-+++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-         CASE_OP_32_64(qemu_ld):
-             {
-                 TCGMemOpIdx oi = op->args[nb_oargs + nb_iargs];
--                TCGMemOp mop = get_memop(oi);
-+                MemOp mop = get_memop(oi);
-                 if (!(mop & MO_SIGN)) {
-                     mask = (2ULL << ((8 << (mop & MO_SIZE)) - 1)) - 1;
-                 }
-diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.inc.c
-+++ b/tcg/ppc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -32768);
-    in CR7, loads the addend of the TLB into R3, and returns the register
-    containing the guest address (zero-extended into R4).  Clobbers R0 and R2. */
--static TCGReg tcg_out_tlb_read(TCGContext *s, TCGMemOp opc,
-+static TCGReg tcg_out_tlb_read(TCGContext *s, MemOp opc,
-                                TCGReg addrlo, TCGReg addrhi,
-                                int mem_index, bool is_read)
- {
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
- static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     TCGReg hi, lo, arg = TCG_REG_R3;
-     if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
- {
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp s_bits = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp s_bits = opc & MO_SIZE;
-     TCGReg hi, lo, arg = TCG_REG_R3;
-     if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg datalo, datahi, addrlo, rbase;
-     TCGReg addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc, s_bits;
-+    MemOp opc, s_bits;
- #ifdef CONFIG_SOFTMMU
-     int mem_index;
-     tcg_insn_unit *label_ptr;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg datalo, datahi, addrlo, rbase;
-     TCGReg addrhi __attribute__((unused));
-     TCGMemOpIdx oi;
--    TCGMemOp opc, s_bits;
-+    MemOp opc, s_bits;
- #ifdef CONFIG_SOFTMMU
-     int mem_index;
-     tcg_insn_unit *label_ptr;
-diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.inc.c
-+++ b/tcg/riscv/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
-                              TCGReg addrh, TCGMemOpIdx oi,
-                              tcg_insn_unit **label_ptr, bool is_load)
- {
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     unsigned s_bits = opc & MO_SIZE;
-     unsigned a_bits = get_alignment_bits(opc);
-     tcg_target_long compare_mask;
-@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
- static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     TCGReg a0 = tcg_target_call_iarg_regs[0];
-     TCGReg a1 = tcg_target_call_iarg_regs[1];
-     TCGReg a2 = tcg_target_call_iarg_regs[2];
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- {
-     TCGMemOpIdx oi = l->oi;
--    TCGMemOp opc = get_memop(oi);
--    TCGMemOp s_bits = opc & MO_SIZE;
-+    MemOp opc = get_memop(oi);
-+    MemOp s_bits = opc & MO_SIZE;
-     TCGReg a0 = tcg_target_call_iarg_regs[0];
-     TCGReg a1 = tcg_target_call_iarg_regs[1];
-     TCGReg a2 = tcg_target_call_iarg_regs[2];
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
- #endif /* CONFIG_SOFTMMU */
- static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
--                                   TCGReg base, TCGMemOp opc, bool is_64)
-+                                   TCGReg base, MemOp opc, bool is_64)
- {
--    const TCGMemOp bswap = opc & MO_BSWAP;
-+    const MemOp bswap = opc & MO_BSWAP;
-     /* We don't yet handle byteswapping, assert */
-     g_assert(!bswap);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg addr_regl, addr_regh __attribute__((unused));
-     TCGReg data_regl, data_regh;
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     tcg_insn_unit *label_ptr[1];
- #endif
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
- }
- static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
--                                   TCGReg base, TCGMemOp opc)
-+                                   TCGReg base, MemOp opc)
- {
--    const TCGMemOp bswap = opc & MO_BSWAP;
-+    const MemOp bswap = opc & MO_BSWAP;
-     /* We don't yet handle byteswapping, assert */
-     g_assert(!bswap);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
-     TCGReg addr_regl, addr_regh __attribute__((unused));
-     TCGReg data_regl, data_regh;
-     TCGMemOpIdx oi;
--    TCGMemOp opc;
-+    MemOp opc;
- #if defined(CONFIG_SOFTMMU)
-     tcg_insn_unit *label_ptr[1];
- #endif
-diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.inc.c
-+++ b/tcg/s390/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *dest)
-     }
- }
--static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
-+static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
-                                    TCGReg base, TCGReg index, int disp)
- {
-     switch (opc & (MO_SSIZE | MO_BSWAP)) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
-     }
- }
--static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
-+static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
-                                    TCGReg base, TCGReg index, int disp)
- {
-     switch (opc & (MO_SIZE | MO_BSWAP)) {
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 19));
- /* Load and compare a TLB entry, leaving the flags set.  Loads the TLB
-    addend into R2.  Returns a register with the santitized guest address.  */
--static TCGReg tcg_out_tlb_read(TCGContext* s, TCGReg addr_reg, TCGMemOp opc,
-+static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
-                                int mem_index, bool is_ld)
- {
-     unsigned s_bits = opc & MO_SIZE;
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                      (intptr_t)s->code_ptr, 2)) {
-@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-     TCGReg addr_reg = lb->addrlo_reg;
-     TCGReg data_reg = lb->datalo_reg;
-     TCGMemOpIdx oi = lb->oi;
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
-     if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
-                      (intptr_t)s->code_ptr, 2)) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
- static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
-                             TCGMemOpIdx oi)
- {
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
- #ifdef CONFIG_SOFTMMU
-     unsigned mem_index = get_mmuidx(oi);
-     tcg_insn_unit *label_ptr;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
- static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
-                             TCGMemOpIdx oi)
- {
--    TCGMemOp opc = get_memop(oi);
-+    MemOp opc = get_memop(oi);
- #ifdef CONFIG_SOFTMMU
-     unsigned mem_index = get_mmuidx(oi);
-     tcg_insn_unit *label_ptr;
-diff --git a/tcg/sparc/tcg-target.inc.c b/tcg/sparc/tcg-target.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/sparc/tcg-target.inc.c
-+++ b/tcg/sparc/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 12));
-    is in the returned register, maybe %o0.  The TLB addend is in %o1.  */
- static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
--                               TCGMemOp opc, int which)
-+                               MemOp opc, int which)
- {
-     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
-     int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
-@@ -XXX,XX +XXX,XX @@ static const int qemu_st_opc[16] = {
- static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
-                             TCGMemOpIdx oi, bool is_64)
- {
--    TCGMemOp memop = get_memop(oi);
-+    MemOp memop = get_memop(oi);
- #ifdef CONFIG_SOFTMMU
-     unsigned memi = get_mmuidx(oi);
-     TCGReg addrz, param;
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
- static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
-                             TCGMemOpIdx oi)
- {
--    TCGMemOp memop = get_memop(oi);
-+    MemOp memop = get_memop(oi);
- #ifdef CONFIG_SOFTMMU
-     unsigned memi = get_mmuidx(oi);
-     TCGReg addrz, param;
-diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op.c
-+++ b/tcg/tcg-op.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_lookup_and_goto_ptr(void)
-     }
- }
--static inline TCGMemOp tcg_canonicalize_memop(TCGMemOp op, bool is64, bool st)
-+static inline MemOp tcg_canonicalize_memop(MemOp op, bool is64, bool st)
- {
-     /* Trigger the asserts within as early as possible.  */
-     (void)get_alignment_bits(op);
-@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp tcg_canonicalize_memop(TCGMemOp op, bool is64, bool st)
- }
- static void gen_ldst_i32(TCGOpcode opc, TCGv_i32 val, TCGv addr,
--                         TCGMemOp memop, TCGArg idx)
-+                         MemOp memop, TCGArg idx)
- {
-     TCGMemOpIdx oi = make_memop_idx(memop, idx);
- #if TARGET_LONG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ static void gen_ldst_i32(TCGOpcode opc, TCGv_i32 val, TCGv addr,
- }
- static void gen_ldst_i64(TCGOpcode opc, TCGv_i64 val, TCGv addr,
--                         TCGMemOp memop, TCGArg idx)
-+                         MemOp memop, TCGArg idx)
- {
-     TCGMemOpIdx oi = make_memop_idx(memop, idx);
- #if TARGET_LONG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ static void tcg_gen_req_mo(TCGBar type)
-     }
- }
--void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-+void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
- {
--    TCGMemOp orig_memop;
-+    MemOp orig_memop;
-     tcg_gen_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
-     memop = tcg_canonicalize_memop(memop, 0, 0);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-     }
- }
--void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-+void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
- {
-     TCGv_i32 swap = NULL;
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-     }
- }
--void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-+void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
- {
--    TCGMemOp orig_memop;
-+    MemOp orig_memop;
-     if (TCG_TARGET_REG_BITS == 32 && (memop & MO_SIZE) < MO_64) {
-         tcg_gen_qemu_ld_i32(TCGV_LOW(val), addr, idx, memop);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-     }
- }
--void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-+void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
- {
-     TCGv_i64 swap = NULL;
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
-     }
- }
--static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, TCGMemOp opc)
-+static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, MemOp opc)
- {
-     switch (opc & MO_SSIZE) {
-     case MO_SB:
-@@ -XXX,XX +XXX,XX @@ static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, TCGMemOp opc)
-     }
- }
--static void tcg_gen_ext_i64(TCGv_i64 ret, TCGv_i64 val, TCGMemOp opc)
-+static void tcg_gen_ext_i64(TCGv_i64 ret, TCGv_i64 val, MemOp opc)
- {
-     switch (opc & MO_SSIZE) {
-     case MO_SB:
-@@ -XXX,XX +XXX,XX @@ static void * const table_cmpxchg[16] = {
- };
- void tcg_gen_atomic_cmpxchg_i32(TCGv_i32 retv, TCGv addr, TCGv_i32 cmpv,
--                                TCGv_i32 newv, TCGArg idx, TCGMemOp memop)
-+                                TCGv_i32 newv, TCGArg idx, MemOp memop)
- {
-     memop = tcg_canonicalize_memop(memop, 0, 0);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i32(TCGv_i32 retv, TCGv addr, TCGv_i32 cmpv,
- }
- void tcg_gen_atomic_cmpxchg_i64(TCGv_i64 retv, TCGv addr, TCGv_i64 cmpv,
--                                TCGv_i64 newv, TCGArg idx, TCGMemOp memop)
-+                                TCGv_i64 newv, TCGArg idx, MemOp memop)
- {
-     memop = tcg_canonicalize_memop(memop, 1, 0);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i64(TCGv_i64 retv, TCGv addr, TCGv_i64 cmpv,
- }
- static void do_nonatomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
--                                TCGArg idx, TCGMemOp memop, bool new_val,
-+                                TCGArg idx, MemOp memop, bool new_val,
-                                 void (*gen)(TCGv_i32, TCGv_i32, TCGv_i32))
- {
-     TCGv_i32 t1 = tcg_temp_new_i32();
-@@ -XXX,XX +XXX,XX @@ static void do_nonatomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
- }
- static void do_atomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
--                             TCGArg idx, TCGMemOp memop, void * const table[])
-+                             TCGArg idx, MemOp memop, void * const table[])
- {
-     gen_atomic_op_i32 gen;
-@@ -XXX,XX +XXX,XX @@ static void do_atomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
- }
- static void do_nonatomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
--                                TCGArg idx, TCGMemOp memop, bool new_val,
-+                                TCGArg idx, MemOp memop, bool new_val,
-                                 void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64))
- {
-     TCGv_i64 t1 = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void do_nonatomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
- }
- static void do_atomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
--                             TCGArg idx, TCGMemOp memop, void * const table[])
-+                             TCGArg idx, MemOp memop, void * const table[])
- {
-     memop = tcg_canonicalize_memop(memop, 1, 0);
-@@ -XXX,XX +XXX,XX @@ static void * const table_##NAME[16] = {                                \
-     WITH_ATOMIC64([MO_64 | MO_BE] = gen_helper_atomic_##NAME##q_be)     \
- };                                                                      \
- void tcg_gen_atomic_##NAME##_i32                                        \
--    (TCGv_i32 ret, TCGv addr, TCGv_i32 val, TCGArg idx, TCGMemOp memop) \
-+    (TCGv_i32 ret, TCGv addr, TCGv_i32 val, TCGArg idx, MemOp memop)    \
- {                                                                       \
-     if (tcg_ctx->tb_cflags & CF_PARALLEL) {                             \
-         do_atomic_op_i32(ret, addr, val, idx, memop, table_##NAME);     \
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_##NAME##_i32                                        \
-     }                                                                   \
- }                                                                       \
- void tcg_gen_atomic_##NAME##_i64                                        \
--    (TCGv_i64 ret, TCGv addr, TCGv_i64 val, TCGArg idx, TCGMemOp memop) \
-+    (TCGv_i64 ret, TCGv addr, TCGv_i64 val, TCGArg idx, MemOp memop)    \
- {                                                                       \
-     if (tcg_ctx->tb_cflags & CF_PARALLEL) {                             \
-         do_atomic_op_i64(ret, addr, val, idx, memop, table_##NAME);     \
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
-             case INDEX_op_qemu_st_i64:
-                 {
-                     TCGMemOpIdx oi = op->args[k++];
--                    TCGMemOp op = get_memop(oi);
-+                    MemOp op = get_memop(oi);
-                     unsigned ix = get_mmuidx(oi);
-                     if (op & ~(MO_AMASK | MO_BSWAP | MO_SSIZE)) {
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ M: Paolo Bonzini <pbonzini@redhat.com>
- S: Supported
- F: include/exec/ioport.h
- F: ioport.c
-+F: include/exec/memop.h
- F: include/exec/memory.h
- F: include/exec/ram_addr.h
- F: memory.c
-diff --git a/tcg/README b/tcg/README
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/README
-+++ b/tcg/README
-@@ -XXX,XX +XXX,XX @@ Both t0 and t1 may be split into little-endian ordered pairs of registers
- if dealing with 64-bit quantities on a 32-bit host.
- The memidx selects the qemu tlb index to use (e.g. user or kernel access).
--The flags are the TCGMemOp bits, selecting the sign, width, and endianness
-+The flags are the MemOp bits, selecting the sign, width, and endianness
- of the memory access.
- For a 32-bit host, qemu_ld/st_i64 is guaranteed to only be used with a
---
-.17.1

-[Qemu-devel] [PATCH 02/36] memory: Introduce size_memop
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Introduce no-op size_memop to aid preparatory conversion of
-interfaces.
-Once interfaces are converted, size_memop will be implemented to
-return a MemOp from size in bytes.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <35b8ee74020f67cf40848fb7d5f127cf96c851d6.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/memop.h | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/include/exec/memop.h b/include/exec/memop.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memop.h
-+++ b/include/exec/memop.h
-@@ -XXX,XX +XXX,XX @@ typedef enum MemOp {
-     MO_SSIZE = MO_SIZE | MO_SIGN,
- } MemOp;
-+/* Size in bytes to MemOp.  */
-+static inline unsigned size_memop(unsigned size)
-+{
-+    /*
-+     * FIXME: No-op to aid conversion of memory_region_dispatch_{read|write}
-+     * "unsigned size" operand into a "MemOp op".
-+     */
-+    return size;
-+}
-+
- #endif
---
-.17.1

-[Qemu-devel] [PATCH 03/36] target/mips: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Message-Id: <af407f0a34dc95ef5aaf2c00dffda7c65df23c3a.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/mips/op_helper.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/op_helper.c
-+++ b/target/mips/op_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/helper-proto.h"
- #include "exec/exec-all.h"
- #include "exec/cpu_ldst.h"
-+#include "exec/memop.h"
- #include "sysemu/kvm.h"
- #include "fpu/softfloat.h"
-@@ -XXX,XX +XXX,XX @@ void helper_cache(CPUMIPSState *env, target_ulong addr, uint32_t op)
-     if (op == 9) {
-         /* Index Store Tag */
-         memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
--                                     8, MEMTXATTRS_UNSPECIFIED);
-+                                     size_memop(8), MEMTXATTRS_UNSPECIFIED);
-     } else if (op == 5) {
-         /* Index Load Tag */
-         memory_region_dispatch_read(env->itc_tag, index, &env->CP0_TagLo,
--                                    8, MEMTXATTRS_UNSPECIFIED);
-+                                    size_memop(8), MEMTXATTRS_UNSPECIFIED);
-     }
- #endif
- }
---
-.17.1

-[Qemu-devel] [PATCH 04/36] hw/s390x: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <2f41da26201fb9b0339c2b7fde34df864f7f9ea8.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- hw/s390x/s390-pci-inst.c | 8 +++++---
-file changed, 5 insertions(+), 3 deletions(-)
-diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/s390x/s390-pci-inst.c
-+++ b/hw/s390x/s390-pci-inst.c
-@@ -XXX,XX +XXX,XX @@
- #include "cpu.h"
- #include "s390-pci-inst.h"
- #include "s390-pci-bus.h"
-+#include "exec/memop.h"
- #include "exec/memory-internal.h"
- #include "qemu/error-report.h"
- #include "sysemu/hw_accel.h"
-@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
-     mr = pbdev->pdev->io_regions[pcias].memory;
-     mr = s390_get_subregion(mr, offset, len);
-     offset -= mr->addr;
--    return memory_region_dispatch_read(mr, offset, data, len,
-+    return memory_region_dispatch_read(mr, offset, data, size_memop(len),
-                                        MEMTXATTRS_UNSPECIFIED);
- }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
-     mr = pbdev->pdev->io_regions[pcias].memory;
-     mr = s390_get_subregion(mr, offset, len);
-     offset -= mr->addr;
--    return memory_region_dispatch_write(mr, offset, data, len,
-+    return memory_region_dispatch_write(mr, offset, data, size_memop(len),
-                                         MEMTXATTRS_UNSPECIFIED);
- }
-@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
-     for (i = 0; i < len / 8; i++) {
-         result = memory_region_dispatch_write(mr, offset + i * 8,
--                                              ldq_p(buffer + i * 8), 8,
-+                                              ldq_p(buffer + i * 8),
-+                                              size_memop(8),
-                                               MEMTXATTRS_UNSPECIFIED);
-         if (result != MEMTX_OK) {
-             s390_program_interrupt(env, PGM_OPERAND, 6, ra);
---
-.17.1

-[Qemu-devel] [PATCH 05/36] hw/intc/armv7m_nic: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <21113bae2f54b45176701e0bf595937031368ae6.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- hw/intc/armv7m_nvic.c | 12 ++++++++----
-file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/qdev-properties.h"
- #include "target/arm/cpu.h"
- #include "exec/exec-all.h"
-+#include "exec/memop.h"
- #include "qemu/log.h"
- #include "qemu/module.h"
- #include "trace.h"
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
-     if (attrs.secure) {
-         /* S accesses to the alias act like NS accesses to the real region */
-         attrs.secure = 0;
--        return memory_region_dispatch_write(mr, addr, value, size, attrs);
-+        return memory_region_dispatch_write(mr, addr, value, size_memop(size),
-+                                            attrs);
-     } else {
-         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
-         if (attrs.user) {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
-     if (attrs.secure) {
-         /* S accesses to the alias act like NS accesses to the real region */
-         attrs.secure = 0;
--        return memory_region_dispatch_read(mr, addr, data, size, attrs);
-+        return memory_region_dispatch_read(mr, addr, data, size_memop(size),
-+                                           attrs);
-     } else {
-         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
-         if (attrs.user) {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
-     /* Direct the access to the correct systick */
-     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
--    return memory_region_dispatch_write(mr, addr, value, size, attrs);
-+    return memory_region_dispatch_write(mr, addr, value, size_memop(size),
-+                                        attrs);
- }
- static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
-     /* Direct the access to the correct systick */
-     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
--    return memory_region_dispatch_read(mr, addr, data, size, attrs);
-+    return memory_region_dispatch_read(mr, addr, data, size_memop(size), attrs);
- }
- static const MemoryRegionOps nvic_systick_ops = {
---
-.17.1

-[Qemu-devel] [PATCH 06/36] hw/virtio: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <ebf1f78029d5ac1de1739a11d679740a87a1f02f.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- hw/virtio/virtio-pci.c | 7 +++++--
-file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-pci.c
-+++ b/hw/virtio/virtio-pci.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
-+#include "exec/memop.h"
- #include "standard-headers/linux/virtio_pci.h"
- #include "hw/virtio/virtio.h"
- #include "migration/qemu-file-types.h"
-@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
-         /* As length is under guest control, handle illegal values. */
-         return;
-     }
--    memory_region_dispatch_write(mr, addr, val, len, MEMTXATTRS_UNSPECIFIED);
-+    memory_region_dispatch_write(mr, addr, val, size_memop(len),
-+                                 MEMTXATTRS_UNSPECIFIED);
- }
- static void
-@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
-     /* Make sure caller aligned buf properly */
-     assert(!(((uintptr_t)buf) & (len - 1)));
--    memory_region_dispatch_read(mr, addr, &val, len, MEMTXATTRS_UNSPECIFIED);
-+    memory_region_dispatch_read(mr, addr, &val, size_memop(len),
-+                                MEMTXATTRS_UNSPECIFIED);
-     switch (len) {
-     case 1:
-         pci_set_byte(buf, val);
---
-.17.1

-[Qemu-devel] [PATCH 07/36] hw/vfio: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <e70ff5814ac3656974180db6375397c43b0bc8b8.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- hw/vfio/pci-quirks.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/vfio/pci-quirks.c
-+++ b/hw/vfio/pci-quirks.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "exec/memop.h"
- #include "qemu/units.h"
- #include "qemu/error-report.h"
- #include "qemu/main-loop.h"
-@@ -XXX,XX +XXX,XX @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
-                 /* Write to the proper guest MSI-X table instead */
-                 memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
--                                             offset, val, size,
-+                                             offset, val, size_memop(size),
-                                              MEMTXATTRS_UNSPECIFIED);
-             }
-             return; /* Do not write guest MSI-X data to hardware */
-@@ -XXX,XX +XXX,XX @@ static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
-     if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
-         hwaddr offset = rtl->addr & 0xfff;
-         memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
--                                    &data, size, MEMTXATTRS_UNSPECIFIED);
-+                                    &data, size_memop(size),
-+                                    MEMTXATTRS_UNSPECIFIED);
-         trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
-     }
---
-.17.1

-[Qemu-devel] [PATCH 08/36] exec: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <3b042deef0a60dd49ae2320ece92120ba6027f2b.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- exec.c            |  6 ++++--
- memory_ldst.inc.c | 18 +++++++++---------
-files changed, 13 insertions(+), 11 deletions(-)
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
-             /* XXX: could force current_cpu to NULL to avoid
-                potential bugs */
-             val = ldn_p(buf, l);
--            result |= memory_region_dispatch_write(mr, addr1, val, l, attrs);
-+            result |= memory_region_dispatch_write(mr, addr1, val,
-+                                                   size_memop(l), attrs);
-         } else {
-             /* RAM case */
-             ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
-@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
-             /* I/O case */
-             release_lock |= prepare_mmio_access(mr);
-             l = memory_access_size(mr, l, addr1);
--            result |= memory_region_dispatch_read(mr, addr1, &val, l, attrs);
-+            result |= memory_region_dispatch_read(mr, addr1, &val,
-+                                                  size_memop(l), attrs);
-             stn_p(buf, l, val);
-         } else {
-             /* RAM case */
-diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/memory_ldst.inc.c
-+++ b/memory_ldst.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, 4, attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(4), attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap32(val);
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, 8, attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(8), attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap64(val);
-@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, 1, attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(1), attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, 2, attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(2), attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap16(val);
-@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
-     if (l < 4 || !memory_access_is_direct(mr, true)) {
-         release_lock |= prepare_mmio_access(mr);
--        r = memory_region_dispatch_write(mr, addr1, val, 4, attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
-     } else {
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-         stl_p(ptr, val);
-@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
-             val = bswap32(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, 4, attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
-     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
-     if (!memory_access_is_direct(mr, true)) {
-         release_lock |= prepare_mmio_access(mr);
--        r = memory_region_dispatch_write(mr, addr1, val, 1, attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(1), attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
-             val = bswap16(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, 2, attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(2), attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
-             val = bswap64(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, 8, attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(8), attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
---
-.17.1

-[Qemu-devel] [PATCH 09/36] cputlb: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-The memory_region_dispatch_{read|write} operand "unsigned size" is
-being converted into a "MemOp op".
-Convert interfaces by using no-op size_memop.
-After all interfaces are converted, size_memop will be implemented
-and the memory_region_dispatch_{read|write} operand "unsigned size"
-will be converted into a "MemOp op".
-As size_memop is a no-op, this patch does not change any behaviour.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <c4571c76467ade83660970f7ef9d7292297f1908.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-         qemu_mutex_lock_iothread();
-         locked = true;
-     }
--    r = memory_region_dispatch_read(mr, mr_offset,
--                                    &val, size, iotlbentry->attrs);
-+    r = memory_region_dispatch_read(mr, mr_offset, &val, size_memop(size),
-+                                    iotlbentry->attrs);
-     if (r != MEMTX_OK) {
-         hwaddr physaddr = mr_offset +
-             section->offset_within_address_space -
-@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-         qemu_mutex_lock_iothread();
-         locked = true;
-     }
--    r = memory_region_dispatch_write(mr, mr_offset,
--                                     val, size, iotlbentry->attrs);
-+    r = memory_region_dispatch_write(mr, mr_offset, val, size_memop(size),
-+                                     iotlbentry->attrs);
-     if (r != MEMTX_OK) {
-         hwaddr physaddr = mr_offset +
-             section->offset_within_address_space -
---
-.17.1

-[Qemu-devel] [PATCH 10/36] memory: Access MemoryRegion with MemOp
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Convert memory_region_dispatch_{read|write} operand "unsigned size"
-into a "MemOp op".
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <1dd82df5801866743f838f1d046475115a1d32da.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/memop.h  | 22 +++++++++++++++-------
- include/exec/memory.h |  9 +++++----
- memory.c              |  7 +++++--
-files changed, 25 insertions(+), 13 deletions(-)
-diff --git a/include/exec/memop.h b/include/exec/memop.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memop.h
-+++ b/include/exec/memop.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef MEMOP_H
- #define MEMOP_H
-+#include "qemu/host-utils.h"
-+
- typedef enum MemOp {
-     MO_8     = 0,
-     MO_16    = 1,
-@@ -XXX,XX +XXX,XX @@ typedef enum MemOp {
-     MO_SSIZE = MO_SIZE | MO_SIGN,
- } MemOp;
--/* Size in bytes to MemOp.  */
--static inline unsigned size_memop(unsigned size)
-+/* MemOp to size in bytes.  */
-+static inline unsigned memop_size(MemOp op)
- {
--    /*
--     * FIXME: No-op to aid conversion of memory_region_dispatch_{read|write}
--     * "unsigned size" operand into a "MemOp op".
--     */
--    return size;
-+    return 1 << (op & MO_SIZE);
-+}
-+
-+/* Size in bytes to MemOp.  */
-+static inline MemOp size_memop(unsigned size)
-+{
-+#ifdef CONFIG_DEBUG_TCG
-+    /* Power of 2 up to 8.  */
-+    assert((size & (size - 1)) == 0 && size >= 1 && size <= 8);
-+#endif
-+    return ctz32(size);
- }
- #endif
-diff --git a/include/exec/memory.h b/include/exec/memory.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memory.h
-+++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@
- #include "exec/cpu-common.h"
- #include "exec/hwaddr.h"
- #include "exec/memattrs.h"
-+#include "exec/memop.h"
- #include "exec/ramlist.h"
- #include "qemu/bswap.h"
- #include "qemu/queue.h"
-@@ -XXX,XX +XXX,XX @@ void mtree_info(bool flatview, bool dispatch_tree, bool owner);
-  * @mr: #MemoryRegion to access
-  * @addr: address within that region
-  * @pval: pointer to uint64_t which the data is written to
-- * @size: size of the access in bytes
-+ * @op: size, sign, and endianness of the memory operation
-  * @attrs: memory transaction attributes to use for the access
-  */
- MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
-                                         hwaddr addr,
-                                         uint64_t *pval,
--                                        unsigned size,
-+                                        MemOp op,
-                                         MemTxAttrs attrs);
- /**
-  * memory_region_dispatch_write: perform a write directly to the specified
-@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
-  * @mr: #MemoryRegion to access
-  * @addr: address within that region
-  * @data: data to write
-- * @size: size of the access in bytes
-+ * @op: size, sign, and endianness of the memory operation
-  * @attrs: memory transaction attributes to use for the access
-  */
- MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
-                                          hwaddr addr,
-                                          uint64_t data,
--                                         unsigned size,
-+                                         MemOp op,
-                                          MemTxAttrs attrs);
- /**
-diff --git a/memory.c b/memory.c
-index XXXXXXX..XXXXXXX 100644
---- a/memory.c
-+++ b/memory.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_dispatch_read1(MemoryRegion *mr,
- MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
-                                         hwaddr addr,
-                                         uint64_t *pval,
--                                        unsigned size,
-+                                        MemOp op,
-                                         MemTxAttrs attrs)
- {
-+    unsigned size = memop_size(op);
-     MemTxResult r;
-     if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
-@@ -XXX,XX +XXX,XX @@ static bool memory_region_dispatch_write_eventfds(MemoryRegion *mr,
- MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
-                                          hwaddr addr,
-                                          uint64_t data,
--                                         unsigned size,
-+                                         MemOp op,
-                                          MemTxAttrs attrs)
- {
-+    unsigned size = memop_size(op);
-+
-     if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
-         unassigned_mem_write(mr, addr, data, size);
-         return MEMTX_DECODE_ERROR;
---
-.17.1

-[Qemu-devel] [PATCH 11/36] hw/s390x: Hard code size with MO_{8|16|32|64}
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Temporarily no-op size_memop was introduced to aid the conversion of
-memory_region_dispatch_{read|write} operand "unsigned size" into
-"MemOp op".
-Now size_memop is implemented, again hard coded size but with
-MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <76dc97273a8eb5e10170ffc16526863df808f487.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- hw/s390x/s390-pci-inst.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/s390x/s390-pci-inst.c
-+++ b/hw/s390x/s390-pci-inst.c
-@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
-     for (i = 0; i < len / 8; i++) {
-         result = memory_region_dispatch_write(mr, offset + i * 8,
-                                               ldq_p(buffer + i * 8),
--                                              size_memop(8),
--                                              MEMTXATTRS_UNSPECIFIED);
-+                                              MO_64, MEMTXATTRS_UNSPECIFIED);
-         if (result != MEMTX_OK) {
-             s390_program_interrupt(env, PGM_OPERAND, 6, ra);
-             return 0;
---
-.17.1

-[Qemu-devel] [PATCH 12/36] target/mips: Hard code size with MO_{8|16|32|64}
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Temporarily no-op size_memop was introduced to aid the conversion of
-memory_region_dispatch_{read|write} operand "unsigned size" into
-"MemOp op".
-Now size_memop is implemented, again hard coded size but with
-MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Message-Id: <99c4459d5c1dc9013820be3dbda9798165c15b99.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/mips/op_helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/op_helper.c
-+++ b/target/mips/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void helper_cache(CPUMIPSState *env, target_ulong addr, uint32_t op)
-     if (op == 9) {
-         /* Index Store Tag */
-         memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
--                                     size_memop(8), MEMTXATTRS_UNSPECIFIED);
-+                                     MO_64, MEMTXATTRS_UNSPECIFIED);
-     } else if (op == 5) {
-         /* Index Load Tag */
-         memory_region_dispatch_read(env->itc_tag, index, &env->CP0_TagLo,
--                                    size_memop(8), MEMTXATTRS_UNSPECIFIED);
-+                                    MO_64, MEMTXATTRS_UNSPECIFIED);
-     }
- #endif
- }
---
-.17.1

-[Qemu-devel] [PATCH 13/36] exec: Hard code size with MO_{8|16|32|64}
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Temporarily no-op size_memop was introduced to aid the conversion of
-memory_region_dispatch_{read|write} operand "unsigned size" into
-"MemOp op".
-Now size_memop is implemented, again hard coded size but with
-MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <99f69701cad294db638f84abebc58115e1b9de9a.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- memory_ldst.inc.c | 18 +++++++++---------
-file changed, 9 insertions(+), 9 deletions(-)
-diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/memory_ldst.inc.c
-+++ b/memory_ldst.inc.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(4), attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, MO_32, attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap32(val);
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(8), attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, MO_64, attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap64(val);
-@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(1), attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, MO_8, attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
-         release_lock |= prepare_mmio_access(mr);
-         /* I/O case */
--        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(2), attrs);
-+        r = memory_region_dispatch_read(mr, addr1, &val, MO_16, attrs);
- #if defined(TARGET_WORDS_BIGENDIAN)
-         if (endian == DEVICE_LITTLE_ENDIAN) {
-             val = bswap16(val);
-@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
-     if (l < 4 || !memory_access_is_direct(mr, true)) {
-         release_lock |= prepare_mmio_access(mr);
--        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
-     } else {
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-         stl_p(ptr, val);
-@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
-             val = bswap32(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
-     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
-     if (!memory_access_is_direct(mr, true)) {
-         release_lock |= prepare_mmio_access(mr);
--        r = memory_region_dispatch_write(mr, addr1, val, size_memop(1), attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, MO_8, attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
-             val = bswap16(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, size_memop(2), attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, MO_16, attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
-             val = bswap64(val);
-         }
- #endif
--        r = memory_region_dispatch_write(mr, addr1, val, size_memop(8), attrs);
-+        r = memory_region_dispatch_write(mr, addr1, val, MO_64, attrs);
-     } else {
-         /* RAM case */
-         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
---
-.17.1

-[Qemu-devel] [PATCH 19/36] target/sparc: sun4u Invert Endian TTE bit
+[PULL v2 1/8] accel/tcg: Allow the second page of an instruction to be MMIO
-From: Tony Nguyen <tony.nguyen@bt.com>
+If an instruction straddles a page boundary, and the first page
 was ram, but the second page was MMIO, we would abort.  Handle
 this as if both pages are MMIO, by setting the ram_addr_t for
 the first page to -1.
-This bit configures endianness of PCI MMIO devices. It is used by
+Reported-by: Sid Manning <sidneym@quicinc.com>
-Solaris and OpenBSD sunhme drivers.
+Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested working on OpenBSD.
 Unfortunately Solaris 10 had a unrelated keyboard issue blocking
 testing... another inch towards Solaris 10 on SPARC64 =)
 Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 Message-Id: <3c8d5181a584f1b3712d3d8d66801b13cecb4b88.1566466906.git.tony.nguyen@bt.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/sparc/cpu.h        | 2 ++
+ accel/tcg/translator.c | 12 ++++++++++--
- target/sparc/mmu_helper.c | 8 +++++++-
+file changed, 10 insertions(+), 2 deletions(-)
 files changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.h
+--- a/accel/tcg/translator.c
-+++ b/target/sparc/cpu.h
++++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
+         if (host == NULL) {
- #define TTE_VALID_BIT       (1ULL << 63)
+             tb_page_addr_t phys_page =
- #define TTE_NFO_BIT         (1ULL << 60)
+                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-+#define TTE_IE_BIT          (1ULL << 59)
+-            /* We cannot handle MMIO as second page. */
- #define TTE_USED_BIT        (1ULL << 41)
+-            assert(phys_page != -1);
- #define TTE_LOCKED_BIT      (1ULL <<  6)
++
- #define TTE_SIDEEFFECT_BIT  (1ULL <<  3)
++            /*
-@@ -XXX,XX +XXX,XX @@ enum {
++             * If the second page is MMIO, treat as if the first page
++             * was MMIO as well, so that we do not cache the TB.
- #define TTE_IS_VALID(tte)   ((tte) & TTE_VALID_BIT)
++             */
- #define TTE_IS_NFO(tte)     ((tte) & TTE_NFO_BIT)
++            if (unlikely(phys_page == -1)) {
-+#define TTE_IS_IE(tte)      ((tte) & TTE_IE_BIT)
++                tb_set_page_addr0(tb, -1);
- #define TTE_IS_USED(tte)    ((tte) & TTE_USED_BIT)
++                return NULL;
  #define TTE_IS_LOCKED(tte)  ((tte) & TTE_LOCKED_BIT)
  #define TTE_IS_SIDEEFFECT(tte) ((tte) & TTE_SIDEEFFECT_BIT)
 diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/mmu_helper.c
 +++ b/target/sparc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_data(CPUSPARCState *env, hwaddr *physical,
          if (ultrasparc_tag_match(&env->dtlb[i], address, context, physical)) {
              int do_fault = 0;
 +            if (TTE_IS_IE(env->dtlb[i].tte)) {
 +                attrs->byte_swap = true;
 +            }
 +
-             /* access ok? */
+             tb_set_page_addr1(tb, phys_page);
-             /* multiple bits in SFSR.FT may be set on TT_DFAULT */
+ #ifdef CONFIG_USER_ONLY
-             if (TTE_IS_PRIV(env->dtlb[i].tte) && is_user) {
+             page_protect(end);
@@ -XXX,XX +XXX,XX @@ void dump_mmu(CPUSPARCState *env)
              }
              if (TTE_IS_VALID(env->dtlb[i].tte)) {
                  qemu_printf("[%02u] VA: %" PRIx64 ", PA: %llx"
 -                            ", %s, %s, %s, %s, ctx %" PRId64 " %s\n",
 +                            ", %s, %s, %s, %s, ie %s, ctx %" PRId64 " %s\n",
                              i,
                              env->dtlb[i].tag & (uint64_t)~0x1fffULL,
                              TTE_PA(env->dtlb[i].tte),
@@ -XXX,XX +XXX,XX @@ void dump_mmu(CPUSPARCState *env)
                              TTE_IS_W_OK(env->dtlb[i].tte) ? "RW" : "RO",
                              TTE_IS_LOCKED(env->dtlb[i].tte) ?
                              "locked" : "unlocked",
 +                            TTE_IS_IE(env->dtlb[i].tte) ?
 +                            "yes" : "no",
                              env->dtlb[i].tag & (uint64_t)0x1fffULL,
                              TTE_IS_GLOBAL(env->dtlb[i].tte) ?
                              "global" : "local");
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 16/36] memory: Single byte swap along the I/O path
+[PULL v2 2/8] linux-user/sparc: Raise SIGILL for all unhandled software traps
-From: Tony Nguyen <tony.nguyen@bt.com>
+The linux kernel's trap tables vector all unassigned trap
 numbers to BAD_TRAP, which then raises SIGILL.
-Now that MemOp has been pushed down into the memory API, and
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-callers are encoding endianness, we can collapse byte swaps
+Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
 along the I/O path into the accelerator and target independent
 adjust_endianness.
 Collapsing byte swaps along the I/O path enables additional endian
 inversion logic, e.g. SPARC64 Invert Endian TTE bit, with redundant
 byte swaps cancelling out.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
 Message-Id: <911ff31af11922a9afba9b7ce128af8b8b80f316.1566466906.git.tony.nguyen@bt.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c     | 42 ++--------------------------
+ linux-user/sparc/cpu_loop.c | 8 ++++++++
- exec.c                 | 17 +++---------
+file changed, 8 insertions(+)
  hw/virtio/virtio-pci.c | 10 +++----
  memory.c               | 33 ++++++++--------------
  memory_ldst.inc.c      | 63 ------------------------------------------
 files changed, 23 insertions(+), 142 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/linux-user/sparc/cpu_loop.c
-+++ b/accel/tcg/cputlb.c
++++ b/linux-user/sparc/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
-     cpu_loop_exit_atomic(env_cpu(env), retaddr);
+             cpu_exec_step_atomic(cs);
  }
 -#ifdef TARGET_WORDS_BIGENDIAN
 -#define NEED_BE_BSWAP 0
 -#define NEED_LE_BSWAP 1
 -#else
 -#define NEED_BE_BSWAP 1
 -#define NEED_LE_BSWAP 0
 -#endif
 -
 -/*
 - * Byte Swap Helper
 - *
 - * This should all dead code away depending on the build host and
 - * access type.
 - */
 -
 -static inline uint64_t handle_bswap(uint64_t val, MemOp op)
 -{
 -    if ((memop_big_endian(op) && NEED_BE_BSWAP) ||
 -        (!memop_big_endian(op) && NEED_LE_BSWAP)) {
 -        switch (op & MO_SIZE) {
 -        case MO_8: return val;
 -        case MO_16: return bswap16(val);
 -        case MO_32: return bswap32(val);
 -        case MO_64: return bswap64(val);
 -        default:
 -            g_assert_not_reached();
 -        }
 -    } else {
 -        return val;
 -    }
 -}
 -
  /*
   * Load Helpers
   *
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              }
          }
 -        /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
 -        res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
 -                       mmu_idx, addr, retaddr, access_type, op);
 -        return handle_bswap(res, op);
 +        return io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
 +                        mmu_idx, addr, retaddr, access_type, op);
      }
      /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              }
          }
 -        /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
          io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
 -                  handle_bswap(val, op),
 -                  addr, retaddr, op);
 +                  val, addr, retaddr, op);
          return;
      }
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
              l = memory_access_size(mr, l, addr1);
              /* XXX: could force current_cpu to NULL to avoid
                 potential bugs */
 -            val = ldn_p(buf, l);
 -            /*
 -             * TODO: Merge bswap from ldn_p into memory_region_dispatch_write
 -             * by using ldn_he_p and dropping MO_TE to get a host-endian value.
 -             */
 +            val = ldn_he_p(buf, l);
              result |= memory_region_dispatch_write(mr, addr1, val,
 -                                                   size_memop(l) | MO_TE,
 -                                                   attrs);
 +                                                   size_memop(l), attrs);
          } else {
              /* RAM case */
              ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
              /* I/O case */
              release_lock |= prepare_mmio_access(mr);
              l = memory_access_size(mr, l, addr1);
 -            /*
 -             * TODO: Merge bswap from stn_p into memory_region_dispatch_read
 -             * by using stn_he_p and dropping MO_TE to get a host-endian value.
 -             */
              result |= memory_region_dispatch_read(mr, addr1, &val,
 -                                                  size_memop(l) | MO_TE, attrs);
 -            stn_p(buf, l, val);
 +                                                  size_memop(l), attrs);
 +            stn_he_p(buf, l, val);
          } else {
              /* RAM case */
              ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
 diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/virtio-pci.c
 +++ b/hw/virtio/virtio-pci.c
@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
          val = pci_get_byte(buf);
          break;
      case 2:
 -        val = cpu_to_le16(pci_get_word(buf));
 +        val = pci_get_word(buf);
          break;
      case 4:
 -        val = cpu_to_le32(pci_get_long(buf));
 +        val = pci_get_long(buf);
          break;
      default:
          /* As length is under guest control, handle illegal values. */
          return;
      }
 -    /* TODO: Merge bswap from cpu_to_leXX into memory_region_dispatch_write.  */
      memory_region_dispatch_write(mr, addr, val, size_memop(len) | MO_LE,
                                   MEMTXATTRS_UNSPECIFIED);
  }
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
      /* Make sure caller aligned buf properly */
      assert(!(((uintptr_t)buf) & (len - 1)));
 -    /* TODO: Merge bswap from leXX_to_cpu into memory_region_dispatch_read.  */
      memory_region_dispatch_read(mr, addr, &val, size_memop(len) | MO_LE,
                                  MEMTXATTRS_UNSPECIFIED);
      switch (len) {
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
          pci_set_byte(buf, val);
          break;
      case 2:
 -        pci_set_word(buf, le16_to_cpu(val));
 +        pci_set_word(buf, val);
          break;
      case 4:
 -        pci_set_long(buf, le32_to_cpu(val));
 +        pci_set_long(buf, val);
          break;
      default:
          /* As length is under guest control, handle illegal values. */
 diff --git a/memory.c b/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory.c
 +++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static bool memory_region_big_endian(MemoryRegion *mr)
  #endif
  }
 -static bool memory_region_wrong_endianness(MemoryRegion *mr)
 +static void adjust_endianness(MemoryRegion *mr, uint64_t *data, MemOp op)
  {
 -#ifdef TARGET_WORDS_BIGENDIAN
 -    return mr->ops->endianness == DEVICE_LITTLE_ENDIAN;
 -#else
 -    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
 -#endif
 -}
 -
 -static void adjust_endianness(MemoryRegion *mr, uint64_t *data, unsigned size)
 -{
 -    if (memory_region_wrong_endianness(mr)) {
 -        switch (size) {
 -        case 1:
 +    if ((op & MO_BSWAP) != devend_memop(mr->ops->endianness)) {
 +        switch (op & MO_SIZE) {
 +        case MO_8:
              break;
 -        case 2:
 +        case MO_16:
              *data = bswap16(*data);
              break;
 -        case 4:
 +        case MO_32:
              *data = bswap32(*data);
              break;
 -        case 8:
 +        case MO_64:
              *data = bswap64(*data);
              break;
          default:
--            abort();
++            /*
-+            g_assert_not_reached();
++             * Most software trap numbers vector to BAD_TRAP.
-         }
++             * Handle anything not explicitly matched above.
-     }
++             */
- }
++            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
-@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
++                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
-     }
++                break;
++            }
-     r = memory_region_dispatch_read1(mr, addr, pval, size, attrs);
+             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
--    adjust_endianness(mr, pval, size);
+             cpu_dump_state(cs, stderr, 0);
-+    adjust_endianness(mr, pval, op);
+             exit(EXIT_FAILURE);
      return r;
  }
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
          return MEMTX_DECODE_ERROR;
      }
 -    adjust_endianness(mr, &data, size);
 +    adjust_endianness(mr, &data, op);
      if ((!kvm_eventfds_enabled()) &&
          memory_region_dispatch_write_eventfds(mr, addr, data, size, attrs)) {
@@ -XXX,XX +XXX,XX @@ void memory_region_add_eventfd(MemoryRegion *mr,
      }
      if (size) {
 -        adjust_endianness(mr, &mrfd.data, size);
 +        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
      }
      memory_region_transaction_begin();
      for (i = 0; i < mr->ioeventfd_nb; ++i) {
@@ -XXX,XX +XXX,XX @@ void memory_region_del_eventfd(MemoryRegion *mr,
      unsigned i;
      if (size) {
 -        adjust_endianness(mr, &mrfd.data, size);
 +        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
      }
      memory_region_transaction_begin();
      for (i = 0; i < mr->ioeventfd_nb; ++i) {
 diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory_ldst.inc.c
 +++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        /* TODO: Merge bswap32 into memory_region_dispatch_read.  */
          r = memory_region_dispatch_read(mr, addr1, &val,
                                          MO_32 | devend_memop(endian), attrs);
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap32(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap32(val);
 -        }
 -#endif
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        /* TODO: Merge bswap64 into memory_region_dispatch_read.  */
          r = memory_region_dispatch_read(mr, addr1, &val,
                                          MO_64 | devend_memop(endian), attrs);
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap64(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap64(val);
 -        }
 -#endif
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        /* TODO: Merge bswap16 into memory_region_dispatch_read.  */
          r = memory_region_dispatch_read(mr, addr1, &val,
                                          MO_16 | devend_memop(endian), attrs);
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap16(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap16(val);
 -        }
 -#endif
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
      mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 4 || !memory_access_is_direct(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
 -
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap32(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap32(val);
 -        }
 -#endif
 -        /* TODO: Merge bswap32 into memory_region_dispatch_write.  */
          r = memory_region_dispatch_write(mr, addr1, val,
                                           MO_32 | devend_memop(endian), attrs);
      } else {
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
      mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 2 || !memory_access_is_direct(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
 -
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap16(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap16(val);
 -        }
 -#endif
 -        /* TODO: Merge bswap16 into memory_region_dispatch_write.  */
          r = memory_region_dispatch_write(mr, addr1, val,
                                           MO_16 | devend_memop(endian), attrs);
      } else {
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
      mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 8 || !memory_access_is_direct(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
 -
 -#if defined(TARGET_WORDS_BIGENDIAN)
 -        if (endian == DEVICE_LITTLE_ENDIAN) {
 -            val = bswap64(val);
 -        }
 -#else
 -        if (endian == DEVICE_BIG_ENDIAN) {
 -            val = bswap64(val);
 -        }
 -#endif
 -        /* TODO: Merge bswap64 into memory_region_dispatch_write.  */
          r = memory_region_dispatch_write(mr, addr1, val,
                                           MO_64 | devend_memop(endian), attrs);
      } else {
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 33/36] hppa/tcg: Call probe_write() also for CONFIG_USER_ONLY
+[PULL v2 3/8] linux-user: Always exit from exclusive state in fork_end()
-From: David Hildenbrand <david@redhat.com>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-We now have a variant for CONFIG_USER_ONLY as well.
+fork()ed processes currently start with
 current_cpu->in_exclusive_context set, which is, strictly speaking, not
 correct, but does not cause problems (even assertion failures).
 With one of the next patches, the code begins to rely on this value, so
 fix it by always calling end_exclusive() in fork_end().
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20190826075112.25637-7-david@redhat.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/hppa/op_helper.c | 2 --
+ linux-user/main.c    | 10 ++++++----
-file changed, 2 deletions(-)
+ linux-user/syscall.c |  1 +
 files changed, 7 insertions(+), 4 deletions(-)
-diff --git a/target/hppa/op_helper.c b/target/hppa/op_helper.c
+diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/op_helper.c
+--- a/linux-user/main.c
-+++ b/target/hppa/op_helper.c
++++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ static void do_stby_e(CPUHPPAState *env, target_ulong addr, target_ureg val,
+@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
-     default:
+         }
-         /* Nothing is stored, but protection is checked and the
+         qemu_init_cpu_list();
-            cacheline is marked dirty.  */
+         gdbserver_fork(thread_cpu);
--#ifndef CONFIG_USER_ONLY
+-        /* qemu_init_cpu_list() takes care of reinitializing the
-         probe_write(env, addr, 0, cpu_mmu_index(env, 0), ra);
+-         * exclusive state, so we don't need to end_exclusive() here.
--#endif
+-         */
-         break;
+     } else {
          cpu_list_unlock();
 -        end_exclusive();
      }
++    /*
++     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
++     * also need to keep current_cpu consistent, so call end_exclusive() for
++     * both child and parent.
++     */
++    end_exclusive();
+ }
+ __thread CPUState *thread_cpu;
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
+             cpu_clone_regs_parent(env, flags);
+             fork_end(0);
+         }
++        g_assert(!cpu_in_exclusive_context(cpu));
+     }
+     return ret;
  }
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 20/36] exec: Move user-only watchpoint stubs inline
+[PULL v2 4/8] cpus: Make {start,end}_exclusive() recursive
-Let the user-only watchpoint stubs resolve to empty inline functions.
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Currently dying to one of the core_dump_signal()s deadlocks, because
-Reviewed-by: David Hildenbrand <david@redhat.com>
+dump_core_and_abort() calls start_exclusive() two times: first via
 stop_all_tasks(), and then via preexit_cleanup() ->
 qemu_plugin_user_exit().
 There are a number of ways to solve this: resume after dumping core;
 check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
 {start,end}_exclusive() recursive. Pick the last option, since it's
 the most straightforward one.
 Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 23 +++++++++++++++++++++++
+ include/hw/core/cpu.h |  4 ++--
- exec.c                | 26 ++------------------------
+ cpus-common.c         | 12 ++++++++++--
-files changed, 25 insertions(+), 24 deletions(-)
+files changed, 12 insertions(+), 4 deletions(-)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_breakpoint_test(CPUState *cpu, vaddr pc, int mask)
+@@ -XXX,XX +XXX,XX @@ struct CPUState {
-     return false;
+     bool unplug;
      bool crash_occurred;
      bool exit_request;
 -    bool in_exclusive_context;
 +    int exclusive_context_count;
      uint32_t cflags_next_tb;
      /* updates protected by BQL */
      uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
   */
  static inline bool cpu_in_exclusive_context(const CPUState *cpu)
  {
 -    return cpu->in_exclusive_context;
 +    return cpu->exclusive_context_count;
  }
-+#ifdef CONFIG_USER_ONLY
+ /**
-+static inline int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
+diff --git a/cpus-common.c b/cpus-common.c
-+                                        int flags, CPUWatchpoint **watchpoint)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/cpus-common.c
-+    return -ENOSYS;
++++ b/cpus-common.c
-+}
+@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
      CPUState *other_cpu;
      int running_cpus;
 +    if (current_cpu->exclusive_context_count) {
 +        current_cpu->exclusive_context_count++;
 +        return;
 +    }
 +
-+static inline int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
+     qemu_mutex_lock(&qemu_cpu_list_lock);
-+                                        vaddr len, int flags)
+     exclusive_idle();
-+{
-+    return -ENOSYS;
+@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-+}
+      */
-+
+     qemu_mutex_unlock(&qemu_cpu_list_lock);
-+static inline void cpu_watchpoint_remove_by_ref(CPUState *cpu,
-+                                                CPUWatchpoint *wp)
+-    current_cpu->in_exclusive_context = true;
-+{
++    current_cpu->exclusive_context_count = 1;
 +}
 +
 +static inline void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
 +{
 +}
 +#else
  int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
                            int flags, CPUWatchpoint **watchpoint);
  int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
                            vaddr len, int flags);
  void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
  void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
 +#endif
  /**
   * cpu_get_address_space:
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
  }
- #endif
+ /* Finish an exclusive operation.  */
--#if defined(CONFIG_USER_ONLY)
+ void end_exclusive(void)
--void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
+ {
--
+-    current_cpu->in_exclusive_context = false;
--{
++    current_cpu->exclusive_context_count--;
--}
++    if (current_cpu->exclusive_context_count) {
--
++        return;
--int cpu_watchpoint_remove(CPUState *cpu, vaddr addr, vaddr len,
++    }
--                          int flags)
--{
+     qemu_mutex_lock(&qemu_cpu_list_lock);
--    return -ENOSYS;
+     qatomic_set(&pending_cpus, 0);
 -}
 -
 -void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint)
 -{
 -}
 -
 -int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
 -                          int flags, CPUWatchpoint **watchpoint)
 -{
 -    return -ENOSYS;
 -}
 -#else
 +#ifndef CONFIG_USER_ONLY
  /* Add a watchpoint.  */
  int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
                            int flags, CPUWatchpoint **watchpoint)
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,
      return !(addr > wpend || wp->vaddr > addrend);
  }
 -
 -#endif
 +#endif /* !CONFIG_USER_ONLY */
  /* Add a breakpoint.  */
  int cpu_breakpoint_insert(CPUState *cpu, vaddr pc, int flags,
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 36/36] tcg: Factor out probe_write() logic into probe_access()
+[PULL v2 5/8] linux-user/microblaze: Handle privileged exception
-From: David Hildenbrand <david@redhat.com>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-Let's also allow to probe other access types.
+Follow what kernel's full_exception() is doing.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20190830100959.26615-3-david@redhat.com>
+Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h | 10 ++++++++--
+ linux-user/microblaze/cpu_loop.c | 10 ++++++++--
- accel/tcg/cputlb.c      | 43 ++++++++++++++++++++++++++++++-----------
+file changed, 8 insertions(+), 2 deletions(-)
  accel/tcg/user-exec.c   | 26 +++++++++++++++++++------
 files changed, 60 insertions(+), 19 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/linux-user/microblaze/cpu_loop.c
-+++ b/include/exec/exec-all.h
++++ b/linux-user/microblaze/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@
  void cpu_loop(CPUMBState *env)
  {
- }
++    int trapnr, ret, si_code, sig;
- #endif
+     CPUState *cs = env_cpu(env);
--void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
+-    int trapnr, ret, si_code;
--                  uintptr_t retaddr);
-+void *probe_access(CPUArchState *env, target_ulong addr, int size,
+     while (1) {
-+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
+         cpu_exec_start(cs);
-+
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
-+static inline void *probe_write(CPUArchState *env, target_ulong addr, int size,
+             env->iflags &= ~(IMM_FLAG | D_FLAG);
-+                                int mmu_idx, uintptr_t retaddr)
+             switch (env->esr & 31) {
-+{
+             case ESR_EC_DIVZERO:
-+    return probe_access(env, addr, size, MMU_DATA_STORE, mmu_idx, retaddr);
++                sig = TARGET_SIGFPE;
-+}
+                 si_code = TARGET_FPE_INTDIV;
+                 break;
- #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
+             case ESR_EC_FPU:
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+                  * if there's no recognized bit set.  Possibly this
-index XXXXXXX..XXXXXXX 100644
+                  * implies that si_code is 0, but follow the structure.
---- a/accel/tcg/cputlb.c
+                  */
-+++ b/accel/tcg/cputlb.c
++                sig = TARGET_SIGFPE;
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
+                 si_code = env->fsr;
-     return qemu_ram_addr_from_host_nofail(p);
+                 if (si_code & FSR_IO) {
- }
+                     si_code = TARGET_FPE_FLTINV;
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
--/* Probe for whether the specified guest write access is permitted.
+                     si_code = TARGET_FPE_FLTRES;
-- * If it is not permitted then an exception will be taken in the same
+                 }
-- * way as if this were a real write access (and we will not return).
+                 break;
-+/*
++            case ESR_EC_PRIVINSN:
-+ * Probe for whether the specified guest access is permitted. If it is not
++                sig = SIGILL;
-+ * permitted then an exception will be taken in the same way as if this
++                si_code = ILL_PRVOPC;
-+ * were a real access (and we will not return).
++                break;
-  * If the size is 0 or the page requires I/O access, returns NULL; otherwise,
+             default:
-  * returns the address of the host page similar to tlb_vaddr_to_host().
+                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
-  */
+                         env->esr & ESR_EC_MASK);
--void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
+                 cpu_dump_state(cs, stderr, 0);
--                  uintptr_t retaddr)
+                 exit(EXIT_FAILURE);
-+void *probe_access(CPUArchState *env, target_ulong addr, int size,
+             }
-+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
+-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
- {
++            force_sig_fault(sig, si_code, env->pc);
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
+             break;
-     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
--    target_ulong tlb_addr = tlb_addr_write(entry);
+         case EXCP_DEBUG:
 +    target_ulong tlb_addr;
 +    size_t elt_ofs;
 +    int wp_access;
      g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 +    switch (access_type) {
 +    case MMU_DATA_LOAD:
 +        elt_ofs = offsetof(CPUTLBEntry, addr_read);
 +        wp_access = BP_MEM_READ;
 +        break;
 +    case MMU_DATA_STORE:
 +        elt_ofs = offsetof(CPUTLBEntry, addr_write);
 +        wp_access = BP_MEM_WRITE;
 +        break;
 +    case MMU_INST_FETCH:
 +        elt_ofs = offsetof(CPUTLBEntry, addr_code);
 +        wp_access = BP_MEM_READ;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    tlb_addr = tlb_read_ofs(entry, elt_ofs);
 +
      if (unlikely(!tlb_hit(tlb_addr, addr))) {
 -        if (!VICTIM_TLB_HIT(addr_write, addr)) {
 -            tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
 -                     mmu_idx, retaddr);
 +        if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs,
 +                            addr & TARGET_PAGE_MASK)) {
 +            tlb_fill(env_cpu(env), addr, size, access_type, mmu_idx, retaddr);
              /* TLB resize via tlb_fill may have moved the entry. */
              index = tlb_index(env, mmu_idx, addr);
              entry = tlb_entry(env, mmu_idx, addr);
          }
 -        tlb_addr = tlb_addr_write(entry);
 +        tlb_addr = tlb_read_ofs(entry, elt_ofs);
      }
      if (!size) {
@@ -XXX,XX +XXX,XX @@ void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
      if (tlb_addr & TLB_WATCHPOINT) {
          cpu_check_watchpoint(env_cpu(env), addr, size,
                               env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
 -                             BP_MEM_WRITE, retaddr);
 +                             wp_access, retaddr);
      }
      if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
      g_assert_not_reached();
  }
 -void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
 -                  uintptr_t retaddr)
 +void *probe_access(CPUArchState *env, target_ulong addr, int size,
 +                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
  {
 +    int flags;
 +
      g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 -    if (!guest_addr_valid(addr) ||
 -        page_check_range(addr, size, PAGE_WRITE) < 0) {
 +    switch (access_type) {
 +    case MMU_DATA_STORE:
 +        flags = PAGE_WRITE;
 +        break;
 +    case MMU_DATA_LOAD:
 +        flags = PAGE_READ;
 +        break;
 +    case MMU_INST_FETCH:
 +        flags = PAGE_EXEC;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    if (!guest_addr_valid(addr) || page_check_range(addr, size, flags) < 0) {
          CPUState *cpu = env_cpu(env);
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -        cc->tlb_fill(cpu, addr, size, MMU_DATA_STORE, MMU_USER_IDX, false,
 +        cc->tlb_fill(cpu, addr, size, access_type, MMU_USER_IDX, false,
                       retaddr);
          g_assert_not_reached();
      }
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 15/36] cputlb: Replace size and endian operands for MemOp
+[PULL v2 6/8] target/microblaze: Add gdbstub xml
-From: Tony Nguyen <tony.nguyen@bt.com>
+Mirroring the upstream gdb xml files, the two stack boundary
 registers are separated out.
-Preparation for collapsing the two byte swaps adjust_endianness and
+Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 handle_bswap into the former.
 Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <755b7104410956b743e1f1e9c34ab87db113360f.1566466906.git.tony.nguyen@bt.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/memop.h |   6 ++
+ target/microblaze/cpu.h                     |  2 +
- accel/tcg/cputlb.c   | 170 +++++++++++++++++++++----------------------
+ target/microblaze/cpu.c                     |  7 ++-
-files changed, 87 insertions(+), 89 deletions(-)
+ target/microblaze/gdbstub.c                 | 51 +++++++++++-----
  configs/targets/microblaze-linux-user.mak   |  1 +
  configs/targets/microblaze-softmmu.mak      |  1 +
  configs/targets/microblazeel-linux-user.mak |  1 +
  configs/targets/microblazeel-softmmu.mak    |  1 +
  gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
  gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 files changed, 128 insertions(+), 15 deletions(-)
  create mode 100644 gdb-xml/microblaze-core.xml
  create mode 100644 gdb-xml/microblaze-stack-protect.xml
-diff --git a/include/exec/memop.h b/include/exec/memop.h
+diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memop.h
+--- a/target/microblaze/cpu.h
-+++ b/include/exec/memop.h
++++ b/target/microblaze/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline MemOp size_memop(unsigned size)
+@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
-     return ctz32(size);
+                                         MemTxAttrs *attrs);
  int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 +int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
 +int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
  static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
  {
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "hw/qdev-properties.h"
  #include "exec/exec-all.h"
 +#include "exec/gdbstub.h"
  #include "fpu/softfloat-helpers.h"
  static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
      CPUMBState *env = &cpu->env;
      cpu_set_cpustate_pointers(cpu);
 +    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
 +                             mb_cpu_gdb_write_stack_protect, 2,
 +                             "microblaze-stack-protect.xml", 0);
      set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->sysemu_ops = &mb_sysemu_ops;
  #endif
      device_class_set_props(dc, mb_properties);
 -    cc->gdb_num_core_regs = 32 + 27;
 +    cc->gdb_num_core_regs = 32 + 25;
 +    cc->gdb_core_xml_file = "microblaze-core.xml";
      cc->disas_set_info = mb_disas_set_info;
      cc->tcg_ops = &mb_tcg_ops;
 diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/gdbstub.c
 +++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
      GDB_PVR0  = 32 + 6,
      GDB_PVR11 = 32 + 17,
      GDB_EDR   = 32 + 18,
 -    GDB_SLR   = 32 + 25,
 -    GDB_SHR   = 32 + 26,
 +};
 +
 +enum {
 +    GDB_SP_SHL,
 +    GDB_SP_SHR,
  };
  int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      case GDB_EDR:
          val = env->edr;
          break;
 -    case GDB_SLR:
 -        val = env->slr;
 -        break;
 -    case GDB_SHR:
 -        val = env->shr;
 -        break;
      default:
          /* Other SRegs aren't modeled, so report a value of 0 */
          val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      return gdb_get_reg32(mem_buf, val);
  }
-+/* Big endianness from MemOp.  */
++int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
 +static inline bool memop_big_endian(MemOp op)
 +{
-+    return (op & MO_BSWAP) == MO_BE;
++    uint32_t val;
 +
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        val = env->slr;
 +        break;
 +    case GDB_SP_SHR:
 +        val = env->shr;
 +        break;
 +    default:
 +        return 0;
 +    }
 +    return gdb_get_reg32(mem_buf, val);
 +}
 +
- #endif
+ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
  static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                           int mmu_idx, target_ulong addr, uintptr_t retaddr,
 -                         MMUAccessType access_type, int size)
 +                         MMUAccessType access_type, MemOp op)
  {
-     CPUState *cpu = env_cpu(env);
+     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-     hwaddr mr_offset;
+@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+     case GDB_EDR:
-         qemu_mutex_lock_iothread();
+         env->edr = tmp;
-         locked = true;
+         break;
 -    case GDB_SLR:
 -        env->slr = tmp;
 -        break;
 -    case GDB_SHR:
 -        env->shr = tmp;
 -        break;
 +    }
 +    return 4;
 +}
 +
 +int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
 +{
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        env->slr = ldl_p(mem_buf);
 +        break;
 +    case GDB_SP_SHR:
 +        env->shr = ldl_p(mem_buf);
 +        break;
 +    default:
 +        return 0;
      }
--    r = memory_region_dispatch_read(mr, mr_offset, &val,
+     return 4;
 -                                    size_memop(size) | MO_TE,
 -                                    iotlbentry->attrs);
 +    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
      if (r != MEMTX_OK) {
          hwaddr physaddr = mr_offset +
              section->offset_within_address_space -
              section->offset_within_region;
 -        cpu_transaction_failed(cpu, physaddr, addr, size, access_type,
 +        cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
                                 mmu_idx, iotlbentry->attrs, r, retaddr);
      }
      if (locked) {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
  static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                        int mmu_idx, uint64_t val, target_ulong addr,
 -                      uintptr_t retaddr, int size)
 +                      uintptr_t retaddr, MemOp op)
  {
      CPUState *cpu = env_cpu(env);
      hwaddr mr_offset;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
          qemu_mutex_lock_iothread();
          locked = true;
      }
 -    r = memory_region_dispatch_write(mr, mr_offset, val,
 -                                     size_memop(size) | MO_TE,
 -                                     iotlbentry->attrs);
 +    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
      if (r != MEMTX_OK) {
          hwaddr physaddr = mr_offset +
              section->offset_within_address_space -
              section->offset_within_region;
 -        cpu_transaction_failed(cpu, physaddr, addr, size, MMU_DATA_STORE,
 -                               mmu_idx, iotlbentry->attrs, r, retaddr);
 +        cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
 +                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
 +                               retaddr);
      }
      if (locked) {
          qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
   * access type.
   */
 -static inline uint64_t handle_bswap(uint64_t val, int size, bool big_endian)
 +static inline uint64_t handle_bswap(uint64_t val, MemOp op)
  {
 -    if ((big_endian && NEED_BE_BSWAP) || (!big_endian && NEED_LE_BSWAP)) {
 -        switch (size) {
 -        case 1: return val;
 -        case 2: return bswap16(val);
 -        case 4: return bswap32(val);
 -        case 8: return bswap64(val);
 +    if ((memop_big_endian(op) && NEED_BE_BSWAP) ||
 +        (!memop_big_endian(op) && NEED_LE_BSWAP)) {
 +        switch (op & MO_SIZE) {
 +        case MO_8: return val;
 +        case MO_16: return bswap16(val);
 +        case MO_32: return bswap32(val);
 +        case MO_64: return bswap64(val);
          default:
              g_assert_not_reached();
          }
@@ -XXX,XX +XXX,XX @@ typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
  static inline uint64_t __attribute__((always_inline))
  load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 -            uintptr_t retaddr, size_t size, bool big_endian, bool code_read,
 +            uintptr_t retaddr, MemOp op, bool code_read,
              FullLoadHelper *full_load)
  {
      uintptr_t mmu_idx = get_mmuidx(oi);
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
      unsigned a_bits = get_alignment_bits(get_memop(oi));
      void *haddr;
      uint64_t res;
 +    size_t size = memop_size(op);
      /* Handle CPU specific unaligned behaviour */
      if (addr & ((1 << a_bits) - 1)) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
          /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
          res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
 -                       mmu_idx, addr, retaddr, access_type, size);
 -        return handle_bswap(res, size, big_endian);
 +                       mmu_idx, addr, retaddr, access_type, op);
 +        return handle_bswap(res, op);
      }
      /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
          r2 = full_load(env, addr2, oi, retaddr);
          shift = (addr & (size - 1)) * 8;
 -        if (big_endian) {
 +        if (memop_big_endian(op)) {
              /* Big-endian combine.  */
              res = (r1 << shift) | (r2 >> ((size * 8) - shift));
          } else {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
   do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
 -    switch (size) {
 -    case 1:
 +    switch (op) {
 +    case MO_UB:
          res = ldub_p(haddr);
          break;
 -    case 2:
 -        if (big_endian) {
 -            res = lduw_be_p(haddr);
 -        } else {
 -            res = lduw_le_p(haddr);
 -        }
 +    case MO_BEUW:
 +        res = lduw_be_p(haddr);
          break;
 -    case 4:
 -        if (big_endian) {
 -            res = (uint32_t)ldl_be_p(haddr);
 -        } else {
 -            res = (uint32_t)ldl_le_p(haddr);
 -        }
 +    case MO_LEUW:
 +        res = lduw_le_p(haddr);
          break;
 -    case 8:
 -        if (big_endian) {
 -            res = ldq_be_p(haddr);
 -        } else {
 -            res = ldq_le_p(haddr);
 -        }
 +    case MO_BEUL:
 +        res = (uint32_t)ldl_be_p(haddr);
 +        break;
 +    case MO_LEUL:
 +        res = (uint32_t)ldl_le_p(haddr);
 +        break;
 +    case MO_BEQ:
 +        res = ldq_be_p(haddr);
 +        break;
 +    case MO_LEQ:
 +        res = ldq_le_p(haddr);
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
  static uint64_t full_ldub_mmu(CPUArchState *env, target_ulong addr,
                                TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 1, false, false,
 -                       full_ldub_mmu);
 +    return load_helper(env, addr, oi, retaddr, MO_UB, false, full_ldub_mmu);
  }
+diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
- tcg_target_ulong helper_ret_ldub_mmu(CPUArchState *env, target_ulong addr,
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_ret_ldub_mmu(CPUArchState *env, target_ulong addr,
+--- a/configs/targets/microblaze-linux-user.mak
- static uint64_t full_le_lduw_mmu(CPUArchState *env, target_ulong addr,
++++ b/configs/targets/microblaze-linux-user.mak
-                                  TCGMemOpIdx oi, uintptr_t retaddr)
+@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
- {
+ TARGET_SYSTBL=syscall.tbl
--    return load_helper(env, addr, oi, retaddr, 2, false, false,
+ TARGET_BIG_ENDIAN=y
-+    return load_helper(env, addr, oi, retaddr, MO_LEUW, false,
+ TARGET_HAS_BFLT=y
-                        full_le_lduw_mmu);
++TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
- }
+diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_le_lduw_mmu(CPUArchState *env, target_ulong addr,
+--- a/configs/targets/microblaze-softmmu.mak
- static uint64_t full_be_lduw_mmu(CPUArchState *env, target_ulong addr,
++++ b/configs/targets/microblaze-softmmu.mak
-                                  TCGMemOpIdx oi, uintptr_t retaddr)
+@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
- {
+ TARGET_BIG_ENDIAN=y
--    return load_helper(env, addr, oi, retaddr, 2, true, false,
+ TARGET_SUPPORTS_MTTCG=y
-+    return load_helper(env, addr, oi, retaddr, MO_BEUW, false,
+ TARGET_NEED_FDT=y
-                        full_be_lduw_mmu);
++TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
- }
+diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_lduw_mmu(CPUArchState *env, target_ulong addr,
+--- a/configs/targets/microblazeel-linux-user.mak
- static uint64_t full_le_ldul_mmu(CPUArchState *env, target_ulong addr,
++++ b/configs/targets/microblazeel-linux-user.mak
-                                  TCGMemOpIdx oi, uintptr_t retaddr)
+@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
- {
+ TARGET_SYSTBL_ABI=common
--    return load_helper(env, addr, oi, retaddr, 4, false, false,
+ TARGET_SYSTBL=syscall.tbl
-+    return load_helper(env, addr, oi, retaddr, MO_LEUL, false,
+ TARGET_HAS_BFLT=y
-                        full_le_ldul_mmu);
++TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
- }
+diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_le_ldul_mmu(CPUArchState *env, target_ulong addr,
+--- a/configs/targets/microblazeel-softmmu.mak
- static uint64_t full_be_ldul_mmu(CPUArchState *env, target_ulong addr,
++++ b/configs/targets/microblazeel-softmmu.mak
-                                  TCGMemOpIdx oi, uintptr_t retaddr)
+@@ -XXX,XX +XXX,XX @@
- {
+ TARGET_ARCH=microblaze
--    return load_helper(env, addr, oi, retaddr, 4, true, false,
+ TARGET_SUPPORTS_MTTCG=y
-+    return load_helper(env, addr, oi, retaddr, MO_BEUL, false,
+ TARGET_NEED_FDT=y
-                        full_be_ldul_mmu);
++TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
- }
+diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
+new file mode 100644
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldul_mmu(CPUArchState *env, target_ulong addr,
+index XXXXXXX..XXXXXXX
- uint64_t helper_le_ldq_mmu(CPUArchState *env, target_ulong addr,
+--- /dev/null
-                            TCGMemOpIdx oi, uintptr_t retaddr)
++++ b/gdb-xml/microblaze-core.xml
- {
+@@ -XXX,XX +XXX,XX @@
--    return load_helper(env, addr, oi, retaddr, 8, false, false,
++<?xml version="1.0"?>
-+    return load_helper(env, addr, oi, retaddr, MO_LEQ, false,
++<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-                        helper_le_ldq_mmu);
++
- }
++     Copying and distribution of this file, with or without modification,
++     are permitted in any medium without royalty provided the copyright
- uint64_t helper_be_ldq_mmu(CPUArchState *env, target_ulong addr,
++     notice and this notice are preserved.  -->
-                            TCGMemOpIdx oi, uintptr_t retaddr)
++
- {
++<!DOCTYPE feature SYSTEM "gdb-target.dtd">
--    return load_helper(env, addr, oi, retaddr, 8, true, false,
++<feature name="org.gnu.gdb.microblaze.core">
-+    return load_helper(env, addr, oi, retaddr, MO_BEQ, false,
++  <reg name="r0" bitsize="32" regnum="0"/>
-                        helper_be_ldq_mmu);
++  <reg name="r1" bitsize="32" type="data_ptr"/>
- }
++  <reg name="r2" bitsize="32"/>
++  <reg name="r3" bitsize="32"/>
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
++  <reg name="r4" bitsize="32"/>
++  <reg name="r5" bitsize="32"/>
- static inline void __attribute__((always_inline))
++  <reg name="r6" bitsize="32"/>
- store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++  <reg name="r7" bitsize="32"/>
--             TCGMemOpIdx oi, uintptr_t retaddr, size_t size, bool big_endian)
++  <reg name="r8" bitsize="32"/>
-+             TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
++  <reg name="r9" bitsize="32"/>
- {
++  <reg name="r10" bitsize="32"/>
-     uintptr_t mmu_idx = get_mmuidx(oi);
++  <reg name="r11" bitsize="32"/>
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
++  <reg name="r12" bitsize="32"/>
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++  <reg name="r13" bitsize="32"/>
-     const size_t tlb_off = offsetof(CPUTLBEntry, addr_write);
++  <reg name="r14" bitsize="32"/>
-     unsigned a_bits = get_alignment_bits(get_memop(oi));
++  <reg name="r15" bitsize="32"/>
-     void *haddr;
++  <reg name="r16" bitsize="32"/>
-+    size_t size = memop_size(op);
++  <reg name="r17" bitsize="32"/>
++  <reg name="r18" bitsize="32"/>
-     /* Handle CPU specific unaligned behaviour */
++  <reg name="r19" bitsize="32"/>
-     if (addr & ((1 << a_bits) - 1)) {
++  <reg name="r20" bitsize="32"/>
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++  <reg name="r21" bitsize="32"/>
++  <reg name="r22" bitsize="32"/>
-         /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
++  <reg name="r23" bitsize="32"/>
-         io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
++  <reg name="r24" bitsize="32"/>
--                  handle_bswap(val, size, big_endian),
++  <reg name="r25" bitsize="32"/>
--                  addr, retaddr, size);
++  <reg name="r26" bitsize="32"/>
-+                  handle_bswap(val, op),
++  <reg name="r27" bitsize="32"/>
-+                  addr, retaddr, op);
++  <reg name="r28" bitsize="32"/>
-         return;
++  <reg name="r29" bitsize="32"/>
-     }
++  <reg name="r30" bitsize="32"/>
++  <reg name="r31" bitsize="32"/>
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++  <reg name="rpc" bitsize="32" type="code_ptr"/>
-          */
++  <reg name="rmsr" bitsize="32"/>
-         for (i = 0; i < size; ++i) {
++  <reg name="rear" bitsize="32"/>
-             uint8_t val8;
++  <reg name="resr" bitsize="32"/>
--            if (big_endian) {
++  <reg name="rfsr" bitsize="32"/>
-+            if (memop_big_endian(op)) {
++  <reg name="rbtr" bitsize="32"/>
-                 /* Big-endian extract.  */
++  <reg name="rpvr0" bitsize="32"/>
-                 val8 = val >> (((size - 1) * 8) - (i * 8));
++  <reg name="rpvr1" bitsize="32"/>
-             } else {
++  <reg name="rpvr2" bitsize="32"/>
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++  <reg name="rpvr3" bitsize="32"/>
++  <reg name="rpvr4" bitsize="32"/>
-  do_aligned_access:
++  <reg name="rpvr5" bitsize="32"/>
-     haddr = (void *)((uintptr_t)addr + entry->addend);
++  <reg name="rpvr6" bitsize="32"/>
--    switch (size) {
++  <reg name="rpvr7" bitsize="32"/>
--    case 1:
++  <reg name="rpvr8" bitsize="32"/>
-+    switch (op) {
++  <reg name="rpvr9" bitsize="32"/>
-+    case MO_UB:
++  <reg name="rpvr10" bitsize="32"/>
-         stb_p(haddr, val);
++  <reg name="rpvr11" bitsize="32"/>
-         break;
++  <reg name="redr" bitsize="32"/>
--    case 2:
++  <reg name="rpid" bitsize="32"/>
--        if (big_endian) {
++  <reg name="rzpr" bitsize="32"/>
--            stw_be_p(haddr, val);
++  <reg name="rtlbx" bitsize="32"/>
--        } else {
++  <reg name="rtlbsx" bitsize="32"/>
--            stw_le_p(haddr, val);
++  <reg name="rtlblo" bitsize="32"/>
--        }
++  <reg name="rtlbhi" bitsize="32"/>
-+    case MO_BEUW:
++</feature>
-+        stw_be_p(haddr, val);
+diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
-         break;
+new file mode 100644
--    case 4:
+index XXXXXXX..XXXXXXX
--        if (big_endian) {
+--- /dev/null
--            stl_be_p(haddr, val);
++++ b/gdb-xml/microblaze-stack-protect.xml
--        } else {
+@@ -XXX,XX +XXX,XX @@
--            stl_le_p(haddr, val);
++<?xml version="1.0"?>
--        }
++<!-- Copyright (C) 2008 Free Software Foundation, Inc.
-+    case MO_LEUW:
++
-+        stw_le_p(haddr, val);
++     Copying and distribution of this file, with or without modification,
-         break;
++     are permitted in any medium without royalty provided the copyright
--    case 8:
++     notice and this notice are preserved.  -->
--        if (big_endian) {
++
--            stq_be_p(haddr, val);
++<!DOCTYPE feature SYSTEM "gdb-target.dtd">
--        } else {
++<feature name="org.gnu.gdb.microblaze.stack-protect">
--            stq_le_p(haddr, val);
++  <reg name="rslr" bitsize="32"/>
--        }
++  <reg name="rshr" bitsize="32"/>
-+    case MO_BEUL:
++</feature>
 +        stl_be_p(haddr, val);
 +        break;
 +    case MO_LEUL:
 +        stl_le_p(haddr, val);
 +        break;
 +    case MO_BEQ:
 +        stq_be_p(haddr, val);
 +        break;
 +    case MO_LEQ:
 +        stq_le_p(haddr, val);
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
  void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
                          TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 1, false);
 +    store_helper(env, addr, val, oi, retaddr, MO_UB);
  }
  void helper_le_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 2, false);
 +    store_helper(env, addr, val, oi, retaddr, MO_LEUW);
  }
  void helper_be_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 2, true);
 +    store_helper(env, addr, val, oi, retaddr, MO_BEUW);
  }
  void helper_le_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 4, false);
 +    store_helper(env, addr, val, oi, retaddr, MO_LEUL);
  }
  void helper_be_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 4, true);
 +    store_helper(env, addr, val, oi, retaddr, MO_BEUL);
  }
  void helper_le_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 8, false);
 +    store_helper(env, addr, val, oi, retaddr, MO_LEQ);
  }
  void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    store_helper(env, addr, val, oi, retaddr, 8, true);
 +    store_helper(env, addr, val, oi, retaddr, MO_BEQ);
  }
  /* First set of helpers allows passing in of OI and RETADDR.  This makes
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
  static uint64_t full_ldub_cmmu(CPUArchState *env, target_ulong addr,
                                 TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 1, false, true,
 -                       full_ldub_cmmu);
 +    return load_helper(env, addr, oi, retaddr, MO_8, true, full_ldub_cmmu);
  }
  uint8_t helper_ret_ldb_cmmu(CPUArchState *env, target_ulong addr,
@@ -XXX,XX +XXX,XX @@ uint8_t helper_ret_ldb_cmmu(CPUArchState *env, target_ulong addr,
  static uint64_t full_le_lduw_cmmu(CPUArchState *env, target_ulong addr,
                                    TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 2, false, true,
 +    return load_helper(env, addr, oi, retaddr, MO_LEUW, true,
                         full_le_lduw_cmmu);
  }
@@ -XXX,XX +XXX,XX @@ uint16_t helper_le_ldw_cmmu(CPUArchState *env, target_ulong addr,
  static uint64_t full_be_lduw_cmmu(CPUArchState *env, target_ulong addr,
                                    TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 2, true, true,
 +    return load_helper(env, addr, oi, retaddr, MO_BEUW, true,
                         full_be_lduw_cmmu);
  }
@@ -XXX,XX +XXX,XX @@ uint16_t helper_be_ldw_cmmu(CPUArchState *env, target_ulong addr,
  static uint64_t full_le_ldul_cmmu(CPUArchState *env, target_ulong addr,
                                    TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 4, false, true,
 +    return load_helper(env, addr, oi, retaddr, MO_LEUL, true,
                         full_le_ldul_cmmu);
  }
@@ -XXX,XX +XXX,XX @@ uint32_t helper_le_ldl_cmmu(CPUArchState *env, target_ulong addr,
  static uint64_t full_be_ldul_cmmu(CPUArchState *env, target_ulong addr,
                                    TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 4, true, true,
 +    return load_helper(env, addr, oi, retaddr, MO_BEUL, true,
                         full_be_ldul_cmmu);
  }
@@ -XXX,XX +XXX,XX @@ uint32_t helper_be_ldl_cmmu(CPUArchState *env, target_ulong addr,
  uint64_t helper_le_ldq_cmmu(CPUArchState *env, target_ulong addr,
                              TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 8, false, true,
 +    return load_helper(env, addr, oi, retaddr, MO_LEQ, true,
                         helper_le_ldq_cmmu);
  }
  uint64_t helper_be_ldq_cmmu(CPUArchState *env, target_ulong addr,
                              TCGMemOpIdx oi, uintptr_t retaddr)
  {
 -    return load_helper(env, addr, oi, retaddr, 8, true, true,
 +    return load_helper(env, addr, oi, retaddr, MO_BEQ, true,
                         helper_be_ldq_cmmu);
  }
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 14/36] memory: Access MemoryRegion with endianness
+[PULL v2 7/8] util/cacheflush: fix cache on windows-arm64
-From: Tony Nguyen <tony.nguyen@bt.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Preparation for collapsing the two byte swaps adjust_endianness and
+ctr_el0 access is privileged on this platform and fails as an illegal
-handle_bswap into the former.
+instruction.
-Call memory_region_dispatch_{read|write} with endianness encoded into
+Windows does not offer a way to flush data cache from userspace, and
-the "MemOp op" operand.
+only FlushInstructionCache is available in Windows API.
-This patch does not change any behaviour as
+The generic implementation of flush_idcache_range uses,
-memory_region_dispatch_{read|write} is yet to handle the endianness.
+__builtin___clear_cache, which already use the FlushInstructionCache
 function. So we rely on that.
-Once it does handle endianness, callers with byte swaps can collapse
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 them into adjust_endianness.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
+Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
 Message-Id: <8066ab3eb037c0388dfadfe53c5118429dd1de3a.1566466906.git.tony.nguyen@bt.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/memory.h    |  3 +++
+ util/cacheflush.c | 14 +++++++++++---
- accel/tcg/cputlb.c       |  8 ++++++--
+file changed, 11 insertions(+), 3 deletions(-)
  exec.c                   | 13 +++++++++++--
  hw/intc/armv7m_nvic.c    | 15 ++++++++-------
  hw/s390x/s390-pci-inst.c |  6 ++++--
  hw/vfio/pci-quirks.c     |  5 +++--
  hw/virtio/virtio-pci.c   |  6 ++++--
  memory.c                 | 18 ++++++++++++++++++
  memory_ldst.inc.c        | 24 ++++++++++++++++++------
 files changed, 75 insertions(+), 23 deletions(-)
-diff --git a/include/exec/memory.h b/include/exec/memory.h
+diff --git a/util/cacheflush.c b/util/cacheflush.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memory.h
+--- a/util/cacheflush.c
-+++ b/include/exec/memory.h
++++ b/util/cacheflush.c
-@@ -XXX,XX +XXX,XX @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
-     }
+ static bool have_coherent_icache;
  }
 +/* enum device_endian to MemOp.  */
 +MemOp devend_memop(enum device_endian end);
 +
  #endif
- #endif
+-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
-index XXXXXXX..XXXXXXX 100644
++#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
---- a/accel/tcg/cputlb.c
++/*
-+++ b/accel/tcg/cputlb.c
++ * Apple does not expose CTR_EL0, so we must use system interfaces.
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
++ * Windows neither, but we use a generic implementation of flush_idcache_range
-         qemu_mutex_lock_iothread();
++ * in this case.
-         locked = true;
++ */
-     }
+ static uint64_t save_ctr_el0;
--    r = memory_region_dispatch_read(mr, mr_offset, &val, size_memop(size),
+ static void arch_cache_info(int *isize, int *dsize)
-+    r = memory_region_dispatch_read(mr, mr_offset, &val,
+ {
-+                                    size_memop(size) | MO_TE,
+@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
-                                     iotlbentry->attrs);
-     if (r != MEMTX_OK) {
+ /* Caches are coherent and do not require flushing; symbol inline. */
-         hwaddr physaddr = mr_offset +
-@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+-#elif defined(__aarch64__)
-         qemu_mutex_lock_iothread();
++#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
-         locked = true;
++/*
-     }
++ * For Windows, we use generic implementation of flush_idcache_range, that
--    r = memory_region_dispatch_write(mr, mr_offset, val, size_memop(size),
++ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
-+    r = memory_region_dispatch_write(mr, mr_offset, val,
++ */
-+                                     size_memop(size) | MO_TE,
-                                      iotlbentry->attrs);
+ #ifdef CONFIG_DARWIN
-     if (r != MEMTX_OK) {
+ /* Apple does not expose CTR_EL0, so we must use system interfaces. */
          hwaddr physaddr = mr_offset +
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              }
          }
 +        /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
          res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
                         mmu_idx, addr, retaddr, access_type, size);
          return handle_bswap(res, size, big_endian);
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              }
          }
 +        /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
          io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
                    handle_bswap(val, size, big_endian),
                    addr, retaddr, size);
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
              /* XXX: could force current_cpu to NULL to avoid
                 potential bugs */
              val = ldn_p(buf, l);
 +            /*
 +             * TODO: Merge bswap from ldn_p into memory_region_dispatch_write
 +             * by using ldn_he_p and dropping MO_TE to get a host-endian value.
 +             */
              result |= memory_region_dispatch_write(mr, addr1, val,
 -                                                   size_memop(l), attrs);
 +                                                   size_memop(l) | MO_TE,
 +                                                   attrs);
          } else {
              /* RAM case */
              ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
              /* I/O case */
              release_lock |= prepare_mmio_access(mr);
              l = memory_access_size(mr, l, addr1);
 +            /*
 +             * TODO: Merge bswap from stn_p into memory_region_dispatch_read
 +             * by using stn_he_p and dropping MO_TE to get a host-endian value.
 +             */
              result |= memory_region_dispatch_read(mr, addr1, &val,
 -                                                  size_memop(l), attrs);
 +                                                  size_memop(l) | MO_TE, attrs);
              stn_p(buf, l, val);
          } else {
              /* RAM case */
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
      if (attrs.secure) {
          /* S accesses to the alias act like NS accesses to the real region */
          attrs.secure = 0;
 -        return memory_region_dispatch_write(mr, addr, value, size_memop(size),
 -                                            attrs);
 +        return memory_region_dispatch_write(mr, addr, value,
 +                                            size_memop(size) | MO_TE, attrs);
      } else {
          /* NS attrs are RAZ/WI for privileged, and BusFault for user */
          if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
      if (attrs.secure) {
          /* S accesses to the alias act like NS accesses to the real region */
          attrs.secure = 0;
 -        return memory_region_dispatch_read(mr, addr, data, size_memop(size),
 -                                           attrs);
 +        return memory_region_dispatch_read(mr, addr, data,
 +                                           size_memop(size) | MO_TE, attrs);
      } else {
          /* NS attrs are RAZ/WI for privileged, and BusFault for user */
          if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
      /* Direct the access to the correct systick */
      mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
 -    return memory_region_dispatch_write(mr, addr, value, size_memop(size),
 -                                        attrs);
 +    return memory_region_dispatch_write(mr, addr, value,
 +                                        size_memop(size) | MO_TE, attrs);
  }
  static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
      /* Direct the access to the correct systick */
      mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
 -    return memory_region_dispatch_read(mr, addr, data, size_memop(size), attrs);
 +    return memory_region_dispatch_read(mr, addr, data, size_memop(size) | MO_TE,
 +                                       attrs);
  }
  static const MemoryRegionOps nvic_systick_ops = {
 diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/s390x/s390-pci-inst.c
 +++ b/hw/s390x/s390-pci-inst.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
      mr = pbdev->pdev->io_regions[pcias].memory;
      mr = s390_get_subregion(mr, offset, len);
      offset -= mr->addr;
 -    return memory_region_dispatch_read(mr, offset, data, size_memop(len),
 +    return memory_region_dispatch_read(mr, offset, data,
 +                                       size_memop(len) | MO_BE,
                                         MEMTXATTRS_UNSPECIFIED);
  }
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
      mr = pbdev->pdev->io_regions[pcias].memory;
      mr = s390_get_subregion(mr, offset, len);
      offset -= mr->addr;
 -    return memory_region_dispatch_write(mr, offset, data, size_memop(len),
 +    return memory_region_dispatch_write(mr, offset, data,
 +                                        size_memop(len) | MO_BE,
                                          MEMTXATTRS_UNSPECIFIED);
  }
 diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci-quirks.c
 +++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
                  /* Write to the proper guest MSI-X table instead */
                  memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
 -                                             offset, val, size_memop(size),
 +                                             offset, val,
 +                                             size_memop(size) | MO_LE,
                                               MEMTXATTRS_UNSPECIFIED);
              }
              return; /* Do not write guest MSI-X data to hardware */
@@ -XXX,XX +XXX,XX @@ static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
      if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
          hwaddr offset = rtl->addr & 0xfff;
          memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
 -                                    &data, size_memop(size),
 +                                    &data, size_memop(size) | MO_LE,
                                      MEMTXATTRS_UNSPECIFIED);
          trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
      }
 diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/virtio-pci.c
 +++ b/hw/virtio/virtio-pci.c
@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
          /* As length is under guest control, handle illegal values. */
          return;
      }
 -    memory_region_dispatch_write(mr, addr, val, size_memop(len),
 +    /* TODO: Merge bswap from cpu_to_leXX into memory_region_dispatch_write.  */
 +    memory_region_dispatch_write(mr, addr, val, size_memop(len) | MO_LE,
                                   MEMTXATTRS_UNSPECIFIED);
  }
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
      /* Make sure caller aligned buf properly */
      assert(!(((uintptr_t)buf) & (len - 1)));
 -    memory_region_dispatch_read(mr, addr, &val, size_memop(len),
 +    /* TODO: Merge bswap from leXX_to_cpu into memory_region_dispatch_read.  */
 +    memory_region_dispatch_read(mr, addr, &val, size_memop(len) | MO_LE,
                                  MEMTXATTRS_UNSPECIFIED);
      switch (len) {
      case 1:
 diff --git a/memory.c b/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory.c
 +++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static void memory_register_types(void)
  }
  type_init(memory_register_types)
 +
 +MemOp devend_memop(enum device_endian end)
 +{
 +    static MemOp conv[] = {
 +        [DEVICE_LITTLE_ENDIAN] = MO_LE,
 +        [DEVICE_BIG_ENDIAN] = MO_BE,
 +        [DEVICE_NATIVE_ENDIAN] = MO_TE,
 +        [DEVICE_HOST_ENDIAN] = 0,
 +    };
 +    switch (end) {
 +    case DEVICE_LITTLE_ENDIAN:
 +    case DEVICE_BIG_ENDIAN:
 +    case DEVICE_NATIVE_ENDIAN:
 +        return conv[end];
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory_ldst.inc.c
 +++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        r = memory_region_dispatch_read(mr, addr1, &val, MO_32, attrs);
 +        /* TODO: Merge bswap32 into memory_region_dispatch_read.  */
 +        r = memory_region_dispatch_read(mr, addr1, &val,
 +                                        MO_32 | devend_memop(endian), attrs);
  #if defined(TARGET_WORDS_BIGENDIAN)
          if (endian == DEVICE_LITTLE_ENDIAN) {
              val = bswap32(val);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        r = memory_region_dispatch_read(mr, addr1, &val, MO_64, attrs);
 +        /* TODO: Merge bswap64 into memory_region_dispatch_read.  */
 +        r = memory_region_dispatch_read(mr, addr1, &val,
 +                                        MO_64 | devend_memop(endian), attrs);
  #if defined(TARGET_WORDS_BIGENDIAN)
          if (endian == DEVICE_LITTLE_ENDIAN) {
              val = bswap64(val);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
          release_lock |= prepare_mmio_access(mr);
          /* I/O case */
 -        r = memory_region_dispatch_read(mr, addr1, &val, MO_16, attrs);
 +        /* TODO: Merge bswap16 into memory_region_dispatch_read.  */
 +        r = memory_region_dispatch_read(mr, addr1, &val,
 +                                        MO_16 | devend_memop(endian), attrs);
  #if defined(TARGET_WORDS_BIGENDIAN)
          if (endian == DEVICE_LITTLE_ENDIAN) {
              val = bswap16(val);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
              val = bswap32(val);
          }
  #endif
 -        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
 +        /* TODO: Merge bswap32 into memory_region_dispatch_write.  */
 +        r = memory_region_dispatch_write(mr, addr1, val,
 +                                         MO_32 | devend_memop(endian), attrs);
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
              val = bswap16(val);
          }
  #endif
 -        r = memory_region_dispatch_write(mr, addr1, val, MO_16, attrs);
 +        /* TODO: Merge bswap16 into memory_region_dispatch_write.  */
 +        r = memory_region_dispatch_write(mr, addr1, val,
 +                                         MO_16 | devend_memop(endian), attrs);
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
              val = bswap64(val);
          }
  #endif
 -        r = memory_region_dispatch_write(mr, addr1, val, MO_64, attrs);
 +        /* TODO: Merge bswap64 into memory_region_dispatch_write.  */
 +        r = memory_region_dispatch_write(mr, addr1, val,
 +                                         MO_64 | devend_memop(endian), attrs);
      } else {
          /* RAM case */
          ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
 --
-.17.1
+.34.1

-[Qemu-devel] [PATCH 17/36] cputlb: Byte swap memory transaction attribute
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Notice new attribute, byte swap, and force the transaction through the
-memory slow path.
-Required by architectures that can invert endianness of memory
-transaction, e.g. SPARC64 has the Invert Endian TTE bit.
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <2a10a1f1c00a894af1212c8f68ef09c2966023c1.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/memattrs.h |  2 ++
- accel/tcg/cputlb.c      | 12 ++++++++++++
-files changed, 14 insertions(+)
-diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memattrs.h
-+++ b/include/exec/memattrs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs {
-     unsigned int user:1;
-     /* Requester ID (for MSI for example) */
-     unsigned int requester_id:16;
-+    /* Invert endianness for this page */
-+    unsigned int byte_swap:1;
-     /*
-      * The following are target-specific page-table bits.  These are not
-      * related to actual memory transactions at all.  However, this structure
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-          */
-         address |= TLB_RECHECK;
-     }
-+    if (attrs.byte_swap) {
-+        /* Force the access through the I/O slow path.  */
-+        address |= TLB_MMIO;
-+    }
-     if (!memory_region_is_ram(section->mr) &&
-         !memory_region_is_romd(section->mr)) {
-         /* IO memory case */
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-     bool locked = false;
-     MemTxResult r;
-+    if (iotlbentry->attrs.byte_swap) {
-+        op ^= MO_BSWAP;
-+    }
-+
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-     mr = section->mr;
-     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-     bool locked = false;
-     MemTxResult r;
-+    if (iotlbentry->attrs.byte_swap) {
-+        op ^= MO_BSWAP;
-+    }
-+
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-     mr = section->mr;
-     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
---
-.17.1

-[Qemu-devel] [PATCH 18/36] target/sparc: Add TLB entry with attributes
+Deleted patch
-From: Tony Nguyen <tony.nguyen@bt.com>
-Append MemTxAttrs to interfaces so we can pass along up coming Invert
-Endian TTE bit on SPARC64.
-Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <f8fcc3138570c460ef289a6b34ba7715ba36f99e.1566466906.git.tony.nguyen@bt.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/sparc/mmu_helper.c | 32 ++++++++++++++++++--------------
-file changed, 18 insertions(+), 14 deletions(-)
-diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/mmu_helper.c
-+++ b/target/sparc/mmu_helper.c
-@@ -XXX,XX +XXX,XX @@ static const int perm_table[2][8] = {
- };
- static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
--                                int *prot, int *access_index,
-+                                int *prot, int *access_index, MemTxAttrs *attrs,
-                                 target_ulong address, int rw, int mmu_idx,
-                                 target_ulong *page_size)
- {
-@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     target_ulong vaddr;
-     target_ulong page_size;
-     int error_code = 0, prot, access_index;
-+    MemTxAttrs attrs = {};
-     /*
-      * TODO: If we ever need tlb_vaddr_to_host for this target,
-@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     assert(!probe);
-     address &= TARGET_PAGE_MASK;
--    error_code = get_physical_address(env, &paddr, &prot, &access_index,
-+    error_code = get_physical_address(env, &paddr, &prot, &access_index, &attrs,
-                                       address, access_type,
-                                       mmu_idx, &page_size);
-     vaddr = address;
-@@ -XXX,XX +XXX,XX @@ static inline int ultrasparc_tag_match(SparcTLBEntry *tlb,
-     return 0;
- }
--static int get_physical_address_data(CPUSPARCState *env,
--                                     hwaddr *physical, int *prot,
-+static int get_physical_address_data(CPUSPARCState *env, hwaddr *physical,
-+                                     int *prot, MemTxAttrs *attrs,
-                                      target_ulong address, int rw, int mmu_idx)
- {
-     CPUState *cs = env_cpu(env);
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_data(CPUSPARCState *env,
-     return 1;
- }
--static int get_physical_address_code(CPUSPARCState *env,
--                                     hwaddr *physical, int *prot,
-+static int get_physical_address_code(CPUSPARCState *env, hwaddr *physical,
-+                                     int *prot, MemTxAttrs *attrs,
-                                      target_ulong address, int mmu_idx)
- {
-     CPUState *cs = env_cpu(env);
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address_code(CPUSPARCState *env,
- }
- static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
--                                int *prot, int *access_index,
-+                                int *prot, int *access_index, MemTxAttrs *attrs,
-                                 target_ulong address, int rw, int mmu_idx,
-                                 target_ulong *page_size)
- {
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
-     }
-     if (rw == 2) {
--        return get_physical_address_code(env, physical, prot, address,
-+        return get_physical_address_code(env, physical, prot, attrs, address,
-                                          mmu_idx);
-     } else {
--        return get_physical_address_data(env, physical, prot, address, rw,
--                                         mmu_idx);
-+        return get_physical_address_data(env, physical, prot, attrs, address,
-+                                         rw, mmu_idx);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     target_ulong vaddr;
-     hwaddr paddr;
-     target_ulong page_size;
-+    MemTxAttrs attrs = {};
-     int error_code = 0, prot, access_index;
-     address &= TARGET_PAGE_MASK;
--    error_code = get_physical_address(env, &paddr, &prot, &access_index,
-+    error_code = get_physical_address(env, &paddr, &prot, &access_index, &attrs,
-                                       address, access_type,
-                                       mmu_idx, &page_size);
-     if (likely(error_code == 0)) {
-@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                                    env->dmmu.mmu_primary_context,
-                                    env->dmmu.mmu_secondary_context);
--        tlb_set_page(cs, vaddr, paddr, prot, mmu_idx, page_size);
-+        tlb_set_page_with_attrs(cs, vaddr, paddr, attrs, prot, mmu_idx,
-+                                page_size);
-         return true;
-     }
-     if (probe) {
-@@ -XXX,XX +XXX,XX @@ static int cpu_sparc_get_phys_page(CPUSPARCState *env, hwaddr *phys,
- {
-     target_ulong page_size;
-     int prot, access_index;
-+    MemTxAttrs attrs = {};
--    return get_physical_address(env, phys, &prot, &access_index, addr, rw,
--                                mmu_idx, &page_size);
-+    return get_physical_address(env, phys, &prot, &access_index, &attrs, addr,
-+                                rw, mmu_idx, &page_size);
- }
- #if defined(TARGET_SPARC64)
---
-.17.1

-[Qemu-devel] [PATCH 21/36] exec: Factor out core logic of check_watchpoint()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-We want to perform the same checks in probe_write() to trigger a cpu
-exit before doing any modifications. We'll have to pass a PC.
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20190823100741.9621-9-david@redhat.com>
-[rth: Use vaddr for len, like other watchpoint functions;
-Move user-only stub to static inline.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/hw/core/cpu.h |  7 +++++++
- exec.c                | 26 ++++++++++++++++++--------
-files changed, 25 insertions(+), 8 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_watchpoint_remove_by_ref(CPUState *cpu,
- static inline void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
- {
- }
-+
-+static inline void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-+                                        MemTxAttrs atr, int fl, uintptr_t ra)
-+{
-+}
- #else
- int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
-                           int flags, CPUWatchpoint **watchpoint);
-@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
-                           vaddr len, int flags);
- void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
- void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
-+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-+                          MemTxAttrs attrs, int flags, uintptr_t ra);
- #endif
- /**
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps notdirty_mem_ops = {
- };
- /* Generate a debug exception if a watchpoint has been hit.  */
--static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-+                          MemTxAttrs attrs, int flags, uintptr_t ra)
- {
--    CPUState *cpu = current_cpu;
-     CPUClass *cc = CPU_GET_CLASS(cpu);
--    target_ulong vaddr;
-     CPUWatchpoint *wp;
-     assert(tcg_enabled());
-@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-         cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-         return;
-     }
--    vaddr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
--    vaddr = cc->adjust_watchpoint_address(cpu, vaddr, len);
-+
-+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
--        if (cpu_watchpoint_address_matches(wp, vaddr, len)
-+        if (cpu_watchpoint_address_matches(wp, addr, len)
-             && (wp->flags & flags)) {
-             if (flags == BP_MEM_READ) {
-                 wp->flags |= BP_WATCHPOINT_HIT_READ;
-             } else {
-                 wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-             }
--            wp->hitaddr = vaddr;
-+            wp->hitaddr = MAX(addr, wp->vaddr);
-             wp->hitattrs = attrs;
-             if (!cpu->watchpoint_hit) {
-                 if (wp->flags & BP_CPU &&
-@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-                     cpu->exception_index = EXCP_DEBUG;
-                     mmap_unlock();
--                    cpu_loop_exit(cpu);
-+                    cpu_loop_exit_restore(cpu, ra);
-                 } else {
-                     /* Force execution of one insn next time.  */
-                     cpu->cflags_next_tb = 1 | curr_cflags();
-                     mmap_unlock();
-+                    if (ra) {
-+                        cpu_restore_state(cpu, ra, true);
-+                    }
-                     cpu_loop_exit_noexc(cpu);
-                 }
-             }
-@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-     }
- }
-+static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-+{
-+    CPUState *cpu = current_cpu;
-+    vaddr addr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
-+
-+    cpu_check_watchpoint(cpu, addr, len, attrs, flags, 0);
-+}
-+
- /* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
-    so these check for a hit then pass through to the normal out-of-line
-    phys routines.  */
---
-.17.1

-[Qemu-devel] [PATCH 22/36] cputlb: Fold TLB_RECHECK into TLB_INVALID_MASK
+Deleted patch
-We had two different mechanisms to force a recheck of the tlb.
-Before TLB_RECHECK was introduced, we had a PAGE_WRITE_INV bit
-that would immediate set TLB_INVALID_MASK, which automatically
-means that a second check of the tlb entry fails.
-We can use the same mechanism to handle small pages.
-Conserve TLB_* bits by removing TLB_RECHECK.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/cpu-all.h |  5 +--
- accel/tcg/cputlb.c     | 86 +++++++++++-------------------------------
-files changed, 24 insertions(+), 67 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
-+++ b/include/exec/cpu-all.h
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
- #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
- /* Set if TLB entry is an IO callback.  */
- #define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
--/* Set if TLB entry must have MMU lookup repeated for every access */
--#define TLB_RECHECK         (1 << (TARGET_PAGE_BITS - 4))
- /* Use this mask to check interception with an alignment mask
-  * in a TCG backend.
-  */
--#define TLB_FLAGS_MASK  (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
--                         | TLB_RECHECK)
-+#define TLB_FLAGS_MASK  (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO)
- /**
-  * tlb_hit_page: return true if page aligned @addr is a hit against the
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-     address = vaddr_page;
-     if (size < TARGET_PAGE_SIZE) {
--        /*
--         * Slow-path the TLB entries; we will repeat the MMU check and TLB
--         * fill on every access.
--         */
--        address |= TLB_RECHECK;
-+        /* Repeat the MMU check and TLB fill on every access.  */
-+        address |= TLB_INVALID_MASK;
-     }
-     if (attrs.byte_swap) {
-         /* Force the access through the I/O slow path.  */
-@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
-   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
-                  (ADDR) & TARGET_PAGE_MASK)
--/* NOTE: this function can trigger an exception */
--/* NOTE2: the returned address is not exactly the physical address: it
-- * is actually a ram_addr_t (in system mode; the user mode emulation
-- * version of this function returns a guest virtual address).
-+/*
-+ * Return a ram_addr_t for the virtual address for execution.
-+ *
-+ * Return -1 if we can't translate and execute from an entire page
-+ * of RAM.  This will force us to execute by loading and translating
-+ * one insn at a time, without caching.
-+ *
-+ * NOTE: This function will trigger an exception if the page is
-+ * not executable.
-  */
- tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
- {
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-             tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-             index = tlb_index(env, mmu_idx, addr);
-             entry = tlb_entry(env, mmu_idx, addr);
-+
-+            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
-+                /*
-+                 * The MMU protection covers a smaller range than a target
-+                 * page, so we must redo the MMU check for every insn.
-+                 */
-+                return -1;
-+            }
-         }
-         assert(tlb_hit(entry->addr_code, addr));
-     }
--    if (unlikely(entry->addr_code & (TLB_RECHECK | TLB_MMIO))) {
--        /*
--         * Return -1 if we can't translate and execute from an entire
--         * page of RAM here, which will cause us to execute by loading
--         * and translating one insn at a time, without caching:
--         *  - TLB_RECHECK: means the MMU protection covers a smaller range
--         *    than a target page, so we must redo the MMU check every insn
--         *  - TLB_MMIO: region is not backed by RAM
--         */
-+    if (unlikely(entry->addr_code & TLB_MMIO)) {
-+        /* The region is not backed by RAM.  */
-         return -1;
-     }
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-     }
-     /* Notice an IO access or a needs-MMU-lookup access */
--    if (unlikely(tlb_addr & (TLB_MMIO | TLB_RECHECK))) {
-+    if (unlikely(tlb_addr & TLB_MMIO)) {
-         /* There's really nothing that can be done to
-            support this apart from stop-the-world.  */
-         goto stop_the_world;
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-             entry = tlb_entry(env, mmu_idx, addr);
-         }
-         tlb_addr = code_read ? entry->addr_code : entry->addr_read;
-+        tlb_addr &= ~TLB_INVALID_MASK;
-     }
-     /* Handle an IO access.  */
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-         if ((addr & (size - 1)) != 0) {
-             goto do_unaligned_access;
-         }
--
--        if (tlb_addr & TLB_RECHECK) {
--            /*
--             * This is a TLB_RECHECK access, where the MMU protection
--             * covers a smaller range than a target page, and we must
--             * repeat the MMU check here. This tlb_fill() call might
--             * longjump out if this access should cause a guest exception.
--             */
--            tlb_fill(env_cpu(env), addr, size,
--                     access_type, mmu_idx, retaddr);
--            index = tlb_index(env, mmu_idx, addr);
--            entry = tlb_entry(env, mmu_idx, addr);
--
--            tlb_addr = code_read ? entry->addr_code : entry->addr_read;
--            tlb_addr &= ~TLB_RECHECK;
--            if (!(tlb_addr & ~TARGET_PAGE_MASK)) {
--                /* RAM access */
--                goto do_aligned_access;
--            }
--        }
--
-         return io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
-                         mmu_idx, addr, retaddr, access_type, op);
-     }
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-         return res & MAKE_64BIT_MASK(0, size * 8);
-     }
-- do_aligned_access:
-     haddr = (void *)((uintptr_t)addr + entry->addend);
-     switch (op) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         if ((addr & (size - 1)) != 0) {
-             goto do_unaligned_access;
-         }
--
--        if (tlb_addr & TLB_RECHECK) {
--            /*
--             * This is a TLB_RECHECK access, where the MMU protection
--             * covers a smaller range than a target page, and we must
--             * repeat the MMU check here. This tlb_fill() call might
--             * longjump out if this access should cause a guest exception.
--             */
--            tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
--                     mmu_idx, retaddr);
--            index = tlb_index(env, mmu_idx, addr);
--            entry = tlb_entry(env, mmu_idx, addr);
--
--            tlb_addr = tlb_addr_write(entry);
--            tlb_addr &= ~TLB_RECHECK;
--            if (!(tlb_addr & ~TARGET_PAGE_MASK)) {
--                /* RAM access */
--                goto do_aligned_access;
--            }
--        }
--
-         io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
-                   val, addr, retaddr, op);
-         return;
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         return;
-     }
-- do_aligned_access:
-     haddr = (void *)((uintptr_t)addr + entry->addend);
-     switch (op) {
-     case MO_UB:
---
-.17.1

-[Qemu-devel] [PATCH 23/36] exec: Factor out cpu_watchpoint_address_matches
+Deleted patch
-We want to move the check for watchpoints from
-memory_region_section_get_iotlb to tlb_set_page_with_attrs.
-Isolate the loop over watchpoints to an exported function.
-Rename the existing cpu_watchpoint_address_matches to
-watchpoint_address_matches, since it doesn't actually
-have a cpu argument.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/hw/core/cpu.h |  7 +++++++
- exec.c                | 45 ++++++++++++++++++++++++++++---------------
-files changed, 36 insertions(+), 16 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                                         MemTxAttrs atr, int fl, uintptr_t ra)
- {
- }
-+
-+static inline int cpu_watchpoint_address_matches(CPUState *cpu,
-+                                                 vaddr addr, vaddr len)
-+{
-+    return 0;
-+}
- #else
- int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
-                           int flags, CPUWatchpoint **watchpoint);
-@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
- void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
- void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                           MemTxAttrs attrs, int flags, uintptr_t ra);
-+int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);
- #endif
- /**
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
-  * partially or completely with the address range covered by the
-  * access).
-  */
--static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,
--                                                  vaddr addr,
--                                                  vaddr len)
-+static inline bool watchpoint_address_matches(CPUWatchpoint *wp,
-+                                              vaddr addr, vaddr len)
- {
-     /* We know the lengths are non-zero, but a little caution is
-      * required to avoid errors in the case where the range ends
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,
-     return !(addr > wpend || wp->vaddr > addrend);
- }
-+
-+/* Return flags for watchpoints that match addr + prot.  */
-+int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
-+{
-+    CPUWatchpoint *wp;
-+    int ret = 0;
-+
-+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-+        if (watchpoint_address_matches(wp, addr, TARGET_PAGE_SIZE)) {
-+            ret |= wp->flags;
-+        }
-+    }
-+    return ret;
-+}
- #endif /* !CONFIG_USER_ONLY */
- /* Add a breakpoint.  */
-@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                        target_ulong *address)
- {
-     hwaddr iotlb;
--    CPUWatchpoint *wp;
-+    int flags, match;
-     if (memory_region_is_ram(section->mr)) {
-         /* Normal RAM.  */
-@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-         iotlb += xlat;
-     }
--    /* Make accesses to pages with watchpoints go via the
--       watchpoint trap routines.  */
--    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
--        if (cpu_watchpoint_address_matches(wp, vaddr, TARGET_PAGE_SIZE)) {
--            /* Avoid trapping reads of pages with a write breakpoint. */
--            if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
--                iotlb = PHYS_SECTION_WATCH + paddr;
--                *address |= TLB_MMIO;
--                break;
--            }
--        }
-+    /* Avoid trapping reads of pages with a write breakpoint. */
-+    match = (prot & PAGE_READ ? BP_MEM_READ : 0)
-+          | (prot & PAGE_WRITE ? BP_MEM_WRITE : 0);
-+    flags = cpu_watchpoint_address_matches(cpu, vaddr, TARGET_PAGE_SIZE);
-+    if (flags & match) {
-+        /*
-+         * Make accesses to pages with watchpoints go via the
-+         * watchpoint trap routines.
-+         */
-+        iotlb = PHYS_SECTION_WATCH + paddr;
-+        *address |= TLB_MMIO;
-     }
-     return iotlb;
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-     addr = cc->adjust_watchpoint_address(cpu, addr, len);
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
--        if (cpu_watchpoint_address_matches(wp, addr, len)
-+        if (watchpoint_address_matches(wp, addr, len)
-             && (wp->flags & flags)) {
-             if (flags == BP_MEM_READ) {
-                 wp->flags |= BP_WATCHPOINT_HIT_READ;
---
-.17.1

-[Qemu-devel] [PATCH 24/36] cputlb: Fix size operand for tlb_fill on unaligned store
+Deleted patch
-We are currently passing the size of the full write to
-the tlb_fill for the second page.  Instead pass the real
-size of the write to that page.
-This argument is unused within all tlb_fill, except to be
-logged via tracing, so in practice this makes no difference.
-But in a moment we'll need the value of size2 for watchpoints,
-and if we've computed the value we might as well use it.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 5 ++++-
-file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         uintptr_t index2;
-         CPUTLBEntry *entry2;
-         target_ulong page2, tlb_addr2;
-+        size_t size2;
-+
-     do_unaligned_access:
-         /*
-          * Ensure the second page is in the TLB.  Note that the first page
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-          * cannot evict the first.
-          */
-         page2 = (addr + size) & TARGET_PAGE_MASK;
-+        size2 = (addr + size) & ~TARGET_PAGE_MASK;
-         index2 = tlb_index(env, mmu_idx, page2);
-         entry2 = tlb_entry(env, mmu_idx, page2);
-         tlb_addr2 = tlb_addr_write(entry2);
-         if (!tlb_hit_page(tlb_addr2, page2)
-             && !victim_tlb_hit(env, mmu_idx, index2, tlb_off,
-                                page2 & TARGET_PAGE_MASK)) {
--            tlb_fill(env_cpu(env), page2, size, MMU_DATA_STORE,
-+            tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
-                      mmu_idx, retaddr);
-         }
---
-.17.1

-[Qemu-devel] [PATCH 25/36] cputlb: Remove double-alignment in store_helper
+Deleted patch
-We have already aligned page2 to the start of the next page.
-There is no reason to do that a second time.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         entry2 = tlb_entry(env, mmu_idx, page2);
-         tlb_addr2 = tlb_addr_write(entry2);
-         if (!tlb_hit_page(tlb_addr2, page2)
--            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off,
--                               page2 & TARGET_PAGE_MASK)) {
-+            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
-             tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
-                      mmu_idx, retaddr);
-         }
---
-.17.1

-[Qemu-devel] [PATCH 26/36] cputlb: Handle watchpoints via TLB_WATCHPOINT
+Deleted patch
-The raising of exceptions from check_watchpoint, buried inside
-of the I/O subsystem, is fundamentally broken.  We do not have
-the helper return address with which we can unwind guest state.
-Replace PHYS_SECTION_WATCH and io_mem_watch with TLB_WATCHPOINT.
-Move the call to cpu_check_watchpoint into the cputlb helpers
-where we do have the helper return address.
-This allows watchpoints on RAM to bypass the full i/o access path.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/cpu-all.h |   5 +-
- accel/tcg/cputlb.c     |  89 ++++++++++++++++++++++++++++----
- exec.c                 | 114 +++--------------------------------------
-files changed, 90 insertions(+), 118 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
-+++ b/include/exec/cpu-all.h
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
- #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
- /* Set if TLB entry is an IO callback.  */
- #define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
-+/* Set if TLB entry contains a watchpoint.  */
-+#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
- /* Use this mask to check interception with an alignment mask
-  * in a TCG backend.
-  */
--#define TLB_FLAGS_MASK  (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO)
-+#define TLB_FLAGS_MASK \
-+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
- /**
-  * tlb_hit_page: return true if page aligned @addr is a hit against the
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-     hwaddr iotlb, xlat, sz, paddr_page;
-     target_ulong vaddr_page;
-     int asidx = cpu_asidx_from_attrs(cpu, attrs);
-+    int wp_flags;
-     assert_cpu_is_self(cpu);
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-     code_address = address;
-     iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
-                                             paddr_page, xlat, prot, &address);
-+    wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
-+                                              TARGET_PAGE_SIZE);
-     index = tlb_index(env, mmu_idx, vaddr_page);
-     te = tlb_entry(env, mmu_idx, vaddr_page);
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-     tn.addend = addend - vaddr_page;
-     if (prot & PAGE_READ) {
-         tn.addr_read = address;
-+        if (wp_flags & BP_MEM_READ) {
-+            tn.addr_read |= TLB_WATCHPOINT;
-+        }
-     } else {
-         tn.addr_read = -1;
-     }
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-         if (prot & PAGE_WRITE_INV) {
-             tn.addr_write |= TLB_INVALID_MASK;
-         }
-+        if (wp_flags & BP_MEM_WRITE) {
-+            tn.addr_write |= TLB_WATCHPOINT;
-+        }
-     }
-     copy_tlb_helper_locked(te, &tn);
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-         tlb_addr &= ~TLB_INVALID_MASK;
-     }
--    /* Handle an IO access.  */
-+    /* Handle anything that isn't just a straight memory access.  */
-     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-+        CPUIOTLBEntry *iotlbentry;
-+
-+        /* For anything that is unaligned, recurse through full_load.  */
-         if ((addr & (size - 1)) != 0) {
-             goto do_unaligned_access;
-         }
--        return io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
--                        mmu_idx, addr, retaddr, access_type, op);
-+
-+        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
-+
-+        /* Handle watchpoints.  */
-+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
-+            /* On watchpoint hit, this will longjmp out.  */
-+            cpu_check_watchpoint(env_cpu(env), addr, size,
-+                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
-+
-+            /* The backing page may or may not require I/O.  */
-+            tlb_addr &= ~TLB_WATCHPOINT;
-+            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-+                goto do_aligned_access;
-+            }
-+        }
-+
-+        /* Handle I/O access.  */
-+        return io_readx(env, iotlbentry, mmu_idx, addr,
-+                        retaddr, access_type, op);
-     }
-     /* Handle slow unaligned access (it spans two pages or IO).  */
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-         return res & MAKE_64BIT_MASK(0, size * 8);
-     }
-+ do_aligned_access:
-     haddr = (void *)((uintptr_t)addr + entry->addend);
-     switch (op) {
-     case MO_UB:
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
-     }
--    /* Handle an IO access.  */
-+    /* Handle anything that isn't just a straight memory access.  */
-     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-+        CPUIOTLBEntry *iotlbentry;
-+
-+        /* For anything that is unaligned, recurse through byte stores.  */
-         if ((addr & (size - 1)) != 0) {
-             goto do_unaligned_access;
-         }
--        io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
--                  val, addr, retaddr, op);
-+
-+        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
-+
-+        /* Handle watchpoints.  */
-+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
-+            /* On watchpoint hit, this will longjmp out.  */
-+            cpu_check_watchpoint(env_cpu(env), addr, size,
-+                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
-+
-+            /* The backing page may or may not require I/O.  */
-+            tlb_addr &= ~TLB_WATCHPOINT;
-+            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-+                goto do_aligned_access;
-+            }
-+        }
-+
-+        /* Handle I/O access.  */
-+        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         index2 = tlb_index(env, mmu_idx, page2);
-         entry2 = tlb_entry(env, mmu_idx, page2);
-         tlb_addr2 = tlb_addr_write(entry2);
--        if (!tlb_hit_page(tlb_addr2, page2)
--            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
--            tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
--                     mmu_idx, retaddr);
-+        if (!tlb_hit_page(tlb_addr2, page2)) {
-+            if (!victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
-+                tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
-+                         mmu_idx, retaddr);
-+                index2 = tlb_index(env, mmu_idx, page2);
-+                entry2 = tlb_entry(env, mmu_idx, page2);
-+            }
-+            tlb_addr2 = tlb_addr_write(entry2);
-+        }
-+
-+        /*
-+         * Handle watchpoints.  Since this may trap, all checks
-+         * must happen before any store.
-+         */
-+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
-+            cpu_check_watchpoint(env_cpu(env), addr, size - size2,
-+                                 env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
-+                                 BP_MEM_WRITE, retaddr);
-+        }
-+        if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
-+            cpu_check_watchpoint(env_cpu(env), page2, size2,
-+                                 env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
-+                                 BP_MEM_WRITE, retaddr);
-         }
-         /*
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-         return;
-     }
-+ do_aligned_access:
-     haddr = (void *)((uintptr_t)addr + entry->addend);
-     switch (op) {
-     case MO_UB:
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
- #define PHYS_SECTION_UNASSIGNED 0
- #define PHYS_SECTION_NOTDIRTY 1
- #define PHYS_SECTION_ROM 2
--#define PHYS_SECTION_WATCH 3
- static void io_mem_init(void);
- static void memory_map_init(void);
- static void tcg_log_global_after_sync(MemoryListener *listener);
- static void tcg_commit(MemoryListener *listener);
--static MemoryRegion io_mem_watch;
--
- /**
-  * CPUAddressSpace: all the information a CPU needs about an AddressSpace
-  * @cpu: the CPU whose AddressSpace this is
-@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                        target_ulong *address)
- {
-     hwaddr iotlb;
--    int flags, match;
-     if (memory_region_is_ram(section->mr)) {
-         /* Normal RAM.  */
-@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-         iotlb += xlat;
-     }
--    /* Avoid trapping reads of pages with a write breakpoint. */
--    match = (prot & PAGE_READ ? BP_MEM_READ : 0)
--          | (prot & PAGE_WRITE ? BP_MEM_WRITE : 0);
--    flags = cpu_watchpoint_address_matches(cpu, vaddr, TARGET_PAGE_SIZE);
--    if (flags & match) {
--        /*
--         * Make accesses to pages with watchpoints go via the
--         * watchpoint trap routines.
--         */
--        iotlb = PHYS_SECTION_WATCH + paddr;
--        *address |= TLB_MMIO;
--    }
--
-     return iotlb;
- }
- #endif /* defined(CONFIG_USER_ONLY) */
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-     assert(tcg_enabled());
-     if (cpu->watchpoint_hit) {
--        /* We re-entered the check after replacing the TB. Now raise
--         * the debug interrupt so that is will trigger after the
--         * current instruction. */
-+        /*
-+         * We re-entered the check after replacing the TB.
-+         * Now raise the debug interrupt so that it will
-+         * trigger after the current instruction.
-+         */
-+        qemu_mutex_lock_iothread();
-         cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-+        qemu_mutex_unlock_iothread();
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-     }
- }
--static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
--{
--    CPUState *cpu = current_cpu;
--    vaddr addr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
--
--    cpu_check_watchpoint(cpu, addr, len, attrs, flags, 0);
--}
--
--/* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
--   so these check for a hit then pass through to the normal out-of-line
--   phys routines.  */
--static MemTxResult watch_mem_read(void *opaque, hwaddr addr, uint64_t *pdata,
--                                  unsigned size, MemTxAttrs attrs)
--{
--    MemTxResult res;
--    uint64_t data;
--    int asidx = cpu_asidx_from_attrs(current_cpu, attrs);
--    AddressSpace *as = current_cpu->cpu_ases[asidx].as;
--
--    check_watchpoint(addr & ~TARGET_PAGE_MASK, size, attrs, BP_MEM_READ);
--    switch (size) {
--    case 1:
--        data = address_space_ldub(as, addr, attrs, &res);
--        break;
--    case 2:
--        data = address_space_lduw(as, addr, attrs, &res);
--        break;
--    case 4:
--        data = address_space_ldl(as, addr, attrs, &res);
--        break;
--    case 8:
--        data = address_space_ldq(as, addr, attrs, &res);
--        break;
--    default: abort();
--    }
--    *pdata = data;
--    return res;
--}
--
--static MemTxResult watch_mem_write(void *opaque, hwaddr addr,
--                                   uint64_t val, unsigned size,
--                                   MemTxAttrs attrs)
--{
--    MemTxResult res;
--    int asidx = cpu_asidx_from_attrs(current_cpu, attrs);
--    AddressSpace *as = current_cpu->cpu_ases[asidx].as;
--
--    check_watchpoint(addr & ~TARGET_PAGE_MASK, size, attrs, BP_MEM_WRITE);
--    switch (size) {
--    case 1:
--        address_space_stb(as, addr, val, attrs, &res);
--        break;
--    case 2:
--        address_space_stw(as, addr, val, attrs, &res);
--        break;
--    case 4:
--        address_space_stl(as, addr, val, attrs, &res);
--        break;
--    case 8:
--        address_space_stq(as, addr, val, attrs, &res);
--        break;
--    default: abort();
--    }
--    return res;
--}
--
--static const MemoryRegionOps watch_mem_ops = {
--    .read_with_attrs = watch_mem_read,
--    .write_with_attrs = watch_mem_write,
--    .endianness = DEVICE_NATIVE_ENDIAN,
--    .valid = {
--        .min_access_size = 1,
--        .max_access_size = 8,
--        .unaligned = false,
--    },
--    .impl = {
--        .min_access_size = 1,
--        .max_access_size = 8,
--        .unaligned = false,
--    },
--};
--
- static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
-                                  MemTxAttrs attrs, uint8_t *buf, hwaddr len);
- static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
-     memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
-                           NULL, UINT64_MAX);
-     memory_region_clear_global_locking(&io_mem_notdirty);
--
--    memory_region_init_io(&io_mem_watch, NULL, &watch_mem_ops, NULL,
--                          NULL, UINT64_MAX);
- }
- AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
-@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
-     assert(n == PHYS_SECTION_NOTDIRTY);
-     n = dummy_section(&d->map, fv, &io_mem_rom);
-     assert(n == PHYS_SECTION_ROM);
--    n = dummy_section(&d->map, fv, &io_mem_watch);
--    assert(n == PHYS_SECTION_WATCH);
-     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
---
-.17.1

-[Qemu-devel] [PATCH 27/36] tcg: Check for watchpoints in probe_write()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Let size > 0 indicate a promise to write to those bytes.
-Check for write watchpoints in the probed range.
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Message-Id: <20190823100741.9621-10-david@redhat.com>
-[rth: Recompute index after tlb_fill; check TLB_WATCHPOINT.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 15 +++++++++++++--
-file changed, 13 insertions(+), 2 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
- {
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
-     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-+    target_ulong tlb_addr = tlb_addr_write(entry);
--    if (!tlb_hit(tlb_addr_write(entry), addr)) {
--        /* TLB entry is for a different page */
-+    if (unlikely(!tlb_hit(tlb_addr, addr))) {
-         if (!VICTIM_TLB_HIT(addr_write, addr)) {
-             tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
-                      mmu_idx, retaddr);
-+            /* TLB resize via tlb_fill may have moved the entry. */
-+            index = tlb_index(env, mmu_idx, addr);
-+            entry = tlb_entry(env, mmu_idx, addr);
-         }
-+        tlb_addr = tlb_addr_write(entry);
-+    }
-+
-+    /* Handle watchpoints.  */
-+    if ((tlb_addr & TLB_WATCHPOINT) && size > 0) {
-+        cpu_check_watchpoint(env_cpu(env), addr, size,
-+                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
-+                             BP_MEM_WRITE, retaddr);
-     }
- }
---
-.17.1

-[Qemu-devel] [PATCH 28/36] s390x/tcg: Use guest_addr_valid() instead of h2g_valid() in probe_write_access()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-If I'm not completely wrong, we are dealing with guest addresses here
-and not with host addresses. Use the right check.
-Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper")
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <20190826075112.25637-2-david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/s390x/mem_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/mem_helper.c
-+++ b/target/s390x/mem_helper.c
-@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
-                         uintptr_t ra)
- {
- #ifdef CONFIG_USER_ONLY
--    if (!h2g_valid(addr) || !h2g_valid(addr + len - 1) ||
-+    if (!guest_addr_valid(addr) || !guest_addr_valid(addr + len - 1) ||
-         page_check_range(addr, len, PAGE_WRITE) < 0) {
-         s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
-     }
---
-.17.1

-[Qemu-devel] [PATCH 29/36] s390x/tcg: Fix length calculation in probe_write_access()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Hm... how did that "-" slip in (-TAGRET_PAGE_SIZE would be correct). This
-currently makes us exceed one page in a single probe_write() call,
-essentially leaving some memory unchecked.
-Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper")
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Message-Id: <20190826075112.25637-3-david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/s390x/mem_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/mem_helper.c
-+++ b/target/s390x/mem_helper.c
-@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
- #else
-     /* test the actual access, not just any access to the page due to LAP */
-     while (len) {
--        const uint64_t pagelen = -(addr | -TARGET_PAGE_MASK);
-+        const uint64_t pagelen = -(addr | TARGET_PAGE_MASK);
-         const uint64_t curlen = MIN(pagelen, len);
-         probe_write(env, addr, curlen, cpu_mmu_index(env, false), ra);
---
-.17.1

-[Qemu-devel] [PATCH 30/36] tcg: Factor out CONFIG_USER_ONLY probe_write() from s390x code
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Factor it out into common code. Similar to the !CONFIG_USER_ONLY variant,
-let's not allow to cross page boundaries.
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20190826075112.25637-4-david@redhat.com>
-[rth: Move cpu & cc variables inside if block.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/exec-all.h   |  4 ++--
- accel/tcg/user-exec.c     | 14 ++++++++++++++
- target/s390x/mem_helper.c |  7 -------
-files changed, 16 insertions(+), 9 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
- void tlb_set_page(CPUState *cpu, target_ulong vaddr,
-                   hwaddr paddr, int prot,
-                   int mmu_idx, target_ulong size);
--void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
--                 uintptr_t retaddr);
- #else
- static inline void tlb_init(CPUState *cpu)
- {
-@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
- {
- }
- #endif
-+void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-+                 uintptr_t retaddr);
- #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
-     g_assert_not_reached();
- }
-+void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-+                 uintptr_t retaddr)
-+{
-+    if (!guest_addr_valid(addr) ||
-+        page_check_range(addr, size, PAGE_WRITE) < 0) {
-+        CPUState *cpu = env_cpu(env);
-+        CPUClass *cc = CPU_GET_CLASS(cpu);
-+
-+        cc->tlb_fill(cpu, addr, size, MMU_DATA_STORE, MMU_USER_IDX, false,
-+                     retaddr);
-+        g_assert_not_reached();
-+    }
-+}
-+
- #if defined(__i386__)
- #if defined(__NetBSD__)
-diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/mem_helper.c
-+++ b/target/s390x/mem_helper.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(cu42)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t m3)
- void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
-                         uintptr_t ra)
- {
--#ifdef CONFIG_USER_ONLY
--    if (!guest_addr_valid(addr) || !guest_addr_valid(addr + len - 1) ||
--        page_check_range(addr, len, PAGE_WRITE) < 0) {
--        s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
--    }
--#else
-     /* test the actual access, not just any access to the page due to LAP */
-     while (len) {
-         const uint64_t pagelen = -(addr | TARGET_PAGE_MASK);
-@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
-         addr = wrap_address(env, addr + curlen);
-         len -= curlen;
-     }
--#endif
- }
- void HELPER(probe_write_access)(CPUS390XState *env, uint64_t addr, uint64_t len)
---
-.17.1

-[Qemu-devel] [PATCH 31/36] tcg: Enforce single page access in probe_write()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Let's enforce the interface restriction.
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20190826075112.25637-5-david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c    | 2 ++
- accel/tcg/user-exec.c | 2 ++
-files changed, 4 insertions(+)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-     target_ulong tlb_addr = tlb_addr_write(entry);
-+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
-+
-     if (unlikely(!tlb_hit(tlb_addr, addr))) {
-         if (!VICTIM_TLB_HIT(addr_write, addr)) {
-             tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
- void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-                  uintptr_t retaddr)
- {
-+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
-+
-     if (!guest_addr_valid(addr) ||
-         page_check_range(addr, size, PAGE_WRITE) < 0) {
-         CPUState *cpu = env_cpu(env);
---
-.17.1

-[Qemu-devel] [PATCH 32/36] mips/tcg: Call probe_write() for CONFIG_USER_ONLY as well
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-Let's call it also for CONFIG_USER_ONLY. While at it, add a FIXME and get
-rid of one local variable.
-MIPS code probably needs a bigger refactoring in regards of
-ensure_writable_pages(), similar to s390x, so for example, watchpoints
-can be handled reliably later. The actually accessed addresses should
-be probed only, not full pages.
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Message-Id: <20190826075112.25637-6-david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/mips/op_helper.c | 8 +++-----
-file changed, 3 insertions(+), 5 deletions(-)
-diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/op_helper.c
-+++ b/target/mips/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void ensure_writable_pages(CPUMIPSState *env,
-                                          int mmu_idx,
-                                          uintptr_t retaddr)
- {
--#if !defined(CONFIG_USER_ONLY)
--    target_ulong page_addr;
-+    /* FIXME: Probe the actual accesses (pass and use a size) */
-     if (unlikely(MSA_PAGESPAN(addr))) {
-         /* first page */
-         probe_write(env, addr, 0, mmu_idx, retaddr);
-         /* second page */
--        page_addr = (addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
--        probe_write(env, page_addr, 0, mmu_idx, retaddr);
-+        addr = (addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-+        probe_write(env, addr, 0, mmu_idx, retaddr);
-     }
--#endif
- }
- void helper_msa_st_b(CPUMIPSState *env, uint32_t wd,
---
-.17.1

-[Qemu-devel] [PATCH 34/36] s390x/tcg: Pass a size to probe_write() in do_csst()
+Deleted patch
-From: David Hildenbrand <david@redhat.com>
-... and also call it for CONFIG_USER_ONLY. This function probably will
-also need some refactoring in regards to probing, however, we'll have to
-come back to that later, once cleaning up the other mem helpers.
-The alignment check always makes sure that the write access falls into a
-single page.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Message-Id: <20190826075112.25637-8-david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/s390x/mem_helper.c | 4 +---
-file changed, 1 insertion(+), 3 deletions(-)
-diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/mem_helper.c
-+++ b/target/s390x/mem_helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t do_csst(CPUS390XState *env, uint32_t r3, uint64_t a1,
-     }
-     /* Sanity check writability of the store address.  */
--#ifndef CONFIG_USER_ONLY
--    probe_write(env, a2, 0, mem_idx, ra);
--#endif
-+    probe_write(env, a2, 1 << sc, mem_idx, ra);
-     /*
-      * Note that the compare-and-swap is atomic, and the store is atomic,
---
-.17.1

-[Qemu-devel] [PATCH 35/36] tcg: Make probe_write() return a pointer to the host page
+[PULL v2 8/8] sysemu/os-win32: fix setjmp/longjmp on windows-arm64
-From: David Hildenbrand <david@redhat.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-... similar to tlb_vaddr_to_host(); however, allow access to the host
+Windows implementation of setjmp/longjmp is done in
-page except when TLB_NOTDIRTY or TLB_MMIO is set.
+C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
 perform stack unwinding, which crashes from generated code.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+By using alternative implementation built in mingw, we avoid doing stack
-Signed-off-by: David Hildenbrand <david@redhat.com>
+unwinding and this fixes crash when calling longjmp.
-Message-Id: <20190830100959.26615-2-david@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h |  4 ++--
+ include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
- accel/tcg/cputlb.c      | 21 ++++++++++++++++-----
+ meson.build               | 21 +++++++++++++++++++++
- accel/tcg/user-exec.c   |  6 ++++--
+files changed, 45 insertions(+), 4 deletions(-)
 files changed, 22 insertions(+), 9 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/include/sysemu/os-win32.h
-+++ b/include/exec/exec-all.h
++++ b/include/sysemu/os-win32.h
-@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
- {
+ extern "C" {
  }
  #endif
--void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
--                 uintptr_t retaddr);
+-#if defined(_WIN64)
-+void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
+-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
-+                  uintptr_t retaddr);
++#if defined(__aarch64__)
++/*
- #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
++ * On windows-arm64, setjmp is available in only one variant, and longjmp always
++ * does stack unwinding. This crash with generated code.
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
++ * Thus, we use another implementation of setjmp (not windows one), coming from
 + * mingw, which never performs stack unwinding.
 + */
 +#undef setjmp
 +#undef longjmp
 +/*
 + * These functions are not declared in setjmp.h because __aarch64__ defines
 + * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
 + * which gets linked automatically.
 + */
 +extern int __mingw_setjmp(jmp_buf);
 +extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
 +#define setjmp(env) __mingw_setjmp(env)
 +#define longjmp(env, val) __mingw_longjmp(env, val)
 +#elif defined(_WIN64)
 +/*
 + * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
   * If this parameter is NULL, longjump does no stack unwinding.
   * That is what we need for QEMU. Passing the value of register rsp (default)
 - * lets longjmp try a stack unwinding which will crash with generated code. */
 + * lets longjmp try a stack unwinding which will crash with generated code.
 + */
  # undef setjmp
  # define setjmp(env) _setjmp(env, NULL)
 -#endif
 +#endif /* __aarch64__ */
  /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
   * "longjmp and don't touch the signal masks". Since we know that the
   * savemask parameter will always be zero we can safely define these
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/meson.build
-+++ b/accel/tcg/cputlb.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
- /* Probe for whether the specified guest write access is permitted.
+     }''', name: '_lock_file and _unlock_file'))
-  * If it is not permitted then an exception will be taken in the same
+ endif
-  * way as if this were a real write access (and we will not return).
-- * Otherwise the function will return, and there will be a valid
++if targetos == 'windows'
-- * entry in the TLB for this access.
++  mingw_has_setjmp_longjmp = cc.links('''
-+ * If the size is 0 or the page requires I/O access, returns NULL; otherwise,
++    #include <setjmp.h>
-+ * returns the address of the host page similar to tlb_vaddr_to_host().
++    int main(void) {
-  */
++      /*
--void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
++       * These functions are not available in setjmp header, but may be
--                 uintptr_t retaddr)
++       * available at link time, from libmingwex.a.
-+void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
++       */
-+                  uintptr_t retaddr)
++      extern int __mingw_setjmp(jmp_buf);
- {
++      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
++      jmp_buf env;
-     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
++      __mingw_setjmp(env);
-@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
++      __mingw_longjmp(env, 0);
          tlb_addr = tlb_addr_write(entry);
      }
 +    if (!size) {
 +        return NULL;
 +    }
++  ''', name: 'mingw setjmp and longjmp')
 +
-     /* Handle watchpoints.  */
++  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
--    if ((tlb_addr & TLB_WATCHPOINT) && size > 0) {
++    error('mingw must provide setjmp/longjmp for windows-arm64')
-+    if (tlb_addr & TLB_WATCHPOINT) {
++  endif
-         cpu_check_watchpoint(env_cpu(env), addr, size,
++endif
                               env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
                               BP_MEM_WRITE, retaddr);
      }
 +
-+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
+ ########################
-+        /* I/O access */
+ # Target configuration #
-+        return NULL;
+ ########################
 +    }
 +
 +    return (void *)((uintptr_t)addr + entry->addend);
  }
  void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
      g_assert_not_reached();
  }
 -void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
 -                 uintptr_t retaddr)
 +void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
 +                  uintptr_t retaddr)
  {
      g_assert(-(addr | TARGET_PAGE_MASK) >= size);
@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
                       retaddr);
          g_assert_not_reached();
      }
 +
 +    return size ? g2h(addr) : NULL;
  }
  #if defined(__i386__)
 --
-.17.1
+.34.1

The following changes since commit fec105c2abda8567ec15230429c41429b5ee307c:

Merge remote-tracking branch 'remotes/kraxel/tags/audio-20190828-pull-request' into staging (2019-09-03 14:03:15 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20190903

for you to fetch changes up to c25c283df0f08582df29f1d5d7be1516b851532d:

tcg: Factor out probe_write() logic into probe_access() (2019-09-03 08:34:18 -0700)

----------------------------------------------------------------
Allow page table bit to swap endianness.
Reorganize watchpoints out of i/o path.
Return host address from probe_write / probe_access.

----------------------------------------------------------------
David Hildenbrand (11):
      exec: Factor out core logic of check_watchpoint()
      tcg: Check for watchpoints in probe_write()
      s390x/tcg: Use guest_addr_valid() instead of h2g_valid() in probe_write_access()
      s390x/tcg: Fix length calculation in probe_write_access()
      tcg: Factor out CONFIG_USER_ONLY probe_write() from s390x code
      tcg: Enforce single page access in probe_write()
      mips/tcg: Call probe_write() for CONFIG_USER_ONLY as well
      hppa/tcg: Call probe_write() also for CONFIG_USER_ONLY
      s390x/tcg: Pass a size to probe_write() in do_csst()
      tcg: Make probe_write() return a pointer to the host page
      tcg: Factor out probe_write() logic into probe_access()

Richard Henderson (6):
      exec: Move user-only watchpoint stubs inline
      cputlb: Fold TLB_RECHECK into TLB_INVALID_MASK
      exec: Factor out cpu_watchpoint_address_matches
      cputlb: Fix size operand for tlb_fill on unaligned store
      cputlb: Remove double-alignment in store_helper
      cputlb: Handle watchpoints via TLB_WATCHPOINT

Tony Nguyen (19):
      tcg: TCGMemOp is now accelerator independent MemOp
      memory: Introduce size_memop
      target/mips: Access MemoryRegion with MemOp
      hw/s390x: Access MemoryRegion with MemOp
      hw/intc/armv7m_nic: Access MemoryRegion with MemOp
      hw/virtio: Access MemoryRegion with MemOp
      hw/vfio: Access MemoryRegion with MemOp
      exec: Access MemoryRegion with MemOp
      cputlb: Access MemoryRegion with MemOp
      memory: Access MemoryRegion with MemOp
      hw/s390x: Hard code size with MO_{8|16|32|64}
      target/mips: Hard code size with MO_{8|16|32|64}
      exec: Hard code size with MO_{8|16|32|64}
      memory: Access MemoryRegion with endianness
      cputlb: Replace size and endian operands for MemOp
      memory: Single byte swap along the I/O path
      cputlb: Byte swap memory transaction attribute
      target/sparc: Add TLB entry with attributes
      target/sparc: sun4u Invert Endian TTE bit

From: Tony Nguyen <tony.nguyen@bt.com>

Preparation for collapsing the two byte swaps, adjust_endianness and
handle_bswap, along the I/O path.

Target dependant attributes are conditionalized upon NEED_CPU_H.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <81d9cd7d7f5aaadfa772d6c48ecee834e9cf7882.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memop.h                    | 110 ++++++++++++++++++++
 target/arm/translate-a64.h              |   2 +-
 target/arm/translate.h                  |   2 +-
 tcg/tcg-op.h                            |  80 +++++++-------
 tcg/tcg.h                               | 101 ++----------------
 trace/mem-internal.h                    |   4 +-
 trace/mem.h                             |   4 +-
 accel/tcg/cputlb.c                      |   2 +-
 target/alpha/translate.c                |   2 +-
 target/arm/translate-a64.c              |  48 ++++-----
 target/arm/translate-sve.c              |   2 +-
 target/arm/translate.c                  |  32 +++---
 target/hppa/translate.c                 |  14 +--
 target/i386/translate.c                 | 132 ++++++++++++------------
 target/m68k/translate.c                 |   2 +-
 target/microblaze/translate.c           |   4 +-
 target/mips/translate.c                 |   8 +-
 target/openrisc/translate.c             |   4 +-
 target/ppc/translate.c                  |  12 +--
 target/riscv/insn_trans/trans_rva.inc.c |   8 +-
 target/riscv/insn_trans/trans_rvi.inc.c |   4 +-
 target/s390x/translate.c                |   6 +-
 target/s390x/translate_vx.inc.c         |  10 +-
 target/sparc/translate.c                |  14 +--
 target/tilegx/translate.c               |  10 +-
 target/tricore/translate.c              |   8 +-
 tcg/aarch64/tcg-target.inc.c            |  26 ++---
 tcg/arm/tcg-target.inc.c                |  26 ++---
 tcg/i386/tcg-target.inc.c               |  24 ++---
 tcg/mips/tcg-target.inc.c               |  16 +--
 tcg/optimize.c                          |   2 +-
 tcg/ppc/tcg-target.inc.c                |  12 +--
 tcg/riscv/tcg-target.inc.c              |  20 ++--
 tcg/s390/tcg-target.inc.c               |  14 +--
 tcg/sparc/tcg-target.inc.c              |   6 +-
 tcg/tcg-op.c                            |  38 +++----
 tcg/tcg.c                               |   2 +-
 MAINTAINERS                             |   1 +
 tcg/README                              |   2 +-
 39 files changed, 418 insertions(+), 396 deletions(-)
 create mode 100644 include/exec/memop.h

diff --git a/include/exec/memop.h b/include/exec/memop.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/exec/memop.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Constants for memory operations
+ *
+ * Authors:
+ *  Richard Henderson <rth@twiddle.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef MEMOP_H
+#define MEMOP_H
+
+typedef enum MemOp {
+    MO_8     = 0,
+    MO_16    = 1,
+    MO_32    = 2,
+    MO_64    = 3,
+    MO_SIZE  = 3,   /* Mask for the above.  */
+
+    MO_SIGN  = 4,   /* Sign-extended, otherwise zero-extended.  */
+
+    MO_BSWAP = 8,   /* Host reverse endian.  */
+#ifdef HOST_WORDS_BIGENDIAN
+    MO_LE    = MO_BSWAP,
+    MO_BE    = 0,
+#else
+    MO_LE    = 0,
+    MO_BE    = MO_BSWAP,
+#endif
+#ifdef NEED_CPU_H
+#ifdef TARGET_WORDS_BIGENDIAN
+    MO_TE    = MO_BE,
+#else
+    MO_TE    = MO_LE,
+#endif
+#endif
+
+    /*
+     * MO_UNALN accesses are never checked for alignment.
+     * MO_ALIGN accesses will result in a call to the CPU's
+     * do_unaligned_access hook if the guest address is not aligned.
+     * The default depends on whether the target CPU defines
+     * TARGET_ALIGNED_ONLY.
+     *
+     * Some architectures (e.g. ARMv8) need the address which is aligned
+     * to a size more than the size of the memory access.
+     * Some architectures (e.g. SPARCv9) need an address which is aligned,
+     * but less strictly than the natural alignment.
+     *
+     * MO_ALIGN supposes the alignment size is the size of a memory access.
+     *
+     * There are three options:
+     * - unaligned access permitted (MO_UNALN).
+     * - an alignment to the size of an access (MO_ALIGN);
+     * - an alignment to a specified size, which may be more or less than
+     *   the access size (MO_ALIGN_x where 'x' is a size in bytes);
+     */
+    MO_ASHIFT = 4,
+    MO_AMASK = 7 << MO_ASHIFT,
+#ifdef NEED_CPU_H
+#ifdef TARGET_ALIGNED_ONLY
+    MO_ALIGN = 0,
+    MO_UNALN = MO_AMASK,
+#else
+    MO_ALIGN = MO_AMASK,
+    MO_UNALN = 0,
+#endif
+#endif
+    MO_ALIGN_2  = 1 << MO_ASHIFT,
+    MO_ALIGN_4  = 2 << MO_ASHIFT,
+    MO_ALIGN_8  = 3 << MO_ASHIFT,
+    MO_ALIGN_16 = 4 << MO_ASHIFT,
+    MO_ALIGN_32 = 5 << MO_ASHIFT,
+    MO_ALIGN_64 = 6 << MO_ASHIFT,
+
+    /* Combinations of the above, for ease of use.  */
+    MO_UB    = MO_8,
+    MO_UW    = MO_16,
+    MO_UL    = MO_32,
+    MO_SB    = MO_SIGN | MO_8,
+    MO_SW    = MO_SIGN | MO_16,
+    MO_SL    = MO_SIGN | MO_32,
+    MO_Q     = MO_64,
+
+    MO_LEUW  = MO_LE | MO_UW,
+    MO_LEUL  = MO_LE | MO_UL,
+    MO_LESW  = MO_LE | MO_SW,
+    MO_LESL  = MO_LE | MO_SL,
+    MO_LEQ   = MO_LE | MO_Q,
+
+    MO_BEUW  = MO_BE | MO_UW,
+    MO_BEUL  = MO_BE | MO_UL,
+    MO_BESW  = MO_BE | MO_SW,
+    MO_BESL  = MO_BE | MO_SL,
+    MO_BEQ   = MO_BE | MO_Q,
+
+#ifdef NEED_CPU_H
+    MO_TEUW  = MO_TE | MO_UW,
+    MO_TEUL  = MO_TE | MO_UL,
+    MO_TESW  = MO_TE | MO_SW,
+    MO_TESL  = MO_TE | MO_SL,
+    MO_TEQ   = MO_TE | MO_Q,
+#endif
+
+    MO_SSIZE = MO_SIZE | MO_SIGN,
+} MemOp;
+
+#endif
diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ static inline void assert_fp_access_checked(DisasContext *s)
  * the FP/vector register Qn.
  */
 static inline int vec_reg_offset(DisasContext *s, int regno,
-                                 int element, TCGMemOp size)
+                                 int element, MemOp size)
 {
     int element_size = 1 << size;
     int offs = element * element_size;
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int condexec_cond;
     int thumb;
     int sctlr_b;
-    TCGMemOp be_data;
+    MemOp be_data;
 #if !defined(CONFIG_USER_ONLY)
     int user;
 #endif
diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_lookup_and_goto_ptr(void);
 #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i64
 #endif
 
-void tcg_gen_qemu_ld_i32(TCGv_i32, TCGv, TCGArg, TCGMemOp);
-void tcg_gen_qemu_st_i32(TCGv_i32, TCGv, TCGArg, TCGMemOp);
-void tcg_gen_qemu_ld_i64(TCGv_i64, TCGv, TCGArg, TCGMemOp);
-void tcg_gen_qemu_st_i64(TCGv_i64, TCGv, TCGArg, TCGMemOp);
+void tcg_gen_qemu_ld_i32(TCGv_i32, TCGv, TCGArg, MemOp);
+void tcg_gen_qemu_st_i32(TCGv_i32, TCGv, TCGArg, MemOp);
+void tcg_gen_qemu_ld_i64(TCGv_i64, TCGv, TCGArg, MemOp);
+void tcg_gen_qemu_st_i64(TCGv_i64, TCGv, TCGArg, MemOp);
 
 static inline void tcg_gen_qemu_ld8u(TCGv ret, TCGv addr, int mem_index)
 {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_qemu_st64(TCGv_i64 arg, TCGv addr, int mem_index)
 }
 
 void tcg_gen_atomic_cmpxchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGv_i32,
-                                TCGArg, TCGMemOp);
+                                TCGArg, MemOp);
 void tcg_gen_atomic_cmpxchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGv_i64,
-                                TCGArg, TCGMemOp);
+                                TCGArg, MemOp);
 
-void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
 
-void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_and_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_and_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
 
-void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_and_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
-void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
-void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_and_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
+void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, MemOp);
+void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, MemOp);
 
 void tcg_gen_mov_vec(TCGv_vec, TCGv_vec);
 void tcg_gen_dup_i32_vec(unsigned vece, TCGv_vec, TCGv_i32);
diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_H
 
 #include "cpu.h"
+#include "exec/memop.h"
 #include "exec/tb-context.h"
 #include "qemu/bitops.h"
 #include "qemu/queue.h"
@@ -XXX,XX +XXX,XX @@ typedef enum TCGType {
 #endif
 } TCGType;
 
-/* Constants for qemu_ld and qemu_st for the Memory Operation field.  */
-typedef enum TCGMemOp {
-    MO_8     = 0,
-    MO_16    = 1,
-    MO_32    = 2,
-    MO_64    = 3,
-    MO_SIZE  = 3,   /* Mask for the above.  */
-
-    MO_SIGN  = 4,   /* Sign-extended, otherwise zero-extended.  */
-
-    MO_BSWAP = 8,   /* Host reverse endian.  */
-#ifdef HOST_WORDS_BIGENDIAN
-    MO_LE    = MO_BSWAP,
-    MO_BE    = 0,
-#else
-    MO_LE    = 0,
-    MO_BE    = MO_BSWAP,
-#endif
-#ifdef TARGET_WORDS_BIGENDIAN
-    MO_TE    = MO_BE,
-#else
-    MO_TE    = MO_LE,
-#endif
-
-    /*
-     * MO_UNALN accesses are never checked for alignment.
-     * MO_ALIGN accesses will result in a call to the CPU's
-     * do_unaligned_access hook if the guest address is not aligned.
-     * The default depends on whether the target CPU defines
-     * TARGET_ALIGNED_ONLY.
-     *
-     * Some architectures (e.g. ARMv8) need the address which is aligned
-     * to a size more than the size of the memory access.
-     * Some architectures (e.g. SPARCv9) need an address which is aligned,
-     * but less strictly than the natural alignment.
-     *
-     * MO_ALIGN supposes the alignment size is the size of a memory access.
-     *
-     * There are three options:
-     * - unaligned access permitted (MO_UNALN).
-     * - an alignment to the size of an access (MO_ALIGN);
-     * - an alignment to a specified size, which may be more or less than
-     *   the access size (MO_ALIGN_x where 'x' is a size in bytes);
-     */
-    MO_ASHIFT = 4,
-    MO_AMASK = 7 << MO_ASHIFT,
-#ifdef TARGET_ALIGNED_ONLY
-    MO_ALIGN = 0,
-    MO_UNALN = MO_AMASK,
-#else
-    MO_ALIGN = MO_AMASK,
-    MO_UNALN = 0,
-#endif
-    MO_ALIGN_2  = 1 << MO_ASHIFT,
-    MO_ALIGN_4  = 2 << MO_ASHIFT,
-    MO_ALIGN_8  = 3 << MO_ASHIFT,
-    MO_ALIGN_16 = 4 << MO_ASHIFT,
-    MO_ALIGN_32 = 5 << MO_ASHIFT,
-    MO_ALIGN_64 = 6 << MO_ASHIFT,
-
-    /* Combinations of the above, for ease of use.  */
-    MO_UB    = MO_8,
-    MO_UW    = MO_16,
-    MO_UL    = MO_32,
-    MO_SB    = MO_SIGN | MO_8,
-    MO_SW    = MO_SIGN | MO_16,
-    MO_SL    = MO_SIGN | MO_32,
-    MO_Q     = MO_64,
-
-    MO_LEUW  = MO_LE | MO_UW,
-    MO_LEUL  = MO_LE | MO_UL,
-    MO_LESW  = MO_LE | MO_SW,
-    MO_LESL  = MO_LE | MO_SL,
-    MO_LEQ   = MO_LE | MO_Q,
-
-    MO_BEUW  = MO_BE | MO_UW,
-    MO_BEUL  = MO_BE | MO_UL,
-    MO_BESW  = MO_BE | MO_SW,
-    MO_BESL  = MO_BE | MO_SL,
-    MO_BEQ   = MO_BE | MO_Q,
-
-    MO_TEUW  = MO_TE | MO_UW,
-    MO_TEUL  = MO_TE | MO_UL,
-    MO_TESW  = MO_TE | MO_SW,
-    MO_TESL  = MO_TE | MO_SL,
-    MO_TEQ   = MO_TE | MO_Q,
-
-    MO_SSIZE = MO_SIZE | MO_SIGN,
-} TCGMemOp;
-
 /**
  * get_alignment_bits
- * @memop: TCGMemOp value
+ * @memop: MemOp value
  *
  * Extract the alignment size from the memop.
  */
-static inline unsigned get_alignment_bits(TCGMemOp memop)
+static inline unsigned get_alignment_bits(MemOp memop)
 {
     unsigned a = memop & MO_AMASK;
 
@@ -XXX,XX +XXX,XX @@ static inline size_t tcg_current_code_size(TCGContext *s)
     return tcg_ptr_byte_diff(s->code_ptr, s->code_buf);
 }
 
-/* Combine the TCGMemOp and mmu_idx parameters into a single value.  */
+/* Combine the MemOp and mmu_idx parameters into a single value.  */
 typedef uint32_t TCGMemOpIdx;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef uint32_t TCGMemOpIdx;
  *
  * Encode these values into a single parameter.
  */
-static inline TCGMemOpIdx make_memop_idx(TCGMemOp op, unsigned idx)
+static inline TCGMemOpIdx make_memop_idx(MemOp op, unsigned idx)
 {
     tcg_debug_assert(idx <= 15);
     return (op << 4) | idx;
@@ -XXX,XX +XXX,XX @@ static inline TCGMemOpIdx make_memop_idx(TCGMemOp op, unsigned idx)
  *
  * Extract the memory operation from the combined value.
  */
-static inline TCGMemOp get_memop(TCGMemOpIdx oi)
+static inline MemOp get_memop(TCGMemOpIdx oi)
 {
     return oi >> 4;
 }
diff --git a/trace/mem-internal.h b/trace/mem-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/trace/mem-internal.h
+++ b/trace/mem-internal.h
@@ -XXX,XX +XXX,XX @@
 #define TRACE_MEM_ST (1ULL << 5)    /* store (y/n) */
 
 static inline uint8_t trace_mem_build_info(
-    int size_shift, bool sign_extend, TCGMemOp endianness, bool store)
+    int size_shift, bool sign_extend, MemOp endianness, bool store)
 {
     uint8_t res;
 
@@ -XXX,XX +XXX,XX @@ static inline uint8_t trace_mem_build_info(
     return res;
 }
 
-static inline uint8_t trace_mem_get_info(TCGMemOp op, bool store)
+static inline uint8_t trace_mem_get_info(MemOp op, bool store)
 {
     return trace_mem_build_info(op & MO_SIZE, !!(op & MO_SIGN),
                                 op & MO_BSWAP, store);
diff --git a/trace/mem.h b/trace/mem.h
index XXXXXXX..XXXXXXX 100644
--- a/trace/mem.h
+++ b/trace/mem.h
@@ -XXX,XX +XXX,XX @@
  *
  * Return a value for the 'info' argument in guest memory access traces.
  */
-static uint8_t trace_mem_get_info(TCGMemOp op, bool store);
+static uint8_t trace_mem_get_info(MemOp op, bool store);
 
 /**
  * trace_mem_build_info:
@@ -XXX,XX +XXX,XX @@ static uint8_t trace_mem_get_info(TCGMemOp op, bool store);
  * Return a value for the 'info' argument in guest memory access traces.
  */
 static uint8_t trace_mem_build_info(int size_shift, bool sign_extend,
-                                    TCGMemOp endianness, bool store);
+                                    MemOp endianness, bool store);
 
 
 #include "trace/mem-internal.h"
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
     target_ulong tlb_addr = tlb_addr_write(tlbe);
-    TCGMemOp mop = get_memop(oi);
+    MemOp mop = get_memop(oi);
     int a_bits = get_alignment_bits(mop);
     int s_bits = mop & MO_SIZE;
     void *hostaddr;
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_store_mem(DisasContext *ctx,
 
 static DisasJumpType gen_store_conditional(DisasContext *ctx, int ra, int rb,
                                            int32_t disp16, int mem_idx,
-                                           TCGMemOp op)
+                                           MemOp op)
 {
     TCGLabel *lab_fail, *lab_done;
     TCGv addr, val;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
 typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
 typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
-typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, TCGMemOp);
+typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
 
 /* initialize TCG globals.  */
 void a64_translate_init(void)
@@ -XXX,XX +XXX,XX @@ TCGv_i64 read_cpu_reg_sp(DisasContext *s, int reg, int sf)
  * Dn, Sn, Hn or Bn).
  * (Note that this is not the same mapping as for A32; see cpu.h)
  */
-static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
+static inline int fp_reg_offset(DisasContext *s, int regno, MemOp size)
 {
     return vec_reg_offset(s, regno, 0, size);
 }
@@ -XXX,XX +XXX,XX @@ static void do_gpr_ld_memidx(DisasContext *s,
                              bool iss_valid, unsigned int iss_srt,
                              bool iss_sf, bool iss_ar)
 {
-    TCGMemOp memop = s->be_data + size;
+    MemOp memop = s->be_data + size;
 
     g_assert(size <= 3);
 
@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
     TCGv_i64 tmphi;
 
     if (size < 4) {
-        TCGMemOp memop = s->be_data + size;
+        MemOp memop = s->be_data + size;
         tmphi = tcg_const_i64(0);
         tcg_gen_qemu_ld_i64(tmplo, tcg_addr, get_mem_index(s), memop);
     } else {
@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
 
 /* Get value of an element within a vector register */
 static void read_vec_element(DisasContext *s, TCGv_i64 tcg_dest, int srcidx,
-                             int element, TCGMemOp memop)
+                             int element, MemOp memop)
 {
     int vect_off = vec_reg_offset(s, srcidx, element, memop & MO_SIZE);
     switch (memop) {
@@ -XXX,XX +XXX,XX @@ static void read_vec_element(DisasContext *s, TCGv_i64 tcg_dest, int srcidx,
 }
 
 static void read_vec_element_i32(DisasContext *s, TCGv_i32 tcg_dest, int srcidx,
-                                 int element, TCGMemOp memop)
+                                 int element, MemOp memop)
 {
     int vect_off = vec_reg_offset(s, srcidx, element, memop & MO_SIZE);
     switch (memop) {
@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i32(DisasContext *s, TCGv_i32 tcg_dest, int srcidx,
 
 /* Set value of an element within a vector register */
 static void write_vec_element(DisasContext *s, TCGv_i64 tcg_src, int destidx,
-                              int element, TCGMemOp memop)
+                              int element, MemOp memop)
 {
     int vect_off = vec_reg_offset(s, destidx, element, memop & MO_SIZE);
     switch (memop) {
@@ -XXX,XX +XXX,XX @@ static void write_vec_element(DisasContext *s, TCGv_i64 tcg_src, int destidx,
 }
 
 static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
-                                  int destidx, int element, TCGMemOp memop)
+                                  int destidx, int element, MemOp memop)
 {
     int vect_off = vec_reg_offset(s, destidx, element, memop & MO_SIZE);
     switch (memop) {
@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
 
 /* Store from vector register to memory */
 static void do_vec_st(DisasContext *s, int srcidx, int element,
-                      TCGv_i64 tcg_addr, int size, TCGMemOp endian)
+                      TCGv_i64 tcg_addr, int size, MemOp endian)
 {
     TCGv_i64 tcg_tmp = tcg_temp_new_i64();
 
@@ -XXX,XX +XXX,XX @@ static void do_vec_st(DisasContext *s, int srcidx, int element,
 
 /* Load from memory to vector register */
 static void do_vec_ld(DisasContext *s, int destidx, int element,
-                      TCGv_i64 tcg_addr, int size, TCGMemOp endian)
+                      TCGv_i64 tcg_addr, int size, MemOp endian)
 {
     TCGv_i64 tcg_tmp = tcg_temp_new_i64();
 
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
                                TCGv_i64 addr, int size, bool is_pair)
 {
     int idx = get_mem_index(s);
-    TCGMemOp memop = s->be_data;
+    MemOp memop = s->be_data;
 
     g_assert(size <= 3);
     if (is_pair) {
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
     bool is_postidx = extract32(insn, 23, 1);
     bool is_q = extract32(insn, 30, 1);
     TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
-    TCGMemOp endian = s->be_data;
+    MemOp endian = s->be_data;
 
     int ebytes;   /* bytes per element */
     int elements; /* elements per vector */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
-    TCGMemOp sz;
+    MemOp sz;
 
     mos = extract32(insn, 29, 3);
     type = extract32(insn, 22, 2);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
     int mos = extract32(insn, 29, 3);
     uint64_t imm;
     TCGv_i64 tcg_res;
-    TCGMemOp sz;
+    MemOp sz;
 
     if (mos || imm5) {
         unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 do_reduction_op(DisasContext *s, int fpopcode, int rn,
 {
     if (esize == size) {
         int element;
-        TCGMemOp msize = esize == 16 ? MO_16 : MO_32;
+        MemOp msize = esize == 16 ? MO_16 : MO_32;
         TCGv_i32 tcg_elem;
 
         /* We should have one register left here */
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
     int shift = (2 * esize) - immhb;
     int elements = is_scalar ? 1 : (64 / esize);
     bool round = extract32(opcode, 0, 1);
-    TCGMemOp ldop = (size + 1) | (is_u_shift ? 0 : MO_SIGN);
+    MemOp ldop = (size + 1) | (is_u_shift ? 0 : MO_SIGN);
     TCGv_i64 tcg_rn, tcg_rd, tcg_round;
     TCGv_i32 tcg_rd_narrowed;
     TCGv_i64 tcg_final;
@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
             }
         };
         NeonGenTwoOpEnvFn *genfn = fns[src_unsigned][dst_unsigned][size];
-        TCGMemOp memop = scalar ? size : MO_32;
+        MemOp memop = scalar ? size : MO_32;
         int maxpass = scalar ? 1 : is_q ? 4 : 2;
 
         for (pass = 0; pass < maxpass; pass++) {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_intfp_conv(DisasContext *s, int rd, int rn,
     TCGv_ptr tcg_fpst = get_fpstatus_ptr(size == MO_16);
     TCGv_i32 tcg_shift = NULL;
 
-    TCGMemOp mop = size | (is_signed ? MO_SIGN : 0);
+    MemOp mop = size | (is_signed ? MO_SIGN : 0);
     int pass;
 
     if (fracbits || size == MO_64) {
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
     int dsize = is_q ? 128 : 64;
     int esize = 8 << size;
     int elements = dsize/esize;
-    TCGMemOp memop = size | (is_u ? 0 : MO_SIGN);
+    MemOp memop = size | (is_u ? 0 : MO_SIGN);
     TCGv_i64 tcg_rn = new_tmp_a64(s);
     TCGv_i64 tcg_rd = new_tmp_a64(s);
     TCGv_i64 tcg_round;
@@ -XXX,XX +XXX,XX @@ static void handle_3rd_widening(DisasContext *s, int is_q, int is_u, int size,
             TCGv_i64 tcg_op1 = tcg_temp_new_i64();
             TCGv_i64 tcg_op2 = tcg_temp_new_i64();
             TCGv_i64 tcg_passres;
-            TCGMemOp memop = MO_32 | (is_u ? 0 : MO_SIGN);
+            MemOp memop = MO_32 | (is_u ? 0 : MO_SIGN);
 
             int elt = pass + is_q * 2;
 
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_pairwise(DisasContext *s, int opcode, bool u,
 
     if (size == 2) {
         /* 32 + 32 -> 64 op */
-        TCGMemOp memop = size + (u ? 0 : MO_SIGN);
+        MemOp memop = size + (u ? 0 : MO_SIGN);
 
         for (pass = 0; pass < maxpass; pass++) {
             TCGv_i64 tcg_op1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
 
     switch (is_fp) {
     case 1: /* normal fp */
-        /* convert insn encoded size to TCGMemOp size */
+        /* convert insn encoded size to MemOp size */
         switch (size) {
         case 0: /* half-precision */
             size = MO_16;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Given TCGMemOp size, adjust register and indexing.  */
+    /* Given MemOp size, adjust register and indexing.  */
     switch (size) {
     case MO_16:
         index = h << 2 | l << 1 | m;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
         TCGv_i64 tcg_res[2];
         int pass;
         bool satop = extract32(opcode, 0, 1);
-        TCGMemOp memop = MO_32;
+        MemOp memop = MO_32;
 
         if (satop || !u) {
             memop |= MO_SIGN;
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_STR_pri(DisasContext *s, arg_rri *a)
  */
 
 /* The memory mode of the dtype.  */
-static const TCGMemOp dtype_mop[16] = {
+static const MemOp dtype_mop[16] = {
     MO_UB, MO_UB, MO_UB, MO_UB,
     MO_SL, MO_UW, MO_UW, MO_UW,
     MO_SW, MO_SW, MO_UL, MO_UL,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ typedef enum ISSInfo {
 } ISSInfo;
 
 /* Save the syndrome information for a Data Abort */
-static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
+static void disas_set_da_iss(DisasContext *s, MemOp memop, ISSInfo issinfo)
 {
     uint32_t syn;
     int sas = memop & MO_SIZE;
@@ -XXX,XX +XXX,XX @@ static inline void store_reg_from_load(DisasContext *s, int reg, TCGv_i32 var)
  * that the address argument is TCGv_i32 rather than TCGv.
  */
 
-static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, TCGMemOp op)
+static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
 {
     TCGv addr = tcg_temp_new();
     tcg_gen_extu_i32_tl(addr, a32);
@@ -XXX,XX +XXX,XX @@ static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, TCGMemOp op)
 }
 
 static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, TCGMemOp opc)
+                            int index, MemOp opc)
 {
     TCGv addr;
 
@@ -XXX,XX +XXX,XX @@ static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 }
 
 static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
-                            int index, TCGMemOp opc)
+                            int index, MemOp opc)
 {
     TCGv addr;
 
@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_frob64(DisasContext *s, TCGv_i64 val)
 }
 
 static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, TCGMemOp opc)
+                            int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
     tcg_gen_qemu_ld_i64(val, addr, index, opc);
@@ -XXX,XX +XXX,XX @@ static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
 }
 
 static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-                            int index, TCGMemOp opc)
+                            int index, MemOp opc)
 {
     TCGv addr = gen_aa32_addr(s, a32, opc);
 
@@ -XXX,XX +XXX,XX @@ neon_reg_offset (int reg, int n)
  * where 0 is the least significant end of the register.
  */
 static inline long
-neon_element_offset(int reg, int element, TCGMemOp size)
+neon_element_offset(int reg, int element, MemOp size)
 {
     int element_size = 1 << size;
     int ofs = element * element_size;
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 neon_load_reg(int reg, int pass)
     return tmp;
 }
 
-static void neon_load_element(TCGv_i32 var, int reg, int ele, TCGMemOp mop)
+static void neon_load_element(TCGv_i32 var, int reg, int ele, MemOp mop)
 {
     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
 
@@ -XXX,XX +XXX,XX @@ static void neon_load_element(TCGv_i32 var, int reg, int ele, TCGMemOp mop)
     }
 }
 
-static void neon_load_element64(TCGv_i64 var, int reg, int ele, TCGMemOp mop)
+static void neon_load_element64(TCGv_i64 var, int reg, int ele, MemOp mop)
 {
     long offset = neon_element_offset(reg, ele, mop & MO_SIZE);
 
@@ -XXX,XX +XXX,XX @@ static void neon_store_reg(int reg, int pass, TCGv_i32 var)
     tcg_temp_free_i32(var);
 }
 
-static void neon_store_element(int reg, int ele, TCGMemOp size, TCGv_i32 var)
+static void neon_store_element(int reg, int ele, MemOp size, TCGv_i32 var)
 {
     long offset = neon_element_offset(reg, ele, size);
 
@@ -XXX,XX +XXX,XX @@ static void neon_store_element(int reg, int ele, TCGMemOp size, TCGv_i32 var)
     }
 }
 
-static void neon_store_element64(int reg, int ele, TCGMemOp size, TCGv_i64 var)
+static void neon_store_element64(int reg, int ele, MemOp size, TCGv_i64 var)
 {
     long offset = neon_element_offset(reg, ele, size);
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
     int n;
     int vec_size;
     int mmu_idx;
-    TCGMemOp endian;
+    MemOp endian;
     TCGv_i32 addr;
     TCGv_i32 tmp;
     TCGv_i32 tmp2;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             } else if ((insn & 0x380) == 0) {
                 /* VDUP */
                 int element;
-                TCGMemOp size;
+                MemOp size;
 
                 if ((insn & (7 << 16)) == 0 || (q && (rd & 1))) {
                     return 1;
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
                                TCGv_i32 addr, int size)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-    TCGMemOp opc = size | MO_ALIGN | s->be_data;
+    MemOp opc = size | MO_ALIGN | s->be_data;
 
     s->is_ldex = true;
 
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
     TCGv taddr;
     TCGLabel *done_label;
     TCGLabel *fail_label;
-    TCGMemOp opc = size | MO_ALIGN | s->be_data;
+    MemOp opc = size | MO_ALIGN | s->be_data;
 
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]) {
          [addr] = {Rt};
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                         */
 
                         TCGv taddr;
-                        TCGMemOp opc = s->be_data;
+                        MemOp opc = s->be_data;
 
                         rm = (insn) & 0xf;
 
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void form_gva(DisasContext *ctx, TCGv_tl *pgva, TCGv_reg *pofs,
  */
 static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
                        unsigned rx, int scale, target_sreg disp,
-                       unsigned sp, int modify, TCGMemOp mop)
+                       unsigned sp, int modify, MemOp mop)
 {
     TCGv_reg ofs;
     TCGv_tl addr;
@@ -XXX,XX +XXX,XX @@ static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
 
 static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
                        unsigned rx, int scale, target_sreg disp,
-                       unsigned sp, int modify, TCGMemOp mop)
+                       unsigned sp, int modify, MemOp mop)
 {
     TCGv_reg ofs;
     TCGv_tl addr;
@@ -XXX,XX +XXX,XX @@ static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
 
 static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
                         unsigned rx, int scale, target_sreg disp,
-                        unsigned sp, int modify, TCGMemOp mop)
+                        unsigned sp, int modify, MemOp mop)
 {
     TCGv_reg ofs;
     TCGv_tl addr;
@@ -XXX,XX +XXX,XX @@ static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
 
 static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
                         unsigned rx, int scale, target_sreg disp,
-                        unsigned sp, int modify, TCGMemOp mop)
+                        unsigned sp, int modify, MemOp mop)
 {
     TCGv_reg ofs;
     TCGv_tl addr;
@@ -XXX,XX +XXX,XX @@ static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
 
 static bool do_load(DisasContext *ctx, unsigned rt, unsigned rb,
                     unsigned rx, int scale, target_sreg disp,
-                    unsigned sp, int modify, TCGMemOp mop)
+                    unsigned sp, int modify, MemOp mop)
 {
     TCGv_reg dest;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fldd(DisasContext *ctx, arg_ldst *a)
 
 static bool do_store(DisasContext *ctx, unsigned rt, unsigned rb,
                      target_sreg disp, unsigned sp,
-                     int modify, TCGMemOp mop)
+                     int modify, MemOp mop)
 {
     nullify_over(ctx);
     do_store_reg(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, mop);
@@ -XXX,XX +XXX,XX @@ static bool trans_st(DisasContext *ctx, arg_ldst *a)
 
 static bool trans_ldc(DisasContext *ctx, arg_ldst *a)
 {
-    TCGMemOp mop = MO_TEUL | MO_ALIGN_16 | a->size;
+    MemOp mop = MO_TEUL | MO_ALIGN_16 | a->size;
     TCGv_reg zero, dest, ofs;
     TCGv_tl addr;
 
diff --git a/target/i386/translate.c b/target/i386/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/translate.c
+++ b/target/i386/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* current insn context */
     int override; /* -1 if no override */
     int prefix;
-    TCGMemOp aflag;
-    TCGMemOp dflag;
+    MemOp aflag;
+    MemOp dflag;
     target_ulong pc_start;
     target_ulong pc; /* pc = eip + cs_base */
     /* current block context */
@@ -XXX,XX +XXX,XX @@ static void gen_eob(DisasContext *s);
 static void gen_jr(DisasContext *s, TCGv dest);
 static void gen_jmp(DisasContext *s, target_ulong eip);
 static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num);
-static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d);
+static void gen_op(DisasContext *s1, int op, MemOp ot, int d);
 
 /* i386 arith/logic operations */
 enum {
@@ -XXX,XX +XXX,XX @@ static inline bool byte_reg_is_xH(DisasContext *s, int reg)
 }
 
 /* Select the size of a push/pop operation.  */
-static inline TCGMemOp mo_pushpop(DisasContext *s, TCGMemOp ot)
+static inline MemOp mo_pushpop(DisasContext *s, MemOp ot)
 {
     if (CODE64(s)) {
         return ot == MO_16 ? MO_16 : MO_64;
@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp mo_pushpop(DisasContext *s, TCGMemOp ot)
 }
 
 /* Select the size of the stack pointer.  */
-static inline TCGMemOp mo_stacksize(DisasContext *s)
+static inline MemOp mo_stacksize(DisasContext *s)
 {
     return CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
 }
 
 /* Select only size 64 else 32.  Used for SSE operand sizes.  */
-static inline TCGMemOp mo_64_32(TCGMemOp ot)
+static inline MemOp mo_64_32(MemOp ot)
 {
 #ifdef TARGET_X86_64
     return ot == MO_64 ? MO_64 : MO_32;
@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp mo_64_32(TCGMemOp ot)
 
 /* Select size 8 if lsb of B is clear, else OT.  Used for decoding
    byte vs word opcodes.  */
-static inline TCGMemOp mo_b_d(int b, TCGMemOp ot)
+static inline MemOp mo_b_d(int b, MemOp ot)
 {
     return b & 1 ? ot : MO_8;
 }
 
 /* Select size 8 if lsb of B is clear, else OT capped at 32.
    Used for decoding operand size of port opcodes.  */
-static inline TCGMemOp mo_b_d32(int b, TCGMemOp ot)
+static inline MemOp mo_b_d32(int b, MemOp ot)
 {
     return b & 1 ? (ot == MO_16 ? MO_16 : MO_32) : MO_8;
 }
 
-static void gen_op_mov_reg_v(DisasContext *s, TCGMemOp ot, int reg, TCGv t0)
+static void gen_op_mov_reg_v(DisasContext *s, MemOp ot, int reg, TCGv t0)
 {
     switch(ot) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static void gen_op_mov_reg_v(DisasContext *s, TCGMemOp ot, int reg, TCGv t0)
 }
 
 static inline
-void gen_op_mov_v_reg(DisasContext *s, TCGMemOp ot, TCGv t0, int reg)
+void gen_op_mov_v_reg(DisasContext *s, MemOp ot, TCGv t0, int reg)
 {
     if (ot == MO_8 && byte_reg_is_xH(s, reg)) {
         tcg_gen_extract_tl(t0, cpu_regs[reg - 4], 8, 8);
@@ -XXX,XX +XXX,XX @@ static inline void gen_op_jmp_v(TCGv dest)
 }
 
 static inline
-void gen_op_add_reg_im(DisasContext *s, TCGMemOp size, int reg, int32_t val)
+void gen_op_add_reg_im(DisasContext *s, MemOp size, int reg, int32_t val)
 {
     tcg_gen_addi_tl(s->tmp0, cpu_regs[reg], val);
     gen_op_mov_reg_v(s, size, reg, s->tmp0);
 }
 
-static inline void gen_op_add_reg_T0(DisasContext *s, TCGMemOp size, int reg)
+static inline void gen_op_add_reg_T0(DisasContext *s, MemOp size, int reg)
 {
     tcg_gen_add_tl(s->tmp0, cpu_regs[reg], s->T0);
     gen_op_mov_reg_v(s, size, reg, s->tmp0);
@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp_im(DisasContext *s, target_ulong pc)
 /* Compute SEG:REG into A0.  SEG is selected from the override segment
    (OVR_SEG) and the default segment (DEF_SEG).  OVR_SEG may be -1 to
    indicate no override.  */
-static void gen_lea_v_seg(DisasContext *s, TCGMemOp aflag, TCGv a0,
+static void gen_lea_v_seg(DisasContext *s, MemOp aflag, TCGv a0,
                           int def_seg, int ovr_seg)
 {
     switch (aflag) {
@@ -XXX,XX +XXX,XX @@ static inline void gen_string_movl_A0_EDI(DisasContext *s)
     gen_lea_v_seg(s, s->aflag, cpu_regs[R_EDI], R_ES, -1);
 }
 
-static inline void gen_op_movl_T0_Dshift(DisasContext *s, TCGMemOp ot)
+static inline void gen_op_movl_T0_Dshift(DisasContext *s, MemOp ot)
 {
     tcg_gen_ld32s_tl(s->T0, cpu_env, offsetof(CPUX86State, df));
     tcg_gen_shli_tl(s->T0, s->T0, ot);
 };
 
-static TCGv gen_ext_tl(TCGv dst, TCGv src, TCGMemOp size, bool sign)
+static TCGv gen_ext_tl(TCGv dst, TCGv src, MemOp size, bool sign)
 {
     switch (size) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static TCGv gen_ext_tl(TCGv dst, TCGv src, TCGMemOp size, bool sign)
     }
 }
 
-static void gen_extu(TCGMemOp ot, TCGv reg)
+static void gen_extu(MemOp ot, TCGv reg)
 {
     gen_ext_tl(reg, reg, ot, false);
 }
 
-static void gen_exts(TCGMemOp ot, TCGv reg)
+static void gen_exts(MemOp ot, TCGv reg)
 {
     gen_ext_tl(reg, reg, ot, true);
 }
 
 static inline
-void gen_op_jnz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
+void gen_op_jnz_ecx(DisasContext *s, MemOp size, TCGLabel *label1)
 {
     tcg_gen_mov_tl(s->tmp0, cpu_regs[R_ECX]);
     gen_extu(size, s->tmp0);
@@ -XXX,XX +XXX,XX @@ void gen_op_jnz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
 }
 
 static inline
-void gen_op_jz_ecx(DisasContext *s, TCGMemOp size, TCGLabel *label1)
+void gen_op_jz_ecx(DisasContext *s, MemOp size, TCGLabel *label1)
 {
     tcg_gen_mov_tl(s->tmp0, cpu_regs[R_ECX]);
     gen_extu(size, s->tmp0);
     tcg_gen_brcondi_tl(TCG_COND_EQ, s->tmp0, 0, label1);
 }
 
-static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
+static void gen_helper_in_func(MemOp ot, TCGv v, TCGv_i32 n)
 {
     switch (ot) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
     }
 }
 
-static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
+static void gen_helper_out_func(MemOp ot, TCGv_i32 v, TCGv_i32 n)
 {
     switch (ot) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
     }
 }
 
-static void gen_check_io(DisasContext *s, TCGMemOp ot, target_ulong cur_eip,
+static void gen_check_io(DisasContext *s, MemOp ot, target_ulong cur_eip,
                          uint32_t svm_flags)
 {
     target_ulong next_eip;
@@ -XXX,XX +XXX,XX @@ static void gen_check_io(DisasContext *s, TCGMemOp ot, target_ulong cur_eip,
     }
 }
 
-static inline void gen_movs(DisasContext *s, TCGMemOp ot)
+static inline void gen_movs(DisasContext *s, MemOp ot)
 {
     gen_string_movl_A0_ESI(s);
     gen_op_ld_v(s, ot, s->T0, s->A0);
@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_s(DisasContext *s, TCGv reg)
         return (CCPrepare) { .cond = TCG_COND_NEVER, .mask = -1 };
     default:
         {
-            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
+            MemOp size = (s->cc_op - CC_OP_ADDB) & 3;
             TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, true);
             return (CCPrepare) { .cond = TCG_COND_LT, .reg = t0, .mask = -1 };
         }
@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_z(DisasContext *s, TCGv reg)
                              .mask = -1 };
     default:
         {
-            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
+            MemOp size = (s->cc_op - CC_OP_ADDB) & 3;
             TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, false);
             return (CCPrepare) { .cond = TCG_COND_EQ, .reg = t0, .mask = -1 };
         }
@@ -XXX,XX +XXX,XX @@ static CCPrepare gen_prepare_eflags_z(DisasContext *s, TCGv reg)
 static CCPrepare gen_prepare_cc(DisasContext *s, int b, TCGv reg)
 {
     int inv, jcc_op, cond;
-    TCGMemOp size;
+    MemOp size;
     CCPrepare cc;
     TCGv t0;
 
@@ -XXX,XX +XXX,XX @@ static TCGLabel *gen_jz_ecx_string(DisasContext *s, target_ulong next_eip)
     return l2;
 }
 
-static inline void gen_stos(DisasContext *s, TCGMemOp ot)
+static inline void gen_stos(DisasContext *s, MemOp ot)
 {
     gen_op_mov_v_reg(s, MO_32, s->T0, R_EAX);
     gen_string_movl_A0_EDI(s);
@@ -XXX,XX +XXX,XX @@ static inline void gen_stos(DisasContext *s, TCGMemOp ot)
     gen_op_add_reg_T0(s, s->aflag, R_EDI);
 }
 
-static inline void gen_lods(DisasContext *s, TCGMemOp ot)
+static inline void gen_lods(DisasContext *s, MemOp ot)
 {
     gen_string_movl_A0_ESI(s);
     gen_op_ld_v(s, ot, s->T0, s->A0);
@@ -XXX,XX +XXX,XX @@ static inline void gen_lods(DisasContext *s, TCGMemOp ot)
     gen_op_add_reg_T0(s, s->aflag, R_ESI);
 }
 
-static inline void gen_scas(DisasContext *s, TCGMemOp ot)
+static inline void gen_scas(DisasContext *s, MemOp ot)
 {
     gen_string_movl_A0_EDI(s);
     gen_op_ld_v(s, ot, s->T1, s->A0);
@@ -XXX,XX +XXX,XX @@ static inline void gen_scas(DisasContext *s, TCGMemOp ot)
     gen_op_add_reg_T0(s, s->aflag, R_EDI);
 }
 
-static inline void gen_cmps(DisasContext *s, TCGMemOp ot)
+static inline void gen_cmps(DisasContext *s, MemOp ot)
 {
     gen_string_movl_A0_EDI(s);
     gen_op_ld_v(s, ot, s->T1, s->A0);
@@ -XXX,XX +XXX,XX @@ static void gen_bpt_io(DisasContext *s, TCGv_i32 t_port, int ot)
 }
 
 
-static inline void gen_ins(DisasContext *s, TCGMemOp ot)
+static inline void gen_ins(DisasContext *s, MemOp ot)
 {
     if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
         gen_io_start();
@@ -XXX,XX +XXX,XX @@ static inline void gen_ins(DisasContext *s, TCGMemOp ot)
     }
 }
 
-static inline void gen_outs(DisasContext *s, TCGMemOp ot)
+static inline void gen_outs(DisasContext *s, MemOp ot)
 {
     if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
         gen_io_start();
@@ -XXX,XX +XXX,XX @@ static inline void gen_outs(DisasContext *s, TCGMemOp ot)
 /* same method as Valgrind : we generate jumps to current or next
    instruction */
 #define GEN_REPZ(op)                                                          \
-static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
+static inline void gen_repz_ ## op(DisasContext *s, MemOp ot,              \
                                  target_ulong cur_eip, target_ulong next_eip) \
 {                                                                             \
     TCGLabel *l2;                                                             \
@@ -XXX,XX +XXX,XX @@ static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
 }
 
 #define GEN_REPZ2(op)                                                         \
-static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
+static inline void gen_repz_ ## op(DisasContext *s, MemOp ot,              \
                                    target_ulong cur_eip,                      \
                                    target_ulong next_eip,                     \
                                    int nz)                                    \
@@ -XXX,XX +XXX,XX @@ static void gen_illegal_opcode(DisasContext *s)
 }
 
 /* if d == OR_TMP0, it means memory operand (address in A0) */
-static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d)
+static void gen_op(DisasContext *s1, int op, MemOp ot, int d)
 {
     if (d != OR_TMP0) {
         if (s1->prefix & PREFIX_LOCK) {
@@ -XXX,XX +XXX,XX @@ static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d)
 }
 
 /* if d == OR_TMP0, it means memory operand (address in A0) */
-static void gen_inc(DisasContext *s1, TCGMemOp ot, int d, int c)
+static void gen_inc(DisasContext *s1, MemOp ot, int d, int c)
 {
     if (s1->prefix & PREFIX_LOCK) {
         if (d != OR_TMP0) {
@@ -XXX,XX +XXX,XX @@ static void gen_inc(DisasContext *s1, TCGMemOp ot, int d, int c)
     set_cc_op(s1, (c > 0 ? CC_OP_INCB : CC_OP_DECB) + ot);
 }
 
-static void gen_shift_flags(DisasContext *s, TCGMemOp ot, TCGv result,
+static void gen_shift_flags(DisasContext *s, MemOp ot, TCGv result,
                             TCGv shm1, TCGv count, bool is_right)
 {
     TCGv_i32 z32, s32, oldop;
@@ -XXX,XX +XXX,XX @@ static void gen_shift_flags(DisasContext *s, TCGMemOp ot, TCGv result,
     set_cc_op(s, CC_OP_DYNAMIC);
 }
 
-static void gen_shift_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
+static void gen_shift_rm_T1(DisasContext *s, MemOp ot, int op1,
                             int is_right, int is_arith)
 {
     target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
@@ -XXX,XX +XXX,XX @@ static void gen_shift_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
     gen_shift_flags(s, ot, s->T0, s->tmp0, s->T1, is_right);
 }
 
-static void gen_shift_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
+static void gen_shift_rm_im(DisasContext *s, MemOp ot, int op1, int op2,
                             int is_right, int is_arith)
 {
     int mask = (ot == MO_64 ? 0x3f : 0x1f);
@@ -XXX,XX +XXX,XX @@ static void gen_shift_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
     }
 }
 
-static void gen_rot_rm_T1(DisasContext *s, TCGMemOp ot, int op1, int is_right)
+static void gen_rot_rm_T1(DisasContext *s, MemOp ot, int op1, int is_right)
 {
     target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
     TCGv_i32 t0, t1;
@@ -XXX,XX +XXX,XX @@ static void gen_rot_rm_T1(DisasContext *s, TCGMemOp ot, int op1, int is_right)
     set_cc_op(s, CC_OP_DYNAMIC);
 }
 
-static void gen_rot_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
+static void gen_rot_rm_im(DisasContext *s, MemOp ot, int op1, int op2,
                           int is_right)
 {
     int mask = (ot == MO_64 ? 0x3f : 0x1f);
@@ -XXX,XX +XXX,XX @@ static void gen_rot_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
 }
 
 /* XXX: add faster immediate = 1 case */
-static void gen_rotc_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
+static void gen_rotc_rm_T1(DisasContext *s, MemOp ot, int op1,
                            int is_right)
 {
     gen_compute_eflags(s);
@@ -XXX,XX +XXX,XX @@ static void gen_rotc_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
 }
 
 /* XXX: add faster immediate case */
-static void gen_shiftd_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
+static void gen_shiftd_rm_T1(DisasContext *s, MemOp ot, int op1,
                              bool is_right, TCGv count_in)
 {
     target_ulong mask = (ot == MO_64 ? 63 : 31);
@@ -XXX,XX +XXX,XX @@ static void gen_shiftd_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
     tcg_temp_free(count);
 }
 
-static void gen_shift(DisasContext *s1, int op, TCGMemOp ot, int d, int s)
+static void gen_shift(DisasContext *s1, int op, MemOp ot, int d, int s)
 {
     if (s != OR_TMP1)
         gen_op_mov_v_reg(s1, ot, s1->T1, s);
@@ -XXX,XX +XXX,XX @@ static void gen_shift(DisasContext *s1, int op, TCGMemOp ot, int d, int s)
     }
 }
 
-static void gen_shifti(DisasContext *s1, int op, TCGMemOp ot, int d, int c)
+static void gen_shifti(DisasContext *s1, int op, MemOp ot, int d, int c)
 {
     switch(op) {
     case OP_ROL:
@@ -XXX,XX +XXX,XX @@ static void gen_add_A0_ds_seg(DisasContext *s)
 /* generate modrm memory load or store of 'reg'. TMP0 is used if reg ==
    OR_TMP0 */
 static void gen_ldst_modrm(CPUX86State *env, DisasContext *s, int modrm,
-                           TCGMemOp ot, int reg, int is_store)
+                           MemOp ot, int reg, int is_store)
 {
     int mod, rm;
 
@@ -XXX,XX +XXX,XX @@ static void gen_ldst_modrm(CPUX86State *env, DisasContext *s, int modrm,
     }
 }
 
-static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, TCGMemOp ot)
+static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, MemOp ot)
 {
     uint32_t ret;
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, TCGMemOp ot)
     return ret;
 }
 
-static inline int insn_const_size(TCGMemOp ot)
+static inline int insn_const_size(MemOp ot)
 {
     if (ot <= MO_32) {
         return 1 << ot;
@@ -XXX,XX +XXX,XX @@ static inline void gen_jcc(DisasContext *s, int b,
     }
 }
 
-static void gen_cmovcc1(CPUX86State *env, DisasContext *s, TCGMemOp ot, int b,
+static void gen_cmovcc1(CPUX86State *env, DisasContext *s, MemOp ot, int b,
                         int modrm, int reg)
 {
     CCPrepare cc;
@@ -XXX,XX +XXX,XX @@ static inline void gen_stack_update(DisasContext *s, int addend)
 /* Generate a push. It depends on ss32, addseg and dflag.  */
 static void gen_push_v(DisasContext *s, TCGv val)
 {
-    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
-    TCGMemOp a_ot = mo_stacksize(s);
+    MemOp d_ot = mo_pushpop(s, s->dflag);
+    MemOp a_ot = mo_stacksize(s);
     int size = 1 << d_ot;
     TCGv new_esp = s->A0;
 
@@ -XXX,XX +XXX,XX @@ static void gen_push_v(DisasContext *s, TCGv val)
 }
 
 /* two step pop is necessary for precise exceptions */
-static TCGMemOp gen_pop_T0(DisasContext *s)
+static MemOp gen_pop_T0(DisasContext *s)
 {
-    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
+    MemOp d_ot = mo_pushpop(s, s->dflag);
 
     gen_lea_v_seg(s, mo_stacksize(s), cpu_regs[R_ESP], R_SS, -1);
     gen_op_ld_v(s, d_ot, s->T0, s->A0);
@@ -XXX,XX +XXX,XX @@ static TCGMemOp gen_pop_T0(DisasContext *s)
     return d_ot;
 }
 
-static inline void gen_pop_update(DisasContext *s, TCGMemOp ot)
+static inline void gen_pop_update(DisasContext *s, MemOp ot)
 {
     gen_stack_update(s, 1 << ot);
 }
@@ -XXX,XX +XXX,XX @@ static inline void gen_stack_A0(DisasContext *s)
 
 static void gen_pusha(DisasContext *s)
 {
-    TCGMemOp s_ot = s->ss32 ? MO_32 : MO_16;
-    TCGMemOp d_ot = s->dflag;
+    MemOp s_ot = s->ss32 ? MO_32 : MO_16;
+    MemOp d_ot = s->dflag;
     int size = 1 << d_ot;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void gen_pusha(DisasContext *s)
 
 static void gen_popa(DisasContext *s)
 {
-    TCGMemOp s_ot = s->ss32 ? MO_32 : MO_16;
-    TCGMemOp d_ot = s->dflag;
+    MemOp s_ot = s->ss32 ? MO_32 : MO_16;
+    MemOp d_ot = s->dflag;
     int size = 1 << d_ot;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void gen_popa(DisasContext *s)
 
 static void gen_enter(DisasContext *s, int esp_addend, int level)
 {
-    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
-    TCGMemOp a_ot = CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
+    MemOp d_ot = mo_pushpop(s, s->dflag);
+    MemOp a_ot = CODE64(s) ? MO_64 : s->ss32 ? MO_32 : MO_16;
     int size = 1 << d_ot;
 
     /* Push BP; compute FrameTemp into T1.  */
@@ -XXX,XX +XXX,XX @@ static void gen_enter(DisasContext *s, int esp_addend, int level)
 
 static void gen_leave(DisasContext *s)
 {
-    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
-    TCGMemOp a_ot = mo_stacksize(s);
+    MemOp d_ot = mo_pushpop(s, s->dflag);
+    MemOp a_ot = mo_stacksize(s);
 
     gen_lea_v_seg(s, a_ot, cpu_regs[R_EBP], R_SS, -1);
     gen_op_ld_v(s, d_ot, s->T0, s->A0);
@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
     SSEFunc_0_eppi sse_fn_eppi;
     SSEFunc_0_ppi sse_fn_ppi;
     SSEFunc_0_eppt sse_fn_eppt;
-    TCGMemOp ot;
+    MemOp ot;
 
     b &= 0xff;
     if (s->prefix & PREFIX_DATA)
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     CPUX86State *env = cpu->env_ptr;
     int b, prefixes;
     int shift;
-    TCGMemOp ot, aflag, dflag;
+    MemOp ot, aflag, dflag;
     int modrm, reg, rm, mod, op, opreg, val;
     target_ulong next_eip, tval;
     int rex_w, rex_r;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     case 0x1be: /* movsbS Gv, Eb */
     case 0x1bf: /* movswS Gv, Eb */
         {
-            TCGMemOp d_ot;
-            TCGMemOp s_ot;
+            MemOp d_ot;
+            MemOp s_ot;
 
             /* d_ot is the size of destination */
             d_ot = dflag;
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ DISAS_INSN(cas)
     uint16_t ext;
     TCGv load;
     TCGv cmp;
-    TCGMemOp opc;
+    MemOp opc;
 
     switch ((insn >> 9) & 3) {
     case 1:
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static void dec_load(DisasContext *dc)
     unsigned int size;
     bool rev = false, ex = false, ea = false;
     int mem_index = cpu_mmu_index(&dc->cpu->env, false);
-    TCGMemOp mop;
+    MemOp mop;
 
     mop = dc->opcode & 3;
     size = 1 << mop;
@@ -XXX,XX +XXX,XX @@ static void dec_store(DisasContext *dc)
     unsigned int size;
     bool rev = false, ex = false, ea = false;
     int mem_index = cpu_mmu_index(&dc->cpu->env, false);
-    TCGMemOp mop;
+    MemOp mop;
 
     mop = dc->opcode & 3;
     size = 1 << mop;
diff --git a/target/mips/translate.c b/target/mips/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int32_t CP0_Config5;
     /* Routine used to access memory */
     int mem_idx;
-    TCGMemOp default_tcg_memop_mask;
+    MemOp default_tcg_memop_mask;
     uint32_t hflags, saved_hflags;
     target_ulong btarget;
     bool ulri;
@@ -XXX,XX +XXX,XX @@ static void gen_st(DisasContext *ctx, uint32_t opc, int rt,
 
 /* Store conditional */
 static void gen_st_cond(DisasContext *ctx, int rt, int base, int offset,
-                        TCGMemOp tcg_mo, bool eva)
+                        MemOp tcg_mo, bool eva)
 {
     TCGv addr, t0, val;
     TCGLabel *l1 = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static void gen_HILO(DisasContext *ctx, uint32_t opc, int acc, int reg)
 }
 
 static inline void gen_r6_ld(target_long addr, int reg, int memidx,
-                             TCGMemOp memop)
+                             MemOp memop)
 {
     TCGv t0 = tcg_const_tl(addr);
     tcg_gen_qemu_ld_tl(t0, t0, memidx, memop);
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
                              extract32(ctx->opcode, 0, 8);
                     TCGv va = tcg_temp_new();
                     TCGv t1 = tcg_temp_new();
-                    TCGMemOp memop = (extract32(ctx->opcode, 8, 3)) ==
+                    MemOp memop = (extract32(ctx->opcode, 8, 3)) ==
                                       NM_P_LS_UAWM ? MO_UNALN : 0;
 
                     count = (count == 0) ? 8 : count;
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_l_lwa(DisasContext *dc, arg_load *a)
     return true;
 }
 
-static void do_load(DisasContext *dc, arg_load *a, TCGMemOp mop)
+static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 {
     TCGv ea;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_l_swa(DisasContext *dc, arg_store *a)
     return true;
 }
 
-static void do_store(DisasContext *dc, arg_store *a, TCGMemOp mop)
+static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
 {
     TCGv t0 = tcg_temp_new();
     tcg_gen_addi_tl(t0, cpu_R[a->a], a->i);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
     int mem_idx;
     int access_type;
     /* Translation flags */
-    TCGMemOp default_tcg_memop_mask;
+    MemOp default_tcg_memop_mask;
 #if defined(TARGET_PPC64)
     bool sf_mode;
     bool has_cfar;
@@ -XXX,XX +XXX,XX @@ static void gen_isync(DisasContext *ctx)
 
 #define MEMOP_GET_SIZE(x)  (1 << ((x) & MO_SIZE))
 
-static void gen_load_locked(DisasContext *ctx, TCGMemOp memop)
+static void gen_load_locked(DisasContext *ctx, MemOp memop)
 {
     TCGv gpr = cpu_gpr[rD(ctx->opcode)];
     TCGv t0 = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ LARX(lbarx, DEF_MEMOP(MO_UB))
 LARX(lharx, DEF_MEMOP(MO_UW))
 LARX(lwarx, DEF_MEMOP(MO_UL))
 
-static void gen_fetch_inc_conditional(DisasContext *ctx, TCGMemOp memop,
+static void gen_fetch_inc_conditional(DisasContext *ctx, MemOp memop,
                                       TCGv EA, TCGCond cond, int addend)
 {
     TCGv t = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ static void gen_fetch_inc_conditional(DisasContext *ctx, TCGMemOp memop,
     tcg_temp_free(u);
 }
 
-static void gen_ld_atomic(DisasContext *ctx, TCGMemOp memop)
+static void gen_ld_atomic(DisasContext *ctx, MemOp memop)
 {
     uint32_t gpr_FC = FC(ctx->opcode);
     TCGv EA = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ static void gen_ldat(DisasContext *ctx)
 }
 #endif
 
-static void gen_st_atomic(DisasContext *ctx, TCGMemOp memop)
+static void gen_st_atomic(DisasContext *ctx, MemOp memop)
 {
     uint32_t gpr_FC = FC(ctx->opcode);
     TCGv EA = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ static void gen_stdat(DisasContext *ctx)
 }
 #endif
 
-static void gen_conditional_store(DisasContext *ctx, TCGMemOp memop)
+static void gen_conditional_store(DisasContext *ctx, MemOp memop)
 {
     TCGLabel *l1 = gen_new_label();
     TCGLabel *l2 = gen_new_label();
diff --git a/target/riscv/insn_trans/trans_rva.inc.c b/target/riscv/insn_trans/trans_rva.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rva.inc.c
+++ b/target/riscv/insn_trans/trans_rva.inc.c
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
+static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
     TCGv src1 = tcg_temp_new();
     /* Put addr in load_res, data in load_val.  */
@@ -XXX,XX +XXX,XX @@ static inline bool gen_lr(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
     return true;
 }
 
-static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
+static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
     TCGv src1 = tcg_temp_new();
     TCGv src2 = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ static inline bool gen_sc(DisasContext *ctx, arg_atomic *a, TCGMemOp mop)
 }
 
 static bool gen_amo(DisasContext *ctx, arg_atomic *a,
-                    void(*func)(TCGv, TCGv, TCGv, TCGArg, TCGMemOp),
-                    TCGMemOp mop)
+                    void(*func)(TCGv, TCGv, TCGv, TCGArg, MemOp),
+                    MemOp mop)
 {
     TCGv src1 = tcg_temp_new();
     TCGv src2 = tcg_temp_new();
diff --git a/target/riscv/insn_trans/trans_rvi.inc.c b/target/riscv/insn_trans/trans_rvi.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.inc.c
+++ b/target/riscv/insn_trans/trans_rvi.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_bgeu(DisasContext *ctx, arg_bgeu *a)
     return gen_branch(ctx, a, TCG_COND_GEU);
 }
 
-static bool gen_load(DisasContext *ctx, arg_lb *a, TCGMemOp memop)
+static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
 {
     TCGv t0 = tcg_temp_new();
     TCGv t1 = tcg_temp_new();
@@ -XXX,XX +XXX,XX @@ static bool trans_lhu(DisasContext *ctx, arg_lhu *a)
     return gen_load(ctx, a, MO_TEUW);
 }
 
-static bool gen_store(DisasContext *ctx, arg_sb *a, TCGMemOp memop)
+static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
     TCGv t0 = tcg_temp_new();
     TCGv dat = tcg_temp_new();
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_offset(uint8_t reg)
     return offsetof(CPUS390XState, vregs[reg][0]);
 }
 
-static inline int vec_reg_offset(uint8_t reg, uint8_t enr, TCGMemOp es)
+static inline int vec_reg_offset(uint8_t reg, uint8_t enr, MemOp es)
 {
     /* Convert element size (es) - e.g. MO_8 - to bytes */
     const uint8_t bytes = 1 << es;
@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_csst(DisasContext *s, DisasOps *o)
 #ifndef CONFIG_USER_ONLY
 static DisasJumpType op_csp(DisasContext *s, DisasOps *o)
 {
-    TCGMemOp mop = s->insn->data;
+    MemOp mop = s->insn->data;
     TCGv_i64 addr, old, cc;
     TCGLabel *lab = gen_new_label();
 
@@ -XXX,XX +XXX,XX @@ static DisasJumpType op_lm64(DisasContext *s, DisasOps *o)
 static DisasJumpType op_lpd(DisasContext *s, DisasOps *o)
 {
     TCGv_i64 a1, a2;
-    TCGMemOp mop = s->insn->data;
+    MemOp mop = s->insn->data;
 
     /* In a parallel context, stop the world and single step.  */
     if (tb_cflags(s->base.tb) & CF_PARALLEL) {
diff --git a/target/s390x/translate_vx.inc.c b/target/s390x/translate_vx.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/translate_vx.inc.c
+++ b/target/s390x/translate_vx.inc.c
@@ -XXX,XX +XXX,XX @@
 #define FPF_LONG        3
 #define FPF_EXT         4
 
-static inline bool valid_vec_element(uint8_t enr, TCGMemOp es)
+static inline bool valid_vec_element(uint8_t enr, MemOp es)
 {
     return !(enr & ~(NUM_VEC_ELEMENTS(es) - 1));
 }
 
 static void read_vec_element_i64(TCGv_i64 dst, uint8_t reg, uint8_t enr,
-                                 TCGMemOp memop)
+                                 MemOp memop)
 {
     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
 
@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i64(TCGv_i64 dst, uint8_t reg, uint8_t enr,
 }
 
 static void read_vec_element_i32(TCGv_i32 dst, uint8_t reg, uint8_t enr,
-                                 TCGMemOp memop)
+                                 MemOp memop)
 {
     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
 
@@ -XXX,XX +XXX,XX @@ static void read_vec_element_i32(TCGv_i32 dst, uint8_t reg, uint8_t enr,
 }
 
 static void write_vec_element_i64(TCGv_i64 src, int reg, uint8_t enr,
-                                  TCGMemOp memop)
+                                  MemOp memop)
 {
     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
 
@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i64(TCGv_i64 src, int reg, uint8_t enr,
 }
 
 static void write_vec_element_i32(TCGv_i32 src, int reg, uint8_t enr,
-                                  TCGMemOp memop)
+                                  MemOp memop)
 {
     const int offs = vec_reg_offset(reg, enr, memop & MO_SIZE);
 
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_ne_fop_QD(DisasContext *dc, int rd, int rs,
 }
 
 static void gen_swap(DisasContext *dc, TCGv dst, TCGv src,
-                     TCGv addr, int mmu_idx, TCGMemOp memop)
+                     TCGv addr, int mmu_idx, MemOp memop)
 {
     gen_address_mask(dc, addr);
     tcg_gen_atomic_xchg_tl(dst, addr, src, mmu_idx, memop);
@@ -XXX,XX +XXX,XX @@ typedef struct {
     ASIType type;
     int asi;
     int mem_idx;
-    TCGMemOp memop;
+    MemOp memop;
 } DisasASI;
 
-static DisasASI get_asi(DisasContext *dc, int insn, TCGMemOp memop)
+static DisasASI get_asi(DisasContext *dc, int insn, MemOp memop)
 {
     int asi = GET_FIELD(insn, 19, 26);
     ASIType type = GET_ASI_HELPER;
@@ -XXX,XX +XXX,XX @@ static DisasASI get_asi(DisasContext *dc, int insn, TCGMemOp memop)
 }
 
 static void gen_ld_asi(DisasContext *dc, TCGv dst, TCGv addr,
-                       int insn, TCGMemOp memop)
+                       int insn, MemOp memop)
 {
     DisasASI da = get_asi(dc, insn, memop);
 
@@ -XXX,XX +XXX,XX @@ static void gen_ld_asi(DisasContext *dc, TCGv dst, TCGv addr,
 }
 
 static void gen_st_asi(DisasContext *dc, TCGv src, TCGv addr,
-                       int insn, TCGMemOp memop)
+                       int insn, MemOp memop)
 {
     DisasASI da = get_asi(dc, insn, memop);
 
@@ -XXX,XX +XXX,XX @@ static void gen_ldf_asi(DisasContext *dc, TCGv addr,
     case GET_ASI_BLOCK:
         /* Valid for lddfa on aligned registers only.  */
         if (size == 8 && (rd & 7) == 0) {
-            TCGMemOp memop;
+            MemOp memop;
             TCGv eight;
             int i;
 
@@ -XXX,XX +XXX,XX @@ static void gen_stf_asi(DisasContext *dc, TCGv addr,
     case GET_ASI_BLOCK:
         /* Valid for stdfa on aligned registers only.  */
         if (size == 8 && (rd & 7) == 0) {
-            TCGMemOp memop;
+            MemOp memop;
             TCGv eight;
             int i;
 
diff --git a/target/tilegx/translate.c b/target/tilegx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/translate.c
+++ b/target/tilegx/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_cmul2(TCGv tdest, TCGv tsrca, TCGv tsrcb, int sh, int rd)
 }
 
 static TileExcp gen_st_opcode(DisasContext *dc, unsigned dest, unsigned srca,
-                              unsigned srcb, TCGMemOp memop, const char *name)
+                              unsigned srcb, MemOp memop, const char *name)
 {
     if (dest) {
         return TILEGX_EXCP_OPCODE_UNKNOWN;
@@ -XXX,XX +XXX,XX @@ static TileExcp gen_st_opcode(DisasContext *dc, unsigned dest, unsigned srca,
 }
 
 static TileExcp gen_st_add_opcode(DisasContext *dc, unsigned srca, unsigned srcb,
-                                  int imm, TCGMemOp memop, const char *name)
+                                  int imm, MemOp memop, const char *name)
 {
     TCGv tsrca = load_gr(dc, srca);
     TCGv tsrcb = load_gr(dc, srcb);
@@ -XXX,XX +XXX,XX @@ static TileExcp gen_rr_opcode(DisasContext *dc, unsigned opext,
 {
     TCGv tdest, tsrca;
     const char *mnemonic;
-    TCGMemOp memop;
+    MemOp memop;
     TileExcp ret = TILEGX_EXCP_NONE;
     bool prefetch_nofault = false;
 
@@ -XXX,XX +XXX,XX @@ static TileExcp gen_rri_opcode(DisasContext *dc, unsigned opext,
     TCGv tsrca = load_gr(dc, srca);
     bool prefetch_nofault = false;
     const char *mnemonic;
-    TCGMemOp memop;
+    MemOp memop;
     int i2, i3;
     TCGv t0;
 
@@ -XXX,XX +XXX,XX @@ static TileExcp decode_y2(DisasContext *dc, tilegx_bundle_bits bundle)
     unsigned srca = get_SrcA_Y2(bundle);
     unsigned srcbdest = get_SrcBDest_Y2(bundle);
     const char *mnemonic;
-    TCGMemOp memop;
+    MemOp memop;
     bool prefetch_nofault = false;
 
     switch (OEY2(opc, mode)) {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void generate_trap(DisasContext *ctx, int class, int tin);
 /* Functions for load/save to/from memory */
 
 static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
-                                 int16_t con, TCGMemOp mop)
+                                 int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_tl(temp, r2, con);
@@ -XXX,XX +XXX,XX @@ static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
 }
 
 static inline void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
-                                 int16_t con, TCGMemOp mop)
+                                 int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_tl(temp, r2, con);
@@ -XXX,XX +XXX,XX @@ static void gen_offset_ld_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
 }
 
 static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
-                           TCGMemOp mop)
+                           MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_tl(temp, r2, off);
@@ -XXX,XX +XXX,XX @@ static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
 }
 
 static void gen_ld_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
-                           TCGMemOp mop)
+                           MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_tl(temp, r2, off);
diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.inc.c
+++ b/tcg/aarch64/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_rev16(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_insn(s, 3507, REV16, TCG_TYPE_I32, rd, rn);
 }
 
-static inline void tcg_out_sxt(TCGContext *s, TCGType ext, TCGMemOp s_bits,
+static inline void tcg_out_sxt(TCGContext *s, TCGType ext, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
     /* Using ALIASes SXTB, SXTH, SXTW, of SBFM Xd, Xn, #0, #7|15|31 */
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_sxt(TCGContext *s, TCGType ext, TCGMemOp s_bits,
     tcg_out_sbfm(s, ext, rd, rn, 0, bits);
 }
 
-static inline void tcg_out_uxt(TCGContext *s, TCGMemOp s_bits,
+static inline void tcg_out_uxt(TCGContext *s, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
     /* Using ALIASes UXTB, UXTH of UBFM Wd, Wn, #0, #7|15 */
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_adr(TCGContext *s, TCGReg rd, void *target)
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp size = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp size = opc & MO_SIZE;
 
     if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp size = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp size = opc & MO_SIZE;
 
     if (!reloc_pc19(lb->label_ptr[0], s->code_ptr)) {
         return false;
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 8);
    slow path for the failure case, which will be patched later when finalizing
    the slow path. Generated code returns the host addend in X1,
    clobbers X0,X2,X3,TMP. */
-static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, TCGMemOp opc,
+static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
                              tcg_insn_unit **label_ptr, int mem_index,
                              bool is_read)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, TCGMemOp opc,
 
 #endif /* CONFIG_SOFTMMU */
 
-static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp memop, TCGType ext,
+static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    const TCGMemOp bswap = memop & MO_BSWAP;
+    const MemOp bswap = memop & MO_BSWAP;
 
     switch (memop & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp memop, TCGType ext,
     }
 }
 
-static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp memop,
+static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    const TCGMemOp bswap = memop & MO_BSWAP;
+    const MemOp bswap = memop & MO_BSWAP;
 
     switch (memop & MO_SIZE) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp memop,
 static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
                             TCGMemOpIdx oi, TCGType ext)
 {
-    TCGMemOp memop = get_memop(oi);
+    MemOp memop = get_memop(oi);
     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
                             TCGMemOpIdx oi)
 {
-    TCGMemOp memop = get_memop(oi);
+    MemOp memop = get_memop(oi);
     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.inc.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 4);
    containing the addend of the tlb entry.  Clobbers R0, R1, R2, TMP.  */
 
 static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
-                               TCGMemOp opc, int mem_index, bool is_load)
+                               MemOp opc, int mem_index, bool is_load)
 {
     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
                    : offsetof(CPUTLBEntry, addr_write));
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     void *func;
 
     if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGReg argreg, datalo, datahi;
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
 
     if (!reloc_pc24(lb->label_ptr[0], s->code_ptr)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 }
 #endif /* SOFTMMU */
 
-static inline void tcg_out_qemu_ld_index(TCGContext *s, TCGMemOp opc,
+static inline void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
                                          TCGReg datalo, TCGReg datahi,
                                          TCGReg addrlo, TCGReg addend)
 {
-    TCGMemOp bswap = opc & MO_BSWAP;
+    MemOp bswap = opc & MO_BSWAP;
 
     switch (opc & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, TCGMemOp opc,
     }
 }
 
-static inline void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc,
+static inline void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc,
                                           TCGReg datalo, TCGReg datahi,
                                           TCGReg addrlo)
 {
-    TCGMemOp bswap = opc & MO_BSWAP;
+    MemOp bswap = opc & MO_BSWAP;
 
     switch (opc & MO_SSIZE) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
 {
     TCGReg addrlo, datalo, datahi, addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     TCGReg addend;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
 #endif
 }
 
-static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, TCGMemOp opc,
+static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, MemOp opc,
                                          TCGReg datalo, TCGReg datahi,
                                          TCGReg addrlo, TCGReg addend)
 {
-    TCGMemOp bswap = opc & MO_BSWAP;
+    MemOp bswap = opc & MO_BSWAP;
 
     switch (opc & MO_SIZE) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, TCGMemOp opc,
     }
 }
 
-static inline void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp opc,
+static inline void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc,
                                           TCGReg datalo, TCGReg datahi,
                                           TCGReg addrlo)
 {
-    TCGMemOp bswap = opc & MO_BSWAP;
+    MemOp bswap = opc & MO_BSWAP;
 
     switch (opc & MO_SIZE) {
     case MO_8:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
 {
     TCGReg addrlo, datalo, datahi, addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     TCGReg addend;
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void * const qemu_st_helpers[16] = {
    First argument register is clobbered.  */
 
 static inline void tcg_out_tlb_load(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
-                                    int mem_index, TCGMemOp opc,
+                                    int mem_index, MemOp opc,
                                     tcg_insn_unit **label_ptr, int which)
 {
     const TCGReg r0 = TCG_REG_L0;
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, bool is_64,
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     TCGReg data_reg;
     tcg_insn_unit **label_ptr = &l->label_ptr[0];
     int rexw = (l->type == TCG_TYPE_I64 ? P_REXW : 0);
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp s_bits = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp s_bits = opc & MO_SIZE;
     tcg_insn_unit **label_ptr = &l->label_ptr[0];
     TCGReg retaddr;
 
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    TCGReg base, int index, intptr_t ofs,
-                                   int seg, bool is64, TCGMemOp memop)
+                                   int seg, bool is64, MemOp memop)
 {
-    const TCGMemOp real_bswap = memop & MO_BSWAP;
-    TCGMemOp bswap = real_bswap;
+    const MemOp real_bswap = memop & MO_BSWAP;
+    MemOp bswap = real_bswap;
     int rexw = is64 * P_REXW;
     int movop = OPC_MOVL_GvEv;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
     TCGReg datalo, datahi, addrlo;
     TCGReg addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     int mem_index;
     tcg_insn_unit *label_ptr[2];
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
 
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    TCGReg base, int index, intptr_t ofs,
-                                   int seg, TCGMemOp memop)
+                                   int seg, MemOp memop)
 {
     /* ??? Ideally we wouldn't need a scratch register.  For user-only,
        we could perform the bswap twice to restore the original value
        instead of moving to the scratch.  But as it is, the L constraint
        means that TCG_REG_L0 is definitely free here.  */
     const TCGReg scratch = TCG_REG_L0;
-    const TCGMemOp real_bswap = memop & MO_BSWAP;
-    TCGMemOp bswap = real_bswap;
+    const MemOp real_bswap = memop & MO_BSWAP;
+    MemOp bswap = real_bswap;
     int movop = OPC_MOVL_EvGv;
 
     if (have_movbe && real_bswap) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
     TCGReg datalo, datahi, addrlo;
     TCGReg addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     int mem_index;
     tcg_insn_unit *label_ptr[2];
diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.inc.c
+++ b/tcg/mips/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
                              TCGReg addrh, TCGMemOpIdx oi,
                              tcg_insn_unit *label_ptr[2], bool is_load)
 {
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     unsigned s_bits = opc & MO_SIZE;
     unsigned a_bits = get_alignment_bits(opc);
     int mem_index = get_mmuidx(oi);
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     TCGReg v0;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp s_bits = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp s_bits = opc & MO_SIZE;
     int i;
 
     /* resolve label address */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 #endif
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
-                                   TCGReg base, TCGMemOp opc, bool is_64)
+                                   TCGReg base, MemOp opc, bool is_64)
 {
     switch (opc & (MO_SSIZE | MO_BSWAP)) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg addr_regl, addr_regh __attribute__((unused));
     TCGReg data_regl, data_regh;
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 }
 
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
-                                   TCGReg base, TCGMemOp opc)
+                                   TCGReg base, MemOp opc)
 {
     /* Don't clutter the code below with checks to avoid bswapping ZERO.  */
     if ((lo | hi) == 0) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg addr_regl, addr_regh __attribute__((unused));
     TCGReg data_regl, data_regh;
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
 #endif
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(qemu_ld):
             {
                 TCGMemOpIdx oi = op->args[nb_oargs + nb_iargs];
-                TCGMemOp mop = get_memop(oi);
+                MemOp mop = get_memop(oi);
                 if (!(mop & MO_SIGN)) {
                     mask = (2ULL << ((8 << (mop & MO_SIZE)) - 1)) - 1;
                 }
diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -32768);
    in CR7, loads the addend of the TLB into R3, and returns the register
    containing the guest address (zero-extended into R4).  Clobbers R0 and R2. */
 
-static TCGReg tcg_out_tlb_read(TCGContext *s, TCGMemOp opc,
+static TCGReg tcg_out_tlb_read(TCGContext *s, MemOp opc,
                                TCGReg addrlo, TCGReg addrhi,
                                int mem_index, bool is_read)
 {
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, bool is_ld, TCGMemOpIdx oi,
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     TCGReg hi, lo, arg = TCG_REG_R3;
 
     if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp s_bits = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp s_bits = opc & MO_SIZE;
     TCGReg hi, lo, arg = TCG_REG_R3;
 
     if (!reloc_pc14(lb->label_ptr[0], s->code_ptr)) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg datalo, datahi, addrlo, rbase;
     TCGReg addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc, s_bits;
+    MemOp opc, s_bits;
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg datalo, datahi, addrlo, rbase;
     TCGReg addrhi __attribute__((unused));
     TCGMemOpIdx oi;
-    TCGMemOp opc, s_bits;
+    MemOp opc, s_bits;
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     tcg_insn_unit *label_ptr;
diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.inc.c
+++ b/tcg/riscv/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
                              TCGReg addrh, TCGMemOpIdx oi,
                              tcg_insn_unit **label_ptr, bool is_load)
 {
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     unsigned s_bits = opc & MO_SIZE;
     unsigned a_bits = get_alignment_bits(opc);
     tcg_target_long compare_mask;
@@ -XXX,XX +XXX,XX @@ static void add_qemu_ldst_label(TCGContext *s, int is_ld, TCGMemOpIdx oi,
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
     TCGReg a0 = tcg_target_call_iarg_regs[0];
     TCGReg a1 = tcg_target_call_iarg_regs[1];
     TCGReg a2 = tcg_target_call_iarg_regs[2];
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 {
     TCGMemOpIdx oi = l->oi;
-    TCGMemOp opc = get_memop(oi);
-    TCGMemOp s_bits = opc & MO_SIZE;
+    MemOp opc = get_memop(oi);
+    MemOp s_bits = opc & MO_SIZE;
     TCGReg a0 = tcg_target_call_iarg_regs[0];
     TCGReg a1 = tcg_target_call_iarg_regs[1];
     TCGReg a2 = tcg_target_call_iarg_regs[2];
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 #endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
-                                   TCGReg base, TCGMemOp opc, bool is_64)
+                                   TCGReg base, MemOp opc, bool is_64)
 {
-    const TCGMemOp bswap = opc & MO_BSWAP;
+    const MemOp bswap = opc & MO_BSWAP;
 
     /* We don't yet handle byteswapping, assert */
     g_assert(!bswap);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg addr_regl, addr_regh __attribute__((unused));
     TCGReg data_regl, data_regh;
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 }
 
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
-                                   TCGReg base, TCGMemOp opc)
+                                   TCGReg base, MemOp opc)
 {
-    const TCGMemOp bswap = opc & MO_BSWAP;
+    const MemOp bswap = opc & MO_BSWAP;
 
     /* We don't yet handle byteswapping, assert */
     g_assert(!bswap);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     TCGReg addr_regl, addr_regh __attribute__((unused));
     TCGReg data_regl, data_regh;
     TCGMemOpIdx oi;
-    TCGMemOp opc;
+    MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
 #endif
diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.inc.c
+++ b/tcg/s390/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, tcg_insn_unit *dest)
     }
 }
 
-static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
+static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg data,
                                    TCGReg base, TCGReg index, int disp)
 {
     switch (opc & (MO_SSIZE | MO_BSWAP)) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
     }
 }
 
-static void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp opc, TCGReg data,
+static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
                                    TCGReg base, TCGReg index, int disp)
 {
     switch (opc & (MO_SIZE | MO_BSWAP)) {
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 19));
 
 /* Load and compare a TLB entry, leaving the flags set.  Loads the TLB
    addend into R2.  Returns a register with the santitized guest address.  */
-static TCGReg tcg_out_tlb_read(TCGContext* s, TCGReg addr_reg, TCGMemOp opc,
+static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
                                int mem_index, bool is_ld)
 {
     unsigned s_bits = opc & MO_SIZE;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
 
     if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
                      (intptr_t)s->code_ptr, 2)) {
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     TCGReg addr_reg = lb->addrlo_reg;
     TCGReg data_reg = lb->datalo_reg;
     TCGMemOpIdx oi = lb->oi;
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
 
     if (!patch_reloc(lb->label_ptr[0], R_390_PC16DBL,
                      (intptr_t)s->code_ptr, 2)) {
@@ -XXX,XX +XXX,XX @@ static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
 static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
                             TCGMemOpIdx oi)
 {
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
     tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
 static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
                             TCGMemOpIdx oi)
 {
-    TCGMemOp opc = get_memop(oi);
+    MemOp opc = get_memop(oi);
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
     tcg_insn_unit *label_ptr;
diff --git a/tcg/sparc/tcg-target.inc.c b/tcg/sparc/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.inc.c
+++ b/tcg/sparc/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 12));
    is in the returned register, maybe %o0.  The TLB addend is in %o1.  */
 
 static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
-                               TCGMemOp opc, int which)
+                               MemOp opc, int which)
 {
     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
     int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
@@ -XXX,XX +XXX,XX @@ static const int qemu_st_opc[16] = {
 static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
                             TCGMemOpIdx oi, bool is_64)
 {
-    TCGMemOp memop = get_memop(oi);
+    MemOp memop = get_memop(oi);
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
     TCGReg addrz, param;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
                             TCGMemOpIdx oi)
 {
-    TCGMemOp memop = get_memop(oi);
+    MemOp memop = get_memop(oi);
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
     TCGReg addrz, param;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_lookup_and_goto_ptr(void)
     }
 }
 
-static inline TCGMemOp tcg_canonicalize_memop(TCGMemOp op, bool is64, bool st)
+static inline MemOp tcg_canonicalize_memop(MemOp op, bool is64, bool st)
 {
     /* Trigger the asserts within as early as possible.  */
     (void)get_alignment_bits(op);
@@ -XXX,XX +XXX,XX @@ static inline TCGMemOp tcg_canonicalize_memop(TCGMemOp op, bool is64, bool st)
 }
 
 static void gen_ldst_i32(TCGOpcode opc, TCGv_i32 val, TCGv addr,
-                         TCGMemOp memop, TCGArg idx)
+                         MemOp memop, TCGArg idx)
 {
     TCGMemOpIdx oi = make_memop_idx(memop, idx);
 #if TARGET_LONG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void gen_ldst_i32(TCGOpcode opc, TCGv_i32 val, TCGv addr,
 }
 
 static void gen_ldst_i64(TCGOpcode opc, TCGv_i64 val, TCGv addr,
-                         TCGMemOp memop, TCGArg idx)
+                         MemOp memop, TCGArg idx)
 {
     TCGMemOpIdx oi = make_memop_idx(memop, idx);
 #if TARGET_LONG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_req_mo(TCGBar type)
     }
 }
 
-void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
+void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
 {
-    TCGMemOp orig_memop;
+    MemOp orig_memop;
 
     tcg_gen_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     memop = tcg_canonicalize_memop(memop, 0, 0);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
     }
 }
 
-void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
+void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
 {
     TCGv_i32 swap = NULL;
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, TCGMemOp memop)
     }
 }
 
-void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
+void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
 {
-    TCGMemOp orig_memop;
+    MemOp orig_memop;
 
     if (TCG_TARGET_REG_BITS == 32 && (memop & MO_SIZE) < MO_64) {
         tcg_gen_qemu_ld_i32(TCGV_LOW(val), addr, idx, memop);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
     }
 }
 
-void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
+void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
 {
     TCGv_i64 swap = NULL;
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, TCGMemOp memop)
     }
 }
 
-static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, TCGMemOp opc)
+static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, MemOp opc)
 {
     switch (opc & MO_SSIZE) {
     case MO_SB:
@@ -XXX,XX +XXX,XX @@ static void tcg_gen_ext_i32(TCGv_i32 ret, TCGv_i32 val, TCGMemOp opc)
     }
 }
 
-static void tcg_gen_ext_i64(TCGv_i64 ret, TCGv_i64 val, TCGMemOp opc)
+static void tcg_gen_ext_i64(TCGv_i64 ret, TCGv_i64 val, MemOp opc)
 {
     switch (opc & MO_SSIZE) {
     case MO_SB:
@@ -XXX,XX +XXX,XX @@ static void * const table_cmpxchg[16] = {
 };
 
 void tcg_gen_atomic_cmpxchg_i32(TCGv_i32 retv, TCGv addr, TCGv_i32 cmpv,
-                                TCGv_i32 newv, TCGArg idx, TCGMemOp memop)
+                                TCGv_i32 newv, TCGArg idx, MemOp memop)
 {
     memop = tcg_canonicalize_memop(memop, 0, 0);
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i32(TCGv_i32 retv, TCGv addr, TCGv_i32 cmpv,
 }
 
 void tcg_gen_atomic_cmpxchg_i64(TCGv_i64 retv, TCGv addr, TCGv_i64 cmpv,
-                                TCGv_i64 newv, TCGArg idx, TCGMemOp memop)
+                                TCGv_i64 newv, TCGArg idx, MemOp memop)
 {
     memop = tcg_canonicalize_memop(memop, 1, 0);
 
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i64(TCGv_i64 retv, TCGv addr, TCGv_i64 cmpv,
 }
 
 static void do_nonatomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
-                                TCGArg idx, TCGMemOp memop, bool new_val,
+                                TCGArg idx, MemOp memop, bool new_val,
                                 void (*gen)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
     TCGv_i32 t1 = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static void do_nonatomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
 }
 
 static void do_atomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
-                             TCGArg idx, TCGMemOp memop, void * const table[])
+                             TCGArg idx, MemOp memop, void * const table[])
 {
     gen_atomic_op_i32 gen;
 
@@ -XXX,XX +XXX,XX @@ static void do_atomic_op_i32(TCGv_i32 ret, TCGv addr, TCGv_i32 val,
 }
 
 static void do_nonatomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
-                                TCGArg idx, TCGMemOp memop, bool new_val,
+                                TCGArg idx, MemOp memop, bool new_val,
                                 void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void do_nonatomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
 }
 
 static void do_atomic_op_i64(TCGv_i64 ret, TCGv addr, TCGv_i64 val,
-                             TCGArg idx, TCGMemOp memop, void * const table[])
+                             TCGArg idx, MemOp memop, void * const table[])
 {
     memop = tcg_canonicalize_memop(memop, 1, 0);
 
@@ -XXX,XX +XXX,XX @@ static void * const table_##NAME[16] = {                                \
     WITH_ATOMIC64([MO_64 | MO_BE] = gen_helper_atomic_##NAME##q_be)     \
 };                                                                      \
 void tcg_gen_atomic_##NAME##_i32                                        \
-    (TCGv_i32 ret, TCGv addr, TCGv_i32 val, TCGArg idx, TCGMemOp memop) \
+    (TCGv_i32 ret, TCGv addr, TCGv_i32 val, TCGArg idx, MemOp memop)    \
 {                                                                       \
     if (tcg_ctx->tb_cflags & CF_PARALLEL) {                             \
         do_atomic_op_i32(ret, addr, val, idx, memop, table_##NAME);     \
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_##NAME##_i32                                        \
     }                                                                   \
 }                                                                       \
 void tcg_gen_atomic_##NAME##_i64                                        \
-    (TCGv_i64 ret, TCGv addr, TCGv_i64 val, TCGArg idx, TCGMemOp memop) \
+    (TCGv_i64 ret, TCGv addr, TCGv_i64 val, TCGArg idx, MemOp memop)    \
 {                                                                       \
     if (tcg_ctx->tb_cflags & CF_PARALLEL) {                             \
         do_atomic_op_i64(ret, addr, val, idx, memop, table_##NAME);     \
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
             case INDEX_op_qemu_st_i64:
                 {
                     TCGMemOpIdx oi = op->args[k++];
-                    TCGMemOp op = get_memop(oi);
+                    MemOp op = get_memop(oi);
                     unsigned ix = get_mmuidx(oi);
 
                     if (op & ~(MO_AMASK | MO_BSWAP | MO_SSIZE)) {
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Paolo Bonzini <pbonzini@redhat.com>
 S: Supported
 F: include/exec/ioport.h
 F: ioport.c
+F: include/exec/memop.h
 F: include/exec/memory.h
 F: include/exec/ram_addr.h
 F: memory.c
diff --git a/tcg/README b/tcg/README
index XXXXXXX..XXXXXXX 100644
--- a/tcg/README
+++ b/tcg/README
@@ -XXX,XX +XXX,XX @@ Both t0 and t1 may be split into little-endian ordered pairs of registers
 if dealing with 64-bit quantities on a 32-bit host.
 
 The memidx selects the qemu tlb index to use (e.g. user or kernel access).
-The flags are the TCGMemOp bits, selecting the sign, width, and endianness
+The flags are the MemOp bits, selecting the sign, width, and endianness
 of the memory access.
 
 For a 32-bit host, qemu_ld/st_i64 is guaranteed to only be used with a
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Introduce no-op size_memop to aid preparatory conversion of
interfaces.

Once interfaces are converted, size_memop will be implemented to
return a MemOp from size in bytes.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <35b8ee74020f67cf40848fb7d5f127cf96c851d6.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memop.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/exec/memop.h b/include/exec/memop.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -XXX,XX +XXX,XX @@ typedef enum MemOp {
     MO_SSIZE = MO_SIZE | MO_SIGN,
 } MemOp;
 
+/* Size in bytes to MemOp.  */
+static inline unsigned size_memop(unsigned size)
+{
+    /*
+     * FIXME: No-op to aid conversion of memory_region_dispatch_{read|write}
+     * "unsigned size" operand into a "MemOp op".
+     */
+    return size;
+}
+
 #endif
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Message-Id: <af407f0a34dc95ef5aaf2c00dffda7c65df23c3a.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/op_helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
+#include "exec/memop.h"
 #include "sysemu/kvm.h"
 #include "fpu/softfloat.h"
 
@@ -XXX,XX +XXX,XX @@ void helper_cache(CPUMIPSState *env, target_ulong addr, uint32_t op)
     if (op == 9) {
         /* Index Store Tag */
         memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
-                                     8, MEMTXATTRS_UNSPECIFIED);
+                                     size_memop(8), MEMTXATTRS_UNSPECIFIED);
     } else if (op == 5) {
         /* Index Load Tag */
         memory_region_dispatch_read(env->itc_tag, index, &env->CP0_TagLo,
-                                    8, MEMTXATTRS_UNSPECIFIED);
+                                    size_memop(8), MEMTXATTRS_UNSPECIFIED);
     }
 #endif
 }
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <2f41da26201fb9b0339c2b7fde34df864f7f9ea8.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/s390x/s390-pci-inst.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "s390-pci-inst.h"
 #include "s390-pci-bus.h"
+#include "exec/memop.h"
 #include "exec/memory-internal.h"
 #include "qemu/error-report.h"
 #include "sysemu/hw_accel.h"
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
     offset -= mr->addr;
-    return memory_region_dispatch_read(mr, offset, data, len,
+    return memory_region_dispatch_read(mr, offset, data, size_memop(len),
                                        MEMTXATTRS_UNSPECIFIED);
 }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
     offset -= mr->addr;
-    return memory_region_dispatch_write(mr, offset, data, len,
+    return memory_region_dispatch_write(mr, offset, data, size_memop(len),
                                         MEMTXATTRS_UNSPECIFIED);
 }
 
@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
 
     for (i = 0; i < len / 8; i++) {
         result = memory_region_dispatch_write(mr, offset + i * 8,
-                                              ldq_p(buffer + i * 8), 8,
+                                              ldq_p(buffer + i * 8),
+                                              size_memop(8),
                                               MEMTXATTRS_UNSPECIFIED);
         if (result != MEMTX_OK) {
             s390_program_interrupt(env, PGM_OPERAND, 6, ra);
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <21113bae2f54b45176701e0bf595937031368ae6.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/intc/armv7m_nvic.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
+#include "exec/memop.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
     if (attrs.secure) {
         /* S accesses to the alias act like NS accesses to the real region */
         attrs.secure = 0;
-        return memory_region_dispatch_write(mr, addr, value, size, attrs);
+        return memory_region_dispatch_write(mr, addr, value, size_memop(size),
+                                            attrs);
     } else {
         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
         if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
     if (attrs.secure) {
         /* S accesses to the alias act like NS accesses to the real region */
         attrs.secure = 0;
-        return memory_region_dispatch_read(mr, addr, data, size, attrs);
+        return memory_region_dispatch_read(mr, addr, data, size_memop(size),
+                                           attrs);
     } else {
         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
         if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
 
     /* Direct the access to the correct systick */
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
-    return memory_region_dispatch_write(mr, addr, value, size, attrs);
+    return memory_region_dispatch_write(mr, addr, value, size_memop(size),
+                                        attrs);
 }
 
 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
 
     /* Direct the access to the correct systick */
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
-    return memory_region_dispatch_read(mr, addr, data, size, attrs);
+    return memory_region_dispatch_read(mr, addr, data, size_memop(size), attrs);
 }
 
 static const MemoryRegionOps nvic_systick_ops = {
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <ebf1f78029d5ac1de1739a11d679740a87a1f02f.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/virtio/virtio-pci.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 
+#include "exec/memop.h"
 #include "standard-headers/linux/virtio_pci.h"
 #include "hw/virtio/virtio.h"
 #include "migration/qemu-file-types.h"
@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
         /* As length is under guest control, handle illegal values. */
         return;
     }
-    memory_region_dispatch_write(mr, addr, val, len, MEMTXATTRS_UNSPECIFIED);
+    memory_region_dispatch_write(mr, addr, val, size_memop(len),
+                                 MEMTXATTRS_UNSPECIFIED);
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
     /* Make sure caller aligned buf properly */
     assert(!(((uintptr_t)buf) & (len - 1)));
 
-    memory_region_dispatch_read(mr, addr, &val, len, MEMTXATTRS_UNSPECIFIED);
+    memory_region_dispatch_read(mr, addr, &val, size_memop(len),
+                                MEMTXATTRS_UNSPECIFIED);
     switch (len) {
     case 1:
         pci_set_byte(buf, val);
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <e70ff5814ac3656974180db6375397c43b0bc8b8.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/vfio/pci-quirks.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "exec/memop.h"
 #include "qemu/units.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
 
                 /* Write to the proper guest MSI-X table instead */
                 memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
-                                             offset, val, size,
+                                             offset, val, size_memop(size),
                                              MEMTXATTRS_UNSPECIFIED);
             }
             return; /* Do not write guest MSI-X data to hardware */
@@ -XXX,XX +XXX,XX @@ static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
     if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
         hwaddr offset = rtl->addr & 0xfff;
         memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
-                                    &data, size, MEMTXATTRS_UNSPECIFIED);
+                                    &data, size_memop(size),
+                                    MEMTXATTRS_UNSPECIFIED);
         trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
     }
 
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <3b042deef0a60dd49ae2320ece92120ba6027f2b.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 exec.c            |  6 ++++--
 memory_ldst.inc.c | 18 +++++++++---------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
             /* XXX: could force current_cpu to NULL to avoid
                potential bugs */
             val = ldn_p(buf, l);
-            result |= memory_region_dispatch_write(mr, addr1, val, l, attrs);
+            result |= memory_region_dispatch_write(mr, addr1, val,
+                                                   size_memop(l), attrs);
         } else {
             /* RAM case */
             ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
             /* I/O case */
             release_lock |= prepare_mmio_access(mr);
             l = memory_access_size(mr, l, addr1);
-            result |= memory_region_dispatch_read(mr, addr1, &val, l, attrs);
+            result |= memory_region_dispatch_read(mr, addr1, &val,
+                                                  size_memop(l), attrs);
             stn_p(buf, l, val);
         } else {
             /* RAM case */
diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/memory_ldst.inc.c
+++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, 4, attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(4), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap32(val);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, 8, attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(8), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap64(val);
@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, 1, attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(1), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, 2, attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(2), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap16(val);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
     if (l < 4 || !memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
-        r = memory_region_dispatch_write(mr, addr1, val, 4, attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
     } else {
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
         stl_p(ptr, val);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
             val = bswap32(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, 4, attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (!memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
-        r = memory_region_dispatch_write(mr, addr1, val, 1, attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(1), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
             val = bswap16(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, 2, attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(2), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
             val = bswap64(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, 8, attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, size_memop(8), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

The memory_region_dispatch_{read|write} operand "unsigned size" is
being converted into a "MemOp op".

Convert interfaces by using no-op size_memop.

After all interfaces are converted, size_memop will be implemented
and the memory_region_dispatch_{read|write} operand "unsigned size"
will be converted into a "MemOp op".

As size_memop is a no-op, this patch does not change any behaviour.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <c4571c76467ade83660970f7ef9d7292297f1908.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_read(mr, mr_offset,
-                                    &val, size, iotlbentry->attrs);
+    r = memory_region_dispatch_read(mr, mr_offset, &val, size_memop(size),
+                                    iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_write(mr, mr_offset,
-                                     val, size, iotlbentry->attrs);
+    r = memory_region_dispatch_write(mr, mr_offset, val, size_memop(size),
+                                     iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Convert memory_region_dispatch_{read|write} operand "unsigned size"
into a "MemOp op".

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <1dd82df5801866743f838f1d046475115a1d32da.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memop.h  | 22 +++++++++++++++-------
 include/exec/memory.h |  9 +++++----
 memory.c              |  7 +++++--
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/include/exec/memop.h b/include/exec/memop.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -XXX,XX +XXX,XX @@
 #ifndef MEMOP_H
 #define MEMOP_H
 
+#include "qemu/host-utils.h"
+
 typedef enum MemOp {
     MO_8     = 0,
     MO_16    = 1,
@@ -XXX,XX +XXX,XX @@ typedef enum MemOp {
     MO_SSIZE = MO_SIZE | MO_SIGN,
 } MemOp;
 
-/* Size in bytes to MemOp.  */
-static inline unsigned size_memop(unsigned size)
+/* MemOp to size in bytes.  */
+static inline unsigned memop_size(MemOp op)
 {
-    /*
-     * FIXME: No-op to aid conversion of memory_region_dispatch_{read|write}
-     * "unsigned size" operand into a "MemOp op".
-     */
-    return size;
+    return 1 << (op & MO_SIZE);
+}
+
+/* Size in bytes to MemOp.  */
+static inline MemOp size_memop(unsigned size)
+{
+#ifdef CONFIG_DEBUG_TCG
+    /* Power of 2 up to 8.  */
+    assert((size & (size - 1)) == 0 && size >= 1 && size <= 8);
+#endif
+    return ctz32(size);
 }
 
 #endif
diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu-common.h"
 #include "exec/hwaddr.h"
 #include "exec/memattrs.h"
+#include "exec/memop.h"
 #include "exec/ramlist.h"
 #include "qemu/bswap.h"
 #include "qemu/queue.h"
@@ -XXX,XX +XXX,XX @@ void mtree_info(bool flatview, bool dispatch_tree, bool owner);
  * @mr: #MemoryRegion to access
  * @addr: address within that region
  * @pval: pointer to uint64_t which the data is written to
- * @size: size of the access in bytes
+ * @op: size, sign, and endianness of the memory operation
  * @attrs: memory transaction attributes to use for the access
  */
 MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
                                         hwaddr addr,
                                         uint64_t *pval,
-                                        unsigned size,
+                                        MemOp op,
                                         MemTxAttrs attrs);
 /**
  * memory_region_dispatch_write: perform a write directly to the specified
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
  * @mr: #MemoryRegion to access
  * @addr: address within that region
  * @data: data to write
- * @size: size of the access in bytes
+ * @op: size, sign, and endianness of the memory operation
  * @attrs: memory transaction attributes to use for the access
  */
 MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
                                          hwaddr addr,
                                          uint64_t data,
-                                         unsigned size,
+                                         MemOp op,
                                          MemTxAttrs attrs);
 
 /**
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_dispatch_read1(MemoryRegion *mr,
 MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
                                         hwaddr addr,
                                         uint64_t *pval,
-                                        unsigned size,
+                                        MemOp op,
                                         MemTxAttrs attrs)
 {
+    unsigned size = memop_size(op);
     MemTxResult r;
 
     if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
@@ -XXX,XX +XXX,XX @@ static bool memory_region_dispatch_write_eventfds(MemoryRegion *mr,
 MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
                                          hwaddr addr,
                                          uint64_t data,
-                                         unsigned size,
+                                         MemOp op,
                                          MemTxAttrs attrs)
 {
+    unsigned size = memop_size(op);
+
     if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
         unassigned_mem_write(mr, addr, data, size);
         return MEMTX_DECODE_ERROR;
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Temporarily no-op size_memop was introduced to aid the conversion of
memory_region_dispatch_{read|write} operand "unsigned size" into
"MemOp op".

Now size_memop is implemented, again hard coded size but with
MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <76dc97273a8eb5e10170ffc16526863df808f487.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/s390x/s390-pci-inst.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
     for (i = 0; i < len / 8; i++) {
         result = memory_region_dispatch_write(mr, offset + i * 8,
                                               ldq_p(buffer + i * 8),
-                                              size_memop(8),
-                                              MEMTXATTRS_UNSPECIFIED);
+                                              MO_64, MEMTXATTRS_UNSPECIFIED);
         if (result != MEMTX_OK) {
             s390_program_interrupt(env, PGM_OPERAND, 6, ra);
             return 0;
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Temporarily no-op size_memop was introduced to aid the conversion of
memory_region_dispatch_{read|write} operand "unsigned size" into
"MemOp op".

Now size_memop is implemented, again hard coded size but with
MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Message-Id: <99c4459d5c1dc9013820be3dbda9798165c15b99.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/op_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_cache(CPUMIPSState *env, target_ulong addr, uint32_t op)
     if (op == 9) {
         /* Index Store Tag */
         memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
-                                     size_memop(8), MEMTXATTRS_UNSPECIFIED);
+                                     MO_64, MEMTXATTRS_UNSPECIFIED);
     } else if (op == 5) {
         /* Index Load Tag */
         memory_region_dispatch_read(env->itc_tag, index, &env->CP0_TagLo,
-                                    size_memop(8), MEMTXATTRS_UNSPECIFIED);
+                                    MO_64, MEMTXATTRS_UNSPECIFIED);
     }
 #endif
 }
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Temporarily no-op size_memop was introduced to aid the conversion of
memory_region_dispatch_{read|write} operand "unsigned size" into
"MemOp op".

Now size_memop is implemented, again hard coded size but with
MO_{8|16|32|64}. This is more expressive and avoids size_memop calls.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <99f69701cad294db638f84abebc58115e1b9de9a.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 memory_ldst.inc.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/memory_ldst.inc.c
+++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(4), attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, MO_32, attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap32(val);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(8), attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, MO_64, attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap64(val);
@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(1), attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, MO_8, attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, size_memop(2), attrs);
+        r = memory_region_dispatch_read(mr, addr1, &val, MO_16, attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap16(val);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
     if (l < 4 || !memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
-        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
     } else {
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
         stl_p(ptr, val);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
             val = bswap32(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, size_memop(4), attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (!memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
-        r = memory_region_dispatch_write(mr, addr1, val, size_memop(1), attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, MO_8, attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
             val = bswap16(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, size_memop(2), attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, MO_16, attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
             val = bswap64(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, size_memop(8), attrs);
+        r = memory_region_dispatch_write(mr, addr1, val, MO_64, attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Preparation for collapsing the two byte swaps adjust_endianness and
handle_bswap into the former.

Call memory_region_dispatch_{read|write} with endianness encoded into
the "MemOp op" operand.

This patch does not change any behaviour as
memory_region_dispatch_{read|write} is yet to handle the endianness.

Once it does handle endianness, callers with byte swaps can collapse
them into adjust_endianness.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Message-Id: <8066ab3eb037c0388dfadfe53c5118429dd1de3a.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memory.h    |  3 +++
 accel/tcg/cputlb.c       |  8 ++++++--
 exec.c                   | 13 +++++++++++--
 hw/intc/armv7m_nvic.c    | 15 ++++++++-------
 hw/s390x/s390-pci-inst.c |  6 ++++--
 hw/vfio/pci-quirks.c     |  5 +++--
 hw/virtio/virtio-pci.c   |  6 ++++--
 memory.c                 | 18 ++++++++++++++++++
 memory_ldst.inc.c        | 24 ++++++++++++++++++------
 9 files changed, 75 insertions(+), 23 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
     }
 }
 
+/* enum device_endian to MemOp.  */
+MemOp devend_memop(enum device_endian end);
+
 #endif
 
 #endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_read(mr, mr_offset, &val, size_memop(size),
+    r = memory_region_dispatch_read(mr, mr_offset, &val,
+                                    size_memop(size) | MO_TE,
                                     iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_write(mr, mr_offset, val, size_memop(size),
+    r = memory_region_dispatch_write(mr, mr_offset, val,
+                                     size_memop(size) | MO_TE,
                                      iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             }
         }
 
+        /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
         res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
                        mmu_idx, addr, retaddr, access_type, size);
         return handle_bswap(res, size, big_endian);
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             }
         }
 
+        /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
         io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
                   handle_bswap(val, size, big_endian),
                   addr, retaddr, size);
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
             /* XXX: could force current_cpu to NULL to avoid
                potential bugs */
             val = ldn_p(buf, l);
+            /*
+             * TODO: Merge bswap from ldn_p into memory_region_dispatch_write
+             * by using ldn_he_p and dropping MO_TE to get a host-endian value.
+             */
             result |= memory_region_dispatch_write(mr, addr1, val,
-                                                   size_memop(l), attrs);
+                                                   size_memop(l) | MO_TE,
+                                                   attrs);
         } else {
             /* RAM case */
             ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
             /* I/O case */
             release_lock |= prepare_mmio_access(mr);
             l = memory_access_size(mr, l, addr1);
+            /*
+             * TODO: Merge bswap from stn_p into memory_region_dispatch_read
+             * by using stn_he_p and dropping MO_TE to get a host-endian value.
+             */
             result |= memory_region_dispatch_read(mr, addr1, &val,
-                                                  size_memop(l), attrs);
+                                                  size_memop(l) | MO_TE, attrs);
             stn_p(buf, l, val);
         } else {
             /* RAM case */
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
     if (attrs.secure) {
         /* S accesses to the alias act like NS accesses to the real region */
         attrs.secure = 0;
-        return memory_region_dispatch_write(mr, addr, value, size_memop(size),
-                                            attrs);
+        return memory_region_dispatch_write(mr, addr, value,
+                                            size_memop(size) | MO_TE, attrs);
     } else {
         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
         if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
     if (attrs.secure) {
         /* S accesses to the alias act like NS accesses to the real region */
         attrs.secure = 0;
-        return memory_region_dispatch_read(mr, addr, data, size_memop(size),
-                                           attrs);
+        return memory_region_dispatch_read(mr, addr, data,
+                                           size_memop(size) | MO_TE, attrs);
     } else {
         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
         if (attrs.user) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
 
     /* Direct the access to the correct systick */
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
-    return memory_region_dispatch_write(mr, addr, value, size_memop(size),
-                                        attrs);
+    return memory_region_dispatch_write(mr, addr, value,
+                                        size_memop(size) | MO_TE, attrs);
 }
 
 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
 
     /* Direct the access to the correct systick */
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
-    return memory_region_dispatch_read(mr, addr, data, size_memop(size), attrs);
+    return memory_region_dispatch_read(mr, addr, data, size_memop(size) | MO_TE,
+                                       attrs);
 }
 
 static const MemoryRegionOps nvic_systick_ops = {
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
     offset -= mr->addr;
-    return memory_region_dispatch_read(mr, offset, data, size_memop(len),
+    return memory_region_dispatch_read(mr, offset, data,
+                                       size_memop(len) | MO_BE,
                                        MEMTXATTRS_UNSPECIFIED);
 }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
     offset -= mr->addr;
-    return memory_region_dispatch_write(mr, offset, data, size_memop(len),
+    return memory_region_dispatch_write(mr, offset, data,
+                                        size_memop(len) | MO_BE,
                                         MEMTXATTRS_UNSPECIFIED);
 }
 
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
 
                 /* Write to the proper guest MSI-X table instead */
                 memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
-                                             offset, val, size_memop(size),
+                                             offset, val,
+                                             size_memop(size) | MO_LE,
                                              MEMTXATTRS_UNSPECIFIED);
             }
             return; /* Do not write guest MSI-X data to hardware */
@@ -XXX,XX +XXX,XX @@ static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
     if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
         hwaddr offset = rtl->addr & 0xfff;
         memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
-                                    &data, size_memop(size),
+                                    &data, size_memop(size) | MO_LE,
                                     MEMTXATTRS_UNSPECIFIED);
         trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
     }
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
         /* As length is under guest control, handle illegal values. */
         return;
     }
-    memory_region_dispatch_write(mr, addr, val, size_memop(len),
+    /* TODO: Merge bswap from cpu_to_leXX into memory_region_dispatch_write.  */
+    memory_region_dispatch_write(mr, addr, val, size_memop(len) | MO_LE,
                                  MEMTXATTRS_UNSPECIFIED);
 }
 
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
     /* Make sure caller aligned buf properly */
     assert(!(((uintptr_t)buf) & (len - 1)));
 
-    memory_region_dispatch_read(mr, addr, &val, size_memop(len),
+    /* TODO: Merge bswap from leXX_to_cpu into memory_region_dispatch_read.  */
+    memory_region_dispatch_read(mr, addr, &val, size_memop(len) | MO_LE,
                                 MEMTXATTRS_UNSPECIFIED);
     switch (len) {
     case 1:
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static void memory_register_types(void)
 }
 
 type_init(memory_register_types)
+
+MemOp devend_memop(enum device_endian end)
+{
+    static MemOp conv[] = {
+        [DEVICE_LITTLE_ENDIAN] = MO_LE,
+        [DEVICE_BIG_ENDIAN] = MO_BE,
+        [DEVICE_NATIVE_ENDIAN] = MO_TE,
+        [DEVICE_HOST_ENDIAN] = 0,
+    };
+    switch (end) {
+    case DEVICE_LITTLE_ENDIAN:
+    case DEVICE_BIG_ENDIAN:
+    case DEVICE_NATIVE_ENDIAN:
+        return conv[end];
+    default:
+        g_assert_not_reached();
+    }
+}
diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/memory_ldst.inc.c
+++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, MO_32, attrs);
+        /* TODO: Merge bswap32 into memory_region_dispatch_read.  */
+        r = memory_region_dispatch_read(mr, addr1, &val,
+                                        MO_32 | devend_memop(endian), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap32(val);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, MO_64, attrs);
+        /* TODO: Merge bswap64 into memory_region_dispatch_read.  */
+        r = memory_region_dispatch_read(mr, addr1, &val,
+                                        MO_64 | devend_memop(endian), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap64(val);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        r = memory_region_dispatch_read(mr, addr1, &val, MO_16, attrs);
+        /* TODO: Merge bswap16 into memory_region_dispatch_read.  */
+        r = memory_region_dispatch_read(mr, addr1, &val,
+                                        MO_16 | devend_memop(endian), attrs);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
             val = bswap16(val);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
             val = bswap32(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, MO_32, attrs);
+        /* TODO: Merge bswap32 into memory_region_dispatch_write.  */
+        r = memory_region_dispatch_write(mr, addr1, val,
+                                         MO_32 | devend_memop(endian), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
             val = bswap16(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, MO_16, attrs);
+        /* TODO: Merge bswap16 into memory_region_dispatch_write.  */
+        r = memory_region_dispatch_write(mr, addr1, val,
+                                         MO_16 | devend_memop(endian), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
             val = bswap64(val);
         }
 #endif
-        r = memory_region_dispatch_write(mr, addr1, val, MO_64, attrs);
+        /* TODO: Merge bswap64 into memory_region_dispatch_write.  */
+        r = memory_region_dispatch_write(mr, addr1, val,
+                                         MO_64 | devend_memop(endian), attrs);
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Preparation for collapsing the two byte swaps adjust_endianness and
handle_bswap into the former.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <755b7104410956b743e1f1e9c34ab87db113360f.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memop.h |   6 ++
 accel/tcg/cputlb.c   | 170 +++++++++++++++++++++----------------------
 2 files changed, 87 insertions(+), 89 deletions(-)

diff --git a/include/exec/memop.h b/include/exec/memop.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -XXX,XX +XXX,XX @@ static inline MemOp size_memop(unsigned size)
     return ctz32(size);
 }
 
+/* Big endianness from MemOp.  */
+static inline bool memop_big_endian(MemOp op)
+{
+    return (op & MO_BSWAP) == MO_BE;
+}
+
 #endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
 
 static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
-                         MMUAccessType access_type, int size)
+                         MMUAccessType access_type, MemOp op)
 {
     CPUState *cpu = env_cpu(env);
     hwaddr mr_offset;
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_read(mr, mr_offset, &val,
-                                    size_memop(size) | MO_TE,
-                                    iotlbentry->attrs);
+    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
-        cpu_transaction_failed(cpu, physaddr, addr, size, access_type,
+        cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
                                mmu_idx, iotlbentry->attrs, r, retaddr);
     }
     if (locked) {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
 
 static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                       int mmu_idx, uint64_t val, target_ulong addr,
-                      uintptr_t retaddr, int size)
+                      uintptr_t retaddr, MemOp op)
 {
     CPUState *cpu = env_cpu(env);
     hwaddr mr_offset;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_write(mr, mr_offset, val,
-                                     size_memop(size) | MO_TE,
-                                     iotlbentry->attrs);
+    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
-        cpu_transaction_failed(cpu, physaddr, addr, size, MMU_DATA_STORE,
-                               mmu_idx, iotlbentry->attrs, r, retaddr);
+        cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
+                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
+                               retaddr);
     }
     if (locked) {
         qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
  * access type.
  */
 
-static inline uint64_t handle_bswap(uint64_t val, int size, bool big_endian)
+static inline uint64_t handle_bswap(uint64_t val, MemOp op)
 {
-    if ((big_endian && NEED_BE_BSWAP) || (!big_endian && NEED_LE_BSWAP)) {
-        switch (size) {
-        case 1: return val;
-        case 2: return bswap16(val);
-        case 4: return bswap32(val);
-        case 8: return bswap64(val);
+    if ((memop_big_endian(op) && NEED_BE_BSWAP) ||
+        (!memop_big_endian(op) && NEED_LE_BSWAP)) {
+        switch (op & MO_SIZE) {
+        case MO_8: return val;
+        case MO_16: return bswap16(val);
+        case MO_32: return bswap32(val);
+        case MO_64: return bswap64(val);
         default:
             g_assert_not_reached();
         }
@@ -XXX,XX +XXX,XX @@ typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
 
 static inline uint64_t __attribute__((always_inline))
 load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
-            uintptr_t retaddr, size_t size, bool big_endian, bool code_read,
+            uintptr_t retaddr, MemOp op, bool code_read,
             FullLoadHelper *full_load)
 {
     uintptr_t mmu_idx = get_mmuidx(oi);
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
     unsigned a_bits = get_alignment_bits(get_memop(oi));
     void *haddr;
     uint64_t res;
+    size_t size = memop_size(op);
 
     /* Handle CPU specific unaligned behaviour */
     if (addr & ((1 << a_bits) - 1)) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 
         /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
         res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
-                       mmu_idx, addr, retaddr, access_type, size);
-        return handle_bswap(res, size, big_endian);
+                       mmu_idx, addr, retaddr, access_type, op);
+        return handle_bswap(res, op);
     }
 
     /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
         r2 = full_load(env, addr2, oi, retaddr);
         shift = (addr & (size - 1)) * 8;
 
-        if (big_endian) {
+        if (memop_big_endian(op)) {
             /* Big-endian combine.  */
             res = (r1 << shift) | (r2 >> ((size * 8) - shift));
         } else {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (size) {
-    case 1:
+    switch (op) {
+    case MO_UB:
         res = ldub_p(haddr);
         break;
-    case 2:
-        if (big_endian) {
-            res = lduw_be_p(haddr);
-        } else {
-            res = lduw_le_p(haddr);
-        }
+    case MO_BEUW:
+        res = lduw_be_p(haddr);
         break;
-    case 4:
-        if (big_endian) {
-            res = (uint32_t)ldl_be_p(haddr);
-        } else {
-            res = (uint32_t)ldl_le_p(haddr);
-        }
+    case MO_LEUW:
+        res = lduw_le_p(haddr);
         break;
-    case 8:
-        if (big_endian) {
-            res = ldq_be_p(haddr);
-        } else {
-            res = ldq_le_p(haddr);
-        }
+    case MO_BEUL:
+        res = (uint32_t)ldl_be_p(haddr);
+        break;
+    case MO_LEUL:
+        res = (uint32_t)ldl_le_p(haddr);
+        break;
+    case MO_BEQ:
+        res = ldq_be_p(haddr);
+        break;
+    case MO_LEQ:
+        res = ldq_le_p(haddr);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 static uint64_t full_ldub_mmu(CPUArchState *env, target_ulong addr,
                               TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 1, false, false,
-                       full_ldub_mmu);
+    return load_helper(env, addr, oi, retaddr, MO_UB, false, full_ldub_mmu);
 }
 
 tcg_target_ulong helper_ret_ldub_mmu(CPUArchState *env, target_ulong addr,
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_ret_ldub_mmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_le_lduw_mmu(CPUArchState *env, target_ulong addr,
                                  TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 2, false, false,
+    return load_helper(env, addr, oi, retaddr, MO_LEUW, false,
                        full_le_lduw_mmu);
 }
 
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_le_lduw_mmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_be_lduw_mmu(CPUArchState *env, target_ulong addr,
                                  TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 2, true, false,
+    return load_helper(env, addr, oi, retaddr, MO_BEUW, false,
                        full_be_lduw_mmu);
 }
 
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_lduw_mmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_le_ldul_mmu(CPUArchState *env, target_ulong addr,
                                  TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 4, false, false,
+    return load_helper(env, addr, oi, retaddr, MO_LEUL, false,
                        full_le_ldul_mmu);
 }
 
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_le_ldul_mmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_be_ldul_mmu(CPUArchState *env, target_ulong addr,
                                  TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 4, true, false,
+    return load_helper(env, addr, oi, retaddr, MO_BEUL, false,
                        full_be_ldul_mmu);
 }
 
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldul_mmu(CPUArchState *env, target_ulong addr,
 uint64_t helper_le_ldq_mmu(CPUArchState *env, target_ulong addr,
                            TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 8, false, false,
+    return load_helper(env, addr, oi, retaddr, MO_LEQ, false,
                        helper_le_ldq_mmu);
 }
 
 uint64_t helper_be_ldq_mmu(CPUArchState *env, target_ulong addr,
                            TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 8, true, false,
+    return load_helper(env, addr, oi, retaddr, MO_BEQ, false,
                        helper_be_ldq_mmu);
 }
 
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
 
 static inline void __attribute__((always_inline))
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-             TCGMemOpIdx oi, uintptr_t retaddr, size_t size, bool big_endian)
+             TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
 {
     uintptr_t mmu_idx = get_mmuidx(oi);
     uintptr_t index = tlb_index(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
     const size_t tlb_off = offsetof(CPUTLBEntry, addr_write);
     unsigned a_bits = get_alignment_bits(get_memop(oi));
     void *haddr;
+    size_t size = memop_size(op);
 
     /* Handle CPU specific unaligned behaviour */
     if (addr & ((1 << a_bits) - 1)) {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
         io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
-                  handle_bswap(val, size, big_endian),
-                  addr, retaddr, size);
+                  handle_bswap(val, op),
+                  addr, retaddr, op);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          */
         for (i = 0; i < size; ++i) {
             uint8_t val8;
-            if (big_endian) {
+            if (memop_big_endian(op)) {
                 /* Big-endian extract.  */
                 val8 = val >> (((size - 1) * 8) - (i * 8));
             } else {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (size) {
-    case 1:
+    switch (op) {
+    case MO_UB:
         stb_p(haddr, val);
         break;
-    case 2:
-        if (big_endian) {
-            stw_be_p(haddr, val);
-        } else {
-            stw_le_p(haddr, val);
-        }
+    case MO_BEUW:
+        stw_be_p(haddr, val);
         break;
-    case 4:
-        if (big_endian) {
-            stl_be_p(haddr, val);
-        } else {
-            stl_le_p(haddr, val);
-        }
+    case MO_LEUW:
+        stw_le_p(haddr, val);
         break;
-    case 8:
-        if (big_endian) {
-            stq_be_p(haddr, val);
-        } else {
-            stq_le_p(haddr, val);
-        }
+    case MO_BEUL:
+        stl_be_p(haddr, val);
+        break;
+    case MO_LEUL:
+        stl_le_p(haddr, val);
+        break;
+    case MO_BEQ:
+        stq_be_p(haddr, val);
+        break;
+    case MO_LEQ:
+        stq_le_p(haddr, val);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
                         TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 1, false);
+    store_helper(env, addr, val, oi, retaddr, MO_UB);
 }
 
 void helper_le_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 2, false);
+    store_helper(env, addr, val, oi, retaddr, MO_LEUW);
 }
 
 void helper_be_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 2, true);
+    store_helper(env, addr, val, oi, retaddr, MO_BEUW);
 }
 
 void helper_le_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 4, false);
+    store_helper(env, addr, val, oi, retaddr, MO_LEUL);
 }
 
 void helper_be_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 4, true);
+    store_helper(env, addr, val, oi, retaddr, MO_BEUL);
 }
 
 void helper_le_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 8, false);
+    store_helper(env, addr, val, oi, retaddr, MO_LEQ);
 }
 
 void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
                        TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    store_helper(env, addr, val, oi, retaddr, 8, true);
+    store_helper(env, addr, val, oi, retaddr, MO_BEQ);
 }
 
 /* First set of helpers allows passing in of OI and RETADDR.  This makes
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
 static uint64_t full_ldub_cmmu(CPUArchState *env, target_ulong addr,
                                TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 1, false, true,
-                       full_ldub_cmmu);
+    return load_helper(env, addr, oi, retaddr, MO_8, true, full_ldub_cmmu);
 }
 
 uint8_t helper_ret_ldb_cmmu(CPUArchState *env, target_ulong addr,
@@ -XXX,XX +XXX,XX @@ uint8_t helper_ret_ldb_cmmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_le_lduw_cmmu(CPUArchState *env, target_ulong addr,
                                   TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 2, false, true,
+    return load_helper(env, addr, oi, retaddr, MO_LEUW, true,
                        full_le_lduw_cmmu);
 }
 
@@ -XXX,XX +XXX,XX @@ uint16_t helper_le_ldw_cmmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_be_lduw_cmmu(CPUArchState *env, target_ulong addr,
                                   TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 2, true, true,
+    return load_helper(env, addr, oi, retaddr, MO_BEUW, true,
                        full_be_lduw_cmmu);
 }
 
@@ -XXX,XX +XXX,XX @@ uint16_t helper_be_ldw_cmmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_le_ldul_cmmu(CPUArchState *env, target_ulong addr,
                                   TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 4, false, true,
+    return load_helper(env, addr, oi, retaddr, MO_LEUL, true,
                        full_le_ldul_cmmu);
 }
 
@@ -XXX,XX +XXX,XX @@ uint32_t helper_le_ldl_cmmu(CPUArchState *env, target_ulong addr,
 static uint64_t full_be_ldul_cmmu(CPUArchState *env, target_ulong addr,
                                   TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 4, true, true,
+    return load_helper(env, addr, oi, retaddr, MO_BEUL, true,
                        full_be_ldul_cmmu);
 }
 
@@ -XXX,XX +XXX,XX @@ uint32_t helper_be_ldl_cmmu(CPUArchState *env, target_ulong addr,
 uint64_t helper_le_ldq_cmmu(CPUArchState *env, target_ulong addr,
                             TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 8, false, true,
+    return load_helper(env, addr, oi, retaddr, MO_LEQ, true,
                        helper_le_ldq_cmmu);
 }
 
 uint64_t helper_be_ldq_cmmu(CPUArchState *env, target_ulong addr,
                             TCGMemOpIdx oi, uintptr_t retaddr)
 {
-    return load_helper(env, addr, oi, retaddr, 8, true, true,
+    return load_helper(env, addr, oi, retaddr, MO_BEQ, true,
                        helper_be_ldq_cmmu);
 }
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Now that MemOp has been pushed down into the memory API, and
callers are encoding endianness, we can collapse byte swaps
along the I/O path into the accelerator and target independent
adjust_endianness.

Collapsing byte swaps along the I/O path enables additional endian
inversion logic, e.g. SPARC64 Invert Endian TTE bit, with redundant
byte swaps cancelling out.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Message-Id: <911ff31af11922a9afba9b7ce128af8b8b80f316.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c     | 42 ++--------------------------
 exec.c                 | 17 +++---------
 hw/virtio/virtio-pci.c | 10 +++----
 memory.c               | 33 ++++++++--------------
 memory_ldst.inc.c      | 63 ------------------------------------------
 5 files changed, 23 insertions(+), 142 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
     cpu_loop_exit_atomic(env_cpu(env), retaddr);
 }
 
-#ifdef TARGET_WORDS_BIGENDIAN
-#define NEED_BE_BSWAP 0
-#define NEED_LE_BSWAP 1
-#else
-#define NEED_BE_BSWAP 1
-#define NEED_LE_BSWAP 0
-#endif
-
-/*
- * Byte Swap Helper
- *
- * This should all dead code away depending on the build host and
- * access type.
- */
-
-static inline uint64_t handle_bswap(uint64_t val, MemOp op)
-{
-    if ((memop_big_endian(op) && NEED_BE_BSWAP) ||
-        (!memop_big_endian(op) && NEED_LE_BSWAP)) {
-        switch (op & MO_SIZE) {
-        case MO_8: return val;
-        case MO_16: return bswap16(val);
-        case MO_32: return bswap32(val);
-        case MO_64: return bswap64(val);
-        default:
-            g_assert_not_reached();
-        }
-    } else {
-        return val;
-    }
-}
-
 /*
  * Load Helpers
  *
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             }
         }
 
-        /* TODO: Merge bswap into io_readx -> memory_region_dispatch_read.  */
-        res = io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
-                       mmu_idx, addr, retaddr, access_type, op);
-        return handle_bswap(res, op);
+        return io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
+                        mmu_idx, addr, retaddr, access_type, op);
     }
 
     /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             }
         }
 
-        /* TODO: Merge bswap into io_writex -> memory_region_dispatch_write.  */
         io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
-                  handle_bswap(val, op),
-                  addr, retaddr, op);
+                  val, addr, retaddr, op);
         return;
     }
 
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
             l = memory_access_size(mr, l, addr1);
             /* XXX: could force current_cpu to NULL to avoid
                potential bugs */
-            val = ldn_p(buf, l);
-            /*
-             * TODO: Merge bswap from ldn_p into memory_region_dispatch_write
-             * by using ldn_he_p and dropping MO_TE to get a host-endian value.
-             */
+            val = ldn_he_p(buf, l);
             result |= memory_region_dispatch_write(mr, addr1, val,
-                                                   size_memop(l) | MO_TE,
-                                                   attrs);
+                                                   size_memop(l), attrs);
         } else {
             /* RAM case */
             ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
             /* I/O case */
             release_lock |= prepare_mmio_access(mr);
             l = memory_access_size(mr, l, addr1);
-            /*
-             * TODO: Merge bswap from stn_p into memory_region_dispatch_read
-             * by using stn_he_p and dropping MO_TE to get a host-endian value.
-             */
             result |= memory_region_dispatch_read(mr, addr1, &val,
-                                                  size_memop(l) | MO_TE, attrs);
-            stn_p(buf, l, val);
+                                                  size_memop(l), attrs);
+            stn_he_p(buf, l, val);
         } else {
             /* RAM case */
             ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -XXX,XX +XXX,XX @@ void virtio_address_space_write(VirtIOPCIProxy *proxy, hwaddr addr,
         val = pci_get_byte(buf);
         break;
     case 2:
-        val = cpu_to_le16(pci_get_word(buf));
+        val = pci_get_word(buf);
         break;
     case 4:
-        val = cpu_to_le32(pci_get_long(buf));
+        val = pci_get_long(buf);
         break;
     default:
         /* As length is under guest control, handle illegal values. */
         return;
     }
-    /* TODO: Merge bswap from cpu_to_leXX into memory_region_dispatch_write.  */
     memory_region_dispatch_write(mr, addr, val, size_memop(len) | MO_LE,
                                  MEMTXATTRS_UNSPECIFIED);
 }
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
     /* Make sure caller aligned buf properly */
     assert(!(((uintptr_t)buf) & (len - 1)));
 
-    /* TODO: Merge bswap from leXX_to_cpu into memory_region_dispatch_read.  */
     memory_region_dispatch_read(mr, addr, &val, size_memop(len) | MO_LE,
                                 MEMTXATTRS_UNSPECIFIED);
     switch (len) {
@@ -XXX,XX +XXX,XX @@ virtio_address_space_read(VirtIOPCIProxy *proxy, hwaddr addr,
         pci_set_byte(buf, val);
         break;
     case 2:
-        pci_set_word(buf, le16_to_cpu(val));
+        pci_set_word(buf, val);
         break;
     case 4:
-        pci_set_long(buf, le32_to_cpu(val));
+        pci_set_long(buf, val);
         break;
     default:
         /* As length is under guest control, handle illegal values. */
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static bool memory_region_big_endian(MemoryRegion *mr)
 #endif
 }
 
-static bool memory_region_wrong_endianness(MemoryRegion *mr)
+static void adjust_endianness(MemoryRegion *mr, uint64_t *data, MemOp op)
 {
-#ifdef TARGET_WORDS_BIGENDIAN
-    return mr->ops->endianness == DEVICE_LITTLE_ENDIAN;
-#else
-    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
-#endif
-}
-
-static void adjust_endianness(MemoryRegion *mr, uint64_t *data, unsigned size)
-{
-    if (memory_region_wrong_endianness(mr)) {
-        switch (size) {
-        case 1:
+    if ((op & MO_BSWAP) != devend_memop(mr->ops->endianness)) {
+        switch (op & MO_SIZE) {
+        case MO_8:
             break;
-        case 2:
+        case MO_16:
             *data = bswap16(*data);
             break;
-        case 4:
+        case MO_32:
             *data = bswap32(*data);
             break;
-        case 8:
+        case MO_64:
             *data = bswap64(*data);
             break;
         default:
-            abort();
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
     }
 
     r = memory_region_dispatch_read1(mr, addr, pval, size, attrs);
-    adjust_endianness(mr, pval, size);
+    adjust_endianness(mr, pval, op);
     return r;
 }
 
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
         return MEMTX_DECODE_ERROR;
     }
 
-    adjust_endianness(mr, &data, size);
+    adjust_endianness(mr, &data, op);
 
     if ((!kvm_eventfds_enabled()) &&
         memory_region_dispatch_write_eventfds(mr, addr, data, size, attrs)) {
@@ -XXX,XX +XXX,XX @@ void memory_region_add_eventfd(MemoryRegion *mr,
     }
 
     if (size) {
-        adjust_endianness(mr, &mrfd.data, size);
+        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
     }
     memory_region_transaction_begin();
     for (i = 0; i < mr->ioeventfd_nb; ++i) {
@@ -XXX,XX +XXX,XX @@ void memory_region_del_eventfd(MemoryRegion *mr,
     unsigned i;
 
     if (size) {
-        adjust_endianness(mr, &mrfd.data, size);
+        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
     }
     memory_region_transaction_begin();
     for (i = 0; i < mr->ioeventfd_nb; ++i) {
diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/memory_ldst.inc.c
+++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        /* TODO: Merge bswap32 into memory_region_dispatch_read.  */
         r = memory_region_dispatch_read(mr, addr1, &val,
                                         MO_32 | devend_memop(endian), attrs);
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap32(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap32(val);
-        }
-#endif
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        /* TODO: Merge bswap64 into memory_region_dispatch_read.  */
         r = memory_region_dispatch_read(mr, addr1, &val,
                                         MO_64 | devend_memop(endian), attrs);
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap64(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap64(val);
-        }
-#endif
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
         release_lock |= prepare_mmio_access(mr);
 
         /* I/O case */
-        /* TODO: Merge bswap16 into memory_region_dispatch_read.  */
         r = memory_region_dispatch_read(mr, addr1, &val,
                                         MO_16 | devend_memop(endian), attrs);
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap16(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap16(val);
-        }
-#endif
     } else {
         /* RAM case */
         ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 4 || !memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
-
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap32(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap32(val);
-        }
-#endif
-        /* TODO: Merge bswap32 into memory_region_dispatch_write.  */
         r = memory_region_dispatch_write(mr, addr1, val,
                                          MO_32 | devend_memop(endian), attrs);
     } else {
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 2 || !memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
-
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap16(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap16(val);
-        }
-#endif
-        /* TODO: Merge bswap16 into memory_region_dispatch_write.  */
         r = memory_region_dispatch_write(mr, addr1, val,
                                          MO_16 | devend_memop(endian), attrs);
     } else {
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
     mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 8 || !memory_access_is_direct(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
-
-#if defined(TARGET_WORDS_BIGENDIAN)
-        if (endian == DEVICE_LITTLE_ENDIAN) {
-            val = bswap64(val);
-        }
-#else
-        if (endian == DEVICE_BIG_ENDIAN) {
-            val = bswap64(val);
-        }
-#endif
-        /* TODO: Merge bswap64 into memory_region_dispatch_write.  */
         r = memory_region_dispatch_write(mr, addr1, val,
                                          MO_64 | devend_memop(endian), attrs);
     } else {
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Notice new attribute, byte swap, and force the transaction through the
memory slow path.

Required by architectures that can invert endianness of memory
transaction, e.g. SPARC64 has the Invert Endian TTE bit.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <2a10a1f1c00a894af1212c8f68ef09c2966023c1.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memattrs.h |  2 ++
 accel/tcg/cputlb.c      | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memattrs.h
+++ b/include/exec/memattrs.h
@@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs {
     unsigned int user:1;
     /* Requester ID (for MSI for example) */
     unsigned int requester_id:16;
+    /* Invert endianness for this page */
+    unsigned int byte_swap:1;
     /*
      * The following are target-specific page-table bits.  These are not
      * related to actual memory transactions at all.  However, this structure
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
          */
         address |= TLB_RECHECK;
     }
+    if (attrs.byte_swap) {
+        /* Force the access through the I/O slow path.  */
+        address |= TLB_MMIO;
+    }
     if (!memory_region_is_ram(section->mr) &&
         !memory_region_is_romd(section->mr)) {
         /* IO memory case */
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
+    if (iotlbentry->attrs.byte_swap) {
+        op ^= MO_BSWAP;
+    }
+
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
+    if (iotlbentry->attrs.byte_swap) {
+        op ^= MO_BSWAP;
+    }
+
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

Append MemTxAttrs to interfaces so we can pass along up coming Invert
Endian TTE bit on SPARC64.

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <f8fcc3138570c460ef289a6b34ba7715ba36f99e.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/mmu_helper.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@ static const int perm_table[2][8] = {
 };
 
 static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
-                                int *prot, int *access_index,
+                                int *prot, int *access_index, MemTxAttrs *attrs,
                                 target_ulong address, int rw, int mmu_idx,
                                 target_ulong *page_size)
 {
@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     target_ulong vaddr;
     target_ulong page_size;
     int error_code = 0, prot, access_index;
+    MemTxAttrs attrs = {};
 
     /*
      * TODO: If we ever need tlb_vaddr_to_host for this target,
@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     assert(!probe);
 
     address &= TARGET_PAGE_MASK;
-    error_code = get_physical_address(env, &paddr, &prot, &access_index,
+    error_code = get_physical_address(env, &paddr, &prot, &access_index, &attrs,
                                       address, access_type,
                                       mmu_idx, &page_size);
     vaddr = address;
@@ -XXX,XX +XXX,XX @@ static inline int ultrasparc_tag_match(SparcTLBEntry *tlb,
     return 0;
 }
 
-static int get_physical_address_data(CPUSPARCState *env,
-                                     hwaddr *physical, int *prot,
+static int get_physical_address_data(CPUSPARCState *env, hwaddr *physical,
+                                     int *prot, MemTxAttrs *attrs,
                                      target_ulong address, int rw, int mmu_idx)
 {
     CPUState *cs = env_cpu(env);
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_data(CPUSPARCState *env,
     return 1;
 }
 
-static int get_physical_address_code(CPUSPARCState *env,
-                                     hwaddr *physical, int *prot,
+static int get_physical_address_code(CPUSPARCState *env, hwaddr *physical,
+                                     int *prot, MemTxAttrs *attrs,
                                      target_ulong address, int mmu_idx)
 {
     CPUState *cs = env_cpu(env);
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_code(CPUSPARCState *env,
 }
 
 static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
-                                int *prot, int *access_index,
+                                int *prot, int *access_index, MemTxAttrs *attrs,
                                 target_ulong address, int rw, int mmu_idx,
                                 target_ulong *page_size)
 {
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPUSPARCState *env, hwaddr *physical,
     }
 
     if (rw == 2) {
-        return get_physical_address_code(env, physical, prot, address,
+        return get_physical_address_code(env, physical, prot, attrs, address,
                                          mmu_idx);
     } else {
-        return get_physical_address_data(env, physical, prot, address, rw,
-                                         mmu_idx);
+        return get_physical_address_data(env, physical, prot, attrs, address,
+                                         rw, mmu_idx);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     target_ulong vaddr;
     hwaddr paddr;
     target_ulong page_size;
+    MemTxAttrs attrs = {};
     int error_code = 0, prot, access_index;
 
     address &= TARGET_PAGE_MASK;
-    error_code = get_physical_address(env, &paddr, &prot, &access_index,
+    error_code = get_physical_address(env, &paddr, &prot, &access_index, &attrs,
                                       address, access_type,
                                       mmu_idx, &page_size);
     if (likely(error_code == 0)) {
@@ -XXX,XX +XXX,XX @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                                    env->dmmu.mmu_primary_context,
                                    env->dmmu.mmu_secondary_context);
 
-        tlb_set_page(cs, vaddr, paddr, prot, mmu_idx, page_size);
+        tlb_set_page_with_attrs(cs, vaddr, paddr, attrs, prot, mmu_idx,
+                                page_size);
         return true;
     }
     if (probe) {
@@ -XXX,XX +XXX,XX @@ static int cpu_sparc_get_phys_page(CPUSPARCState *env, hwaddr *phys,
 {
     target_ulong page_size;
     int prot, access_index;
+    MemTxAttrs attrs = {};
 
-    return get_physical_address(env, phys, &prot, &access_index, addr, rw,
-                                mmu_idx, &page_size);
+    return get_physical_address(env, phys, &prot, &access_index, &attrs, addr,
+                                rw, mmu_idx, &page_size);
 }
 
 #if defined(TARGET_SPARC64)
-- 
2.17.1

From: Tony Nguyen <tony.nguyen@bt.com>

This bit configures endianness of PCI MMIO devices. It is used by
Solaris and OpenBSD sunhme drivers.

Tested working on OpenBSD.

Unfortunately Solaris 10 had a unrelated keyboard issue blocking
testing... another inch towards Solaris 10 on SPARC64 =)

Signed-off-by: Tony Nguyen <tony.nguyen@bt.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <3c8d5181a584f1b3712d3d8d66801b13cecb4b88.1566466906.git.tony.nguyen@bt.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.h        | 2 ++
 target/sparc/mmu_helper.c | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ enum {
 
 #define TTE_VALID_BIT       (1ULL << 63)
 #define TTE_NFO_BIT         (1ULL << 60)
+#define TTE_IE_BIT          (1ULL << 59)
 #define TTE_USED_BIT        (1ULL << 41)
 #define TTE_LOCKED_BIT      (1ULL <<  6)
 #define TTE_SIDEEFFECT_BIT  (1ULL <<  3)
@@ -XXX,XX +XXX,XX @@ enum {
 
 #define TTE_IS_VALID(tte)   ((tte) & TTE_VALID_BIT)
 #define TTE_IS_NFO(tte)     ((tte) & TTE_NFO_BIT)
+#define TTE_IS_IE(tte)      ((tte) & TTE_IE_BIT)
 #define TTE_IS_USED(tte)    ((tte) & TTE_USED_BIT)
 #define TTE_IS_LOCKED(tte)  ((tte) & TTE_LOCKED_BIT)
 #define TTE_IS_SIDEEFFECT(tte) ((tte) & TTE_SIDEEFFECT_BIT)
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_data(CPUSPARCState *env, hwaddr *physical,
         if (ultrasparc_tag_match(&env->dtlb[i], address, context, physical)) {
             int do_fault = 0;
 
+            if (TTE_IS_IE(env->dtlb[i].tte)) {
+                attrs->byte_swap = true;
+            }
+
             /* access ok? */
             /* multiple bits in SFSR.FT may be set on TT_DFAULT */
             if (TTE_IS_PRIV(env->dtlb[i].tte) && is_user) {
@@ -XXX,XX +XXX,XX @@ void dump_mmu(CPUSPARCState *env)
             }
             if (TTE_IS_VALID(env->dtlb[i].tte)) {
                 qemu_printf("[%02u] VA: %" PRIx64 ", PA: %llx"
-                            ", %s, %s, %s, %s, ctx %" PRId64 " %s\n",
+                            ", %s, %s, %s, %s, ie %s, ctx %" PRId64 " %s\n",
                             i,
                             env->dtlb[i].tag & (uint64_t)~0x1fffULL,
                             TTE_PA(env->dtlb[i].tte),
@@ -XXX,XX +XXX,XX @@ void dump_mmu(CPUSPARCState *env)
                             TTE_IS_W_OK(env->dtlb[i].tte) ? "RW" : "RO",
                             TTE_IS_LOCKED(env->dtlb[i].tte) ?
                             "locked" : "unlocked",
+                            TTE_IS_IE(env->dtlb[i].tte) ?
+                            "yes" : "no",
                             env->dtlb[i].tag & (uint64_t)0x1fffULL,
                             TTE_IS_GLOBAL(env->dtlb[i].tte) ?
                             "global" : "local");
-- 
2.17.1

Let the user-only watchpoint stubs resolve to empty inline functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 23 +++++++++++++++++++++++
 exec.c                | 26 ++------------------------
 2 files changed, 25 insertions(+), 24 deletions(-)

From: David Hildenbrand <david@redhat.com>

We want to perform the same checks in probe_write() to trigger a cpu
exit before doing any modifications. We'll have to pass a PC.

Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20190823100741.9621-9-david@redhat.com>
[rth: Use vaddr for len, like other watchpoint functions;
Move user-only stub to static inline.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  7 +++++++
 exec.c                | 26 ++++++++++++++++++--------
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_watchpoint_remove_by_ref(CPUState *cpu,
 static inline void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
 {
 }
+
+static inline void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                                        MemTxAttrs atr, int fl, uintptr_t ra)
+{
+}
 #else
 int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
                           int flags, CPUWatchpoint **watchpoint);
@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
                           vaddr len, int flags);
 void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
 void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                          MemTxAttrs attrs, int flags, uintptr_t ra);
 #endif
 
 /**
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps notdirty_mem_ops = {
 };
 
 /* Generate a debug exception if a watchpoint has been hit.  */
-static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                          MemTxAttrs attrs, int flags, uintptr_t ra)
 {
-    CPUState *cpu = current_cpu;
     CPUClass *cc = CPU_GET_CLASS(cpu);
-    target_ulong vaddr;
     CPUWatchpoint *wp;
 
     assert(tcg_enabled());
@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
         cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
         return;
     }
-    vaddr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
-    vaddr = cc->adjust_watchpoint_address(cpu, vaddr, len);
+
+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (cpu_watchpoint_address_matches(wp, vaddr, len)
+        if (cpu_watchpoint_address_matches(wp, addr, len)
             && (wp->flags & flags)) {
             if (flags == BP_MEM_READ) {
                 wp->flags |= BP_WATCHPOINT_HIT_READ;
             } else {
                 wp->flags |= BP_WATCHPOINT_HIT_WRITE;
             }
-            wp->hitaddr = vaddr;
+            wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
                 if (wp->flags & BP_CPU &&
@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                     cpu->exception_index = EXCP_DEBUG;
                     mmap_unlock();
-                    cpu_loop_exit(cpu);
+                    cpu_loop_exit_restore(cpu, ra);
                 } else {
                     /* Force execution of one insn next time.  */
                     cpu->cflags_next_tb = 1 | curr_cflags();
                     mmap_unlock();
+                    if (ra) {
+                        cpu_restore_state(cpu, ra, true);
+                    }
                     cpu_loop_exit_noexc(cpu);
                 }
             }
@@ -XXX,XX +XXX,XX @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
     }
 }
 
+static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
+{
+    CPUState *cpu = current_cpu;
+    vaddr addr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
+
+    cpu_check_watchpoint(cpu, addr, len, attrs, flags, 0);
+}
+
 /* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
    so these check for a hit then pass through to the normal out-of-line
    phys routines.  */
-- 
2.17.1

We had two different mechanisms to force a recheck of the tlb.

Before TLB_RECHECK was introduced, we had a PAGE_WRITE_INV bit
that would immediate set TLB_INVALID_MASK, which automatically
means that a second check of the tlb entry fails.

We can use the same mechanism to handle small pages.
Conserve TLB_* bits by removing TLB_RECHECK.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  5 +--
 accel/tcg/cputlb.c     | 86 +++++++++++-------------------------------
 2 files changed, 24 insertions(+), 67 deletions(-)

We want to move the check for watchpoints from
memory_region_section_get_iotlb to tlb_set_page_with_attrs.
Isolate the loop over watchpoints to an exported function.

Rename the existing cpu_watchpoint_address_matches to
watchpoint_address_matches, since it doesn't actually
have a cpu argument.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  7 +++++++
 exec.c                | 45 ++++++++++++++++++++++++++++---------------
 2 files changed, 36 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                                         MemTxAttrs atr, int fl, uintptr_t ra)
 {
 }
+
+static inline int cpu_watchpoint_address_matches(CPUState *cpu,
+                                                 vaddr addr, vaddr len)
+{
+    return 0;
+}
 #else
 int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
                           int flags, CPUWatchpoint **watchpoint);
@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
 void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
 void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                           MemTxAttrs attrs, int flags, uintptr_t ra);
+int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);
 #endif
 
 /**
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
  * partially or completely with the address range covered by the
  * access).
  */
-static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,
-                                                  vaddr addr,
-                                                  vaddr len)
+static inline bool watchpoint_address_matches(CPUWatchpoint *wp,
+                                              vaddr addr, vaddr len)
 {
     /* We know the lengths are non-zero, but a little caution is
      * required to avoid errors in the case where the range ends
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,
 
     return !(addr > wpend || wp->vaddr > addrend);
 }
+
+/* Return flags for watchpoints that match addr + prot.  */
+int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
+{
+    CPUWatchpoint *wp;
+    int ret = 0;
+
+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+        if (watchpoint_address_matches(wp, addr, TARGET_PAGE_SIZE)) {
+            ret |= wp->flags;
+        }
+    }
+    return ret;
+}
 #endif /* !CONFIG_USER_ONLY */
 
 /* Add a breakpoint.  */
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
                                        target_ulong *address)
 {
     hwaddr iotlb;
-    CPUWatchpoint *wp;
+    int flags, match;
 
     if (memory_region_is_ram(section->mr)) {
         /* Normal RAM.  */
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
         iotlb += xlat;
     }
 
-    /* Make accesses to pages with watchpoints go via the
-       watchpoint trap routines.  */
-    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (cpu_watchpoint_address_matches(wp, vaddr, TARGET_PAGE_SIZE)) {
-            /* Avoid trapping reads of pages with a write breakpoint. */
-            if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
-                iotlb = PHYS_SECTION_WATCH + paddr;
-                *address |= TLB_MMIO;
-                break;
-            }
-        }
+    /* Avoid trapping reads of pages with a write breakpoint. */
+    match = (prot & PAGE_READ ? BP_MEM_READ : 0)
+          | (prot & PAGE_WRITE ? BP_MEM_WRITE : 0);
+    flags = cpu_watchpoint_address_matches(cpu, vaddr, TARGET_PAGE_SIZE);
+    if (flags & match) {
+        /*
+         * Make accesses to pages with watchpoints go via the
+         * watchpoint trap routines.
+         */
+        iotlb = PHYS_SECTION_WATCH + paddr;
+        *address |= TLB_MMIO;
     }
 
     return iotlb;
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
 
     addr = cc->adjust_watchpoint_address(cpu, addr, len);
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (cpu_watchpoint_address_matches(wp, addr, len)
+        if (watchpoint_address_matches(wp, addr, len)
             && (wp->flags & flags)) {
             if (flags == BP_MEM_READ) {
                 wp->flags |= BP_WATCHPOINT_HIT_READ;
-- 
2.17.1

We are currently passing the size of the full write to
the tlb_fill for the second page.  Instead pass the real
size of the write to that page.

This argument is unused within all tlb_fill, except to be
logged via tracing, so in practice this makes no difference.

But in a moment we'll need the value of size2 for watchpoints,
and if we've computed the value we might as well use it.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         uintptr_t index2;
         CPUTLBEntry *entry2;
         target_ulong page2, tlb_addr2;
+        size_t size2;
+
     do_unaligned_access:
         /*
          * Ensure the second page is in the TLB.  Note that the first page
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          * cannot evict the first.
          */
         page2 = (addr + size) & TARGET_PAGE_MASK;
+        size2 = (addr + size) & ~TARGET_PAGE_MASK;
         index2 = tlb_index(env, mmu_idx, page2);
         entry2 = tlb_entry(env, mmu_idx, page2);
         tlb_addr2 = tlb_addr_write(entry2);
         if (!tlb_hit_page(tlb_addr2, page2)
             && !victim_tlb_hit(env, mmu_idx, index2, tlb_off,
                                page2 & TARGET_PAGE_MASK)) {
-            tlb_fill(env_cpu(env), page2, size, MMU_DATA_STORE,
+            tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
                      mmu_idx, retaddr);
         }
 
-- 
2.17.1

We have already aligned page2 to the start of the next page.
There is no reason to do that a second time.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         entry2 = tlb_entry(env, mmu_idx, page2);
         tlb_addr2 = tlb_addr_write(entry2);
         if (!tlb_hit_page(tlb_addr2, page2)
-            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off,
-                               page2 & TARGET_PAGE_MASK)) {
+            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
             tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
                      mmu_idx, retaddr);
         }
-- 
2.17.1

The raising of exceptions from check_watchpoint, buried inside
of the I/O subsystem, is fundamentally broken.  We do not have
the helper return address with which we can unwind guest state.

Replace PHYS_SECTION_WATCH and io_mem_watch with TLB_WATCHPOINT.
Move the call to cpu_check_watchpoint into the cputlb helpers
where we do have the helper return address.

This allows watchpoints on RAM to bypass the full i/o access path.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |   5 +-
 accel/tcg/cputlb.c     |  89 ++++++++++++++++++++++++++++----
 exec.c                 | 114 +++--------------------------------------
 3 files changed, 90 insertions(+), 118 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
 /* Set if TLB entry is an IO callback.  */
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
+/* Set if TLB entry contains a watchpoint.  */
+#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
-#define TLB_FLAGS_MASK  (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO)
+#define TLB_FLAGS_MASK \
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     hwaddr iotlb, xlat, sz, paddr_page;
     target_ulong vaddr_page;
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
+    int wp_flags;
 
     assert_cpu_is_self(cpu);
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     code_address = address;
     iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
                                             paddr_page, xlat, prot, &address);
+    wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
+                                              TARGET_PAGE_SIZE);
 
     index = tlb_index(env, mmu_idx, vaddr_page);
     te = tlb_entry(env, mmu_idx, vaddr_page);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     tn.addend = addend - vaddr_page;
     if (prot & PAGE_READ) {
         tn.addr_read = address;
+        if (wp_flags & BP_MEM_READ) {
+            tn.addr_read |= TLB_WATCHPOINT;
+        }
     } else {
         tn.addr_read = -1;
     }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
         if (prot & PAGE_WRITE_INV) {
             tn.addr_write |= TLB_INVALID_MASK;
         }
+        if (wp_flags & BP_MEM_WRITE) {
+            tn.addr_write |= TLB_WATCHPOINT;
+        }
     }
 
     copy_tlb_helper_locked(te, &tn);
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
         tlb_addr &= ~TLB_INVALID_MASK;
     }
 
-    /* Handle an IO access.  */
+    /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
+        CPUIOTLBEntry *iotlbentry;
+
+        /* For anything that is unaligned, recurse through full_load.  */
         if ((addr & (size - 1)) != 0) {
             goto do_unaligned_access;
         }
-        return io_readx(env, &env_tlb(env)->d[mmu_idx].iotlb[index],
-                        mmu_idx, addr, retaddr, access_type, op);
+
+        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+
+        /* Handle watchpoints.  */
+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+            /* On watchpoint hit, this will longjmp out.  */
+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
+
+            /* The backing page may or may not require I/O.  */
+            tlb_addr &= ~TLB_WATCHPOINT;
+            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
+                goto do_aligned_access;
+            }
+        }
+
+        /* Handle I/O access.  */
+        return io_readx(env, iotlbentry, mmu_idx, addr,
+                        retaddr, access_type, op);
     }
 
     /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
         return res & MAKE_64BIT_MASK(0, size * 8);
     }
 
+ do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     switch (op) {
     case MO_UB:
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
     }
 
-    /* Handle an IO access.  */
+    /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
+        CPUIOTLBEntry *iotlbentry;
+
+        /* For anything that is unaligned, recurse through byte stores.  */
         if ((addr & (size - 1)) != 0) {
             goto do_unaligned_access;
         }
-        io_writex(env, &env_tlb(env)->d[mmu_idx].iotlb[index], mmu_idx,
-                  val, addr, retaddr, op);
+
+        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+
+        /* Handle watchpoints.  */
+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+            /* On watchpoint hit, this will longjmp out.  */
+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
+
+            /* The backing page may or may not require I/O.  */
+            tlb_addr &= ~TLB_WATCHPOINT;
+            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
+                goto do_aligned_access;
+            }
+        }
+
+        /* Handle I/O access.  */
+        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         index2 = tlb_index(env, mmu_idx, page2);
         entry2 = tlb_entry(env, mmu_idx, page2);
         tlb_addr2 = tlb_addr_write(entry2);
-        if (!tlb_hit_page(tlb_addr2, page2)
-            && !victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
-            tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
-                     mmu_idx, retaddr);
+        if (!tlb_hit_page(tlb_addr2, page2)) {
+            if (!victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
+                tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
+                         mmu_idx, retaddr);
+                index2 = tlb_index(env, mmu_idx, page2);
+                entry2 = tlb_entry(env, mmu_idx, page2);
+            }
+            tlb_addr2 = tlb_addr_write(entry2);
+        }
+
+        /*
+         * Handle watchpoints.  Since this may trap, all checks
+         * must happen before any store.
+         */
+        if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+            cpu_check_watchpoint(env_cpu(env), addr, size - size2,
+                                 env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+                                 BP_MEM_WRITE, retaddr);
+        }
+        if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
+            cpu_check_watchpoint(env_cpu(env), page2, size2,
+                                 env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
+                                 BP_MEM_WRITE, retaddr);
         }
 
         /*
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         return;
     }
 
+ do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     switch (op) {
     case MO_UB:
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
 #define PHYS_SECTION_UNASSIGNED 0
 #define PHYS_SECTION_NOTDIRTY 1
 #define PHYS_SECTION_ROM 2
-#define PHYS_SECTION_WATCH 3
 
 static void io_mem_init(void);
 static void memory_map_init(void);
 static void tcg_log_global_after_sync(MemoryListener *listener);
 static void tcg_commit(MemoryListener *listener);
 
-static MemoryRegion io_mem_watch;
-
 /**
  * CPUAddressSpace: all the information a CPU needs about an AddressSpace
  * @cpu: the CPU whose AddressSpace this is
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
                                        target_ulong *address)
 {
     hwaddr iotlb;
-    int flags, match;
 
     if (memory_region_is_ram(section->mr)) {
         /* Normal RAM.  */
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
         iotlb += xlat;
     }
 
-    /* Avoid trapping reads of pages with a write breakpoint. */
-    match = (prot & PAGE_READ ? BP_MEM_READ : 0)
-          | (prot & PAGE_WRITE ? BP_MEM_WRITE : 0);
-    flags = cpu_watchpoint_address_matches(cpu, vaddr, TARGET_PAGE_SIZE);
-    if (flags & match) {
-        /*
-         * Make accesses to pages with watchpoints go via the
-         * watchpoint trap routines.
-         */
-        iotlb = PHYS_SECTION_WATCH + paddr;
-        *address |= TLB_MMIO;
-    }
-
     return iotlb;
 }
 #endif /* defined(CONFIG_USER_ONLY) */
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
 
     assert(tcg_enabled());
     if (cpu->watchpoint_hit) {
-        /* We re-entered the check after replacing the TB. Now raise
-         * the debug interrupt so that is will trigger after the
-         * current instruction. */
+        /*
+         * We re-entered the check after replacing the TB.
+         * Now raise the debug interrupt so that it will
+         * trigger after the current instruction.
+         */
+        qemu_mutex_lock_iothread();
         cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
+        qemu_mutex_unlock_iothread();
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
     }
 }
 
-static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags)
-{
-    CPUState *cpu = current_cpu;
-    vaddr addr = (cpu->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
-
-    cpu_check_watchpoint(cpu, addr, len, attrs, flags, 0);
-}
-
-/* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
-   so these check for a hit then pass through to the normal out-of-line
-   phys routines.  */
-static MemTxResult watch_mem_read(void *opaque, hwaddr addr, uint64_t *pdata,
-                                  unsigned size, MemTxAttrs attrs)
-{
-    MemTxResult res;
-    uint64_t data;
-    int asidx = cpu_asidx_from_attrs(current_cpu, attrs);
-    AddressSpace *as = current_cpu->cpu_ases[asidx].as;
-
-    check_watchpoint(addr & ~TARGET_PAGE_MASK, size, attrs, BP_MEM_READ);
-    switch (size) {
-    case 1:
-        data = address_space_ldub(as, addr, attrs, &res);
-        break;
-    case 2:
-        data = address_space_lduw(as, addr, attrs, &res);
-        break;
-    case 4:
-        data = address_space_ldl(as, addr, attrs, &res);
-        break;
-    case 8:
-        data = address_space_ldq(as, addr, attrs, &res);
-        break;
-    default: abort();
-    }
-    *pdata = data;
-    return res;
-}
-
-static MemTxResult watch_mem_write(void *opaque, hwaddr addr,
-                                   uint64_t val, unsigned size,
-                                   MemTxAttrs attrs)
-{
-    MemTxResult res;
-    int asidx = cpu_asidx_from_attrs(current_cpu, attrs);
-    AddressSpace *as = current_cpu->cpu_ases[asidx].as;
-
-    check_watchpoint(addr & ~TARGET_PAGE_MASK, size, attrs, BP_MEM_WRITE);
-    switch (size) {
-    case 1:
-        address_space_stb(as, addr, val, attrs, &res);
-        break;
-    case 2:
-        address_space_stw(as, addr, val, attrs, &res);
-        break;
-    case 4:
-        address_space_stl(as, addr, val, attrs, &res);
-        break;
-    case 8:
-        address_space_stq(as, addr, val, attrs, &res);
-        break;
-    default: abort();
-    }
-    return res;
-}
-
-static const MemoryRegionOps watch_mem_ops = {
-    .read_with_attrs = watch_mem_read,
-    .write_with_attrs = watch_mem_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-};
-
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, uint8_t *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
     memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
                           NULL, UINT64_MAX);
     memory_region_clear_global_locking(&io_mem_notdirty);
-
-    memory_region_init_io(&io_mem_watch, NULL, &watch_mem_ops, NULL,
-                          NULL, UINT64_MAX);
 }
 
 AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
     assert(n == PHYS_SECTION_NOTDIRTY);
     n = dummy_section(&d->map, fv, &io_mem_rom);
     assert(n == PHYS_SECTION_ROM);
-    n = dummy_section(&d->map, fv, &io_mem_watch);
-    assert(n == PHYS_SECTION_WATCH);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

Let size > 0 indicate a promise to write to those bytes.
Check for write watchpoints in the probed range.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190823100741.9621-10-david@redhat.com>
[rth: Recompute index after tlb_fill; check TLB_WATCHPOINT.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
+    target_ulong tlb_addr = tlb_addr_write(entry);
 
-    if (!tlb_hit(tlb_addr_write(entry), addr)) {
-        /* TLB entry is for a different page */
+    if (unlikely(!tlb_hit(tlb_addr, addr))) {
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
                      mmu_idx, retaddr);
+            /* TLB resize via tlb_fill may have moved the entry. */
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
+        tlb_addr = tlb_addr_write(entry);
+    }
+
+    /* Handle watchpoints.  */
+    if ((tlb_addr & TLB_WATCHPOINT) && size > 0) {
+        cpu_check_watchpoint(env_cpu(env), addr, size,
+                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+                             BP_MEM_WRITE, retaddr);
     }
 }
 
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

If I'm not completely wrong, we are dealing with guest addresses here
and not with host addresses. Use the right check.

Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <20190826075112.25637-2-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/mem_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
                         uintptr_t ra)
 {
 #ifdef CONFIG_USER_ONLY
-    if (!h2g_valid(addr) || !h2g_valid(addr + len - 1) ||
+    if (!guest_addr_valid(addr) || !guest_addr_valid(addr + len - 1) ||
         page_check_range(addr, len, PAGE_WRITE) < 0) {
         s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
     }
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

Hm... how did that "-" slip in (-TAGRET_PAGE_SIZE would be correct). This
currently makes us exceed one page in a single probe_write() call,
essentially leaving some memory unchecked.

Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <20190826075112.25637-3-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/mem_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
 #else
     /* test the actual access, not just any access to the page due to LAP */
     while (len) {
-        const uint64_t pagelen = -(addr | -TARGET_PAGE_MASK);
+        const uint64_t pagelen = -(addr | TARGET_PAGE_MASK);
         const uint64_t curlen = MIN(pagelen, len);
 
         probe_write(env, addr, curlen, cpu_mmu_index(env, false), ra);
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

Factor it out into common code. Similar to the !CONFIG_USER_ONLY variant,
let's not allow to cross page boundaries.

Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20190826075112.25637-4-david@redhat.com>
[rth: Move cpu & cc variables inside if block.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h   |  4 ++--
 accel/tcg/user-exec.c     | 14 ++++++++++++++
 target/s390x/mem_helper.c |  7 -------
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size);
-void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-                 uintptr_t retaddr);
 #else
 static inline void tlb_init(CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
 {
 }
 #endif
+void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
+                 uintptr_t retaddr);
 
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     g_assert_not_reached();
 }
 
+void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
+                 uintptr_t retaddr)
+{
+    if (!guest_addr_valid(addr) ||
+        page_check_range(addr, size, PAGE_WRITE) < 0) {
+        CPUState *cpu = env_cpu(env);
+        CPUClass *cc = CPU_GET_CLASS(cpu);
+
+        cc->tlb_fill(cpu, addr, size, MMU_DATA_STORE, MMU_USER_IDX, false,
+                     retaddr);
+        g_assert_not_reached();
+    }
+}
+
 #if defined(__i386__)
 
 #if defined(__NetBSD__)
diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(cu42)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t m3)
 void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
                         uintptr_t ra)
 {
-#ifdef CONFIG_USER_ONLY
-    if (!guest_addr_valid(addr) || !guest_addr_valid(addr + len - 1) ||
-        page_check_range(addr, len, PAGE_WRITE) < 0) {
-        s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
-    }
-#else
     /* test the actual access, not just any access to the page due to LAP */
     while (len) {
         const uint64_t pagelen = -(addr | TARGET_PAGE_MASK);
@@ -XXX,XX +XXX,XX @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len,
         addr = wrap_address(env, addr + curlen);
         len -= curlen;
     }
-#endif
 }
 
 void HELPER(probe_write_access)(CPUS390XState *env, uint64_t addr, uint64_t len)
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

Let's enforce the interface restriction.

Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20190826075112.25637-5-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 2 ++
 accel/tcg/user-exec.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     target_ulong tlb_addr = tlb_addr_write(entry);
 
+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
     if (unlikely(!tlb_hit(tlb_addr, addr))) {
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
 void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
                  uintptr_t retaddr)
 {
+    g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
     if (!guest_addr_valid(addr) ||
         page_check_range(addr, size, PAGE_WRITE) < 0) {
         CPUState *cpu = env_cpu(env);
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

Let's call it also for CONFIG_USER_ONLY. While at it, add a FIXME and get
rid of one local variable.

MIPS code probably needs a bigger refactoring in regards of
ensure_writable_pages(), similar to s390x, so for example, watchpoints
can be handled reliably later. The actually accessed addresses should
be probed only, not full pages.

Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Message-Id: <20190826075112.25637-6-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/op_helper.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -XXX,XX +XXX,XX @@ static inline void ensure_writable_pages(CPUMIPSState *env,
                                          int mmu_idx,
                                          uintptr_t retaddr)
 {
-#if !defined(CONFIG_USER_ONLY)
-    target_ulong page_addr;
+    /* FIXME: Probe the actual accesses (pass and use a size) */
     if (unlikely(MSA_PAGESPAN(addr))) {
         /* first page */
         probe_write(env, addr, 0, mmu_idx, retaddr);
         /* second page */
-        page_addr = (addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-        probe_write(env, page_addr, 0, mmu_idx, retaddr);
+        addr = (addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+        probe_write(env, addr, 0, mmu_idx, retaddr);
     }
-#endif
 }
 
 void helper_msa_st_b(CPUMIPSState *env, uint32_t wd,
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

... and also call it for CONFIG_USER_ONLY. This function probably will
also need some refactoring in regards to probing, however, we'll have to
come back to that later, once cleaning up the other mem helpers.

The alignment check always makes sure that the write access falls into a
single page.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190826075112.25637-8-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/mem_helper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t do_csst(CPUS390XState *env, uint32_t r3, uint64_t a1,
     }
 
     /* Sanity check writability of the store address.  */
-#ifndef CONFIG_USER_ONLY
-    probe_write(env, a2, 0, mem_idx, ra);
-#endif
+    probe_write(env, a2, 1 << sc, mem_idx, ra);
 
     /*
      * Note that the compare-and-swap is atomic, and the store is atomic,
-- 
2.17.1

From: David Hildenbrand <david@redhat.com>

... similar to tlb_vaddr_to_host(); however, allow access to the host
page except when TLB_NOTDIRTY or TLB_MMIO is set.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190830100959.26615-2-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |  4 ++--
 accel/tcg/cputlb.c      | 21 ++++++++++++++++-----
 accel/tcg/user-exec.c   |  6 ++++--
 3 files changed, 22 insertions(+), 9 deletions(-)

From: David Hildenbrand <david@redhat.com>

Let's also allow to probe other access types.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190830100959.26615-3-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 10 ++++++++--
 accel/tcg/cputlb.c      | 43 ++++++++++++++++++++++++++++++-----------
 accel/tcg/user-exec.c   | 26 +++++++++++++++++++------
 3 files changed, 60 insertions(+), 19 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
 {
 }
 #endif
-void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-                  uintptr_t retaddr);
+void *probe_access(CPUArchState *env, target_ulong addr, int size,
+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
+
+static inline void *probe_write(CPUArchState *env, target_ulong addr, int size,
+                                int mmu_idx, uintptr_t retaddr)
+{
+    return probe_access(env, addr, size, MMU_DATA_STORE, mmu_idx, retaddr);
+}
 
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
     return qemu_ram_addr_from_host_nofail(p);
 }
 
-/* Probe for whether the specified guest write access is permitted.
- * If it is not permitted then an exception will be taken in the same
- * way as if this were a real write access (and we will not return).
+/*
+ * Probe for whether the specified guest access is permitted. If it is not
+ * permitted then an exception will be taken in the same way as if this
+ * were a real access (and we will not return).
  * If the size is 0 or the page requires I/O access, returns NULL; otherwise,
  * returns the address of the host page similar to tlb_vaddr_to_host().
  */
-void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-                  uintptr_t retaddr)
+void *probe_access(CPUArchState *env, target_ulong addr, int size,
+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    target_ulong tlb_addr = tlb_addr_write(entry);
+    target_ulong tlb_addr;
+    size_t elt_ofs;
+    int wp_access;
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
+    switch (access_type) {
+    case MMU_DATA_LOAD:
+        elt_ofs = offsetof(CPUTLBEntry, addr_read);
+        wp_access = BP_MEM_READ;
+        break;
+    case MMU_DATA_STORE:
+        elt_ofs = offsetof(CPUTLBEntry, addr_write);
+        wp_access = BP_MEM_WRITE;
+        break;
+    case MMU_INST_FETCH:
+        elt_ofs = offsetof(CPUTLBEntry, addr_code);
+        wp_access = BP_MEM_READ;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    tlb_addr = tlb_read_ofs(entry, elt_ofs);
+
     if (unlikely(!tlb_hit(tlb_addr, addr))) {
-        if (!VICTIM_TLB_HIT(addr_write, addr)) {
-            tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
-                     mmu_idx, retaddr);
+        if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs,
+                            addr & TARGET_PAGE_MASK)) {
+            tlb_fill(env_cpu(env), addr, size, access_type, mmu_idx, retaddr);
             /* TLB resize via tlb_fill may have moved the entry. */
             index = tlb_index(env, mmu_idx, addr);
             entry = tlb_entry(env, mmu_idx, addr);
         }
-        tlb_addr = tlb_addr_write(entry);
+        tlb_addr = tlb_read_ofs(entry, elt_ofs);
     }
 
     if (!size) {
@@ -XXX,XX +XXX,XX @@ void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
     if (tlb_addr & TLB_WATCHPOINT) {
         cpu_check_watchpoint(env_cpu(env), addr, size,
                              env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
-                             BP_MEM_WRITE, retaddr);
+                             wp_access, retaddr);
     }
 
     if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     g_assert_not_reached();
 }
 
-void *probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
-                  uintptr_t retaddr)
+void *probe_access(CPUArchState *env, target_ulong addr, int size,
+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
+    int flags;
+
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
-    if (!guest_addr_valid(addr) ||
-        page_check_range(addr, size, PAGE_WRITE) < 0) {
+    switch (access_type) {
+    case MMU_DATA_STORE:
+        flags = PAGE_WRITE;
+        break;
+    case MMU_DATA_LOAD:
+        flags = PAGE_READ;
+        break;
+    case MMU_INST_FETCH:
+        flags = PAGE_EXEC;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (!guest_addr_valid(addr) || page_check_range(addr, size, flags) < 0) {
         CPUState *cpu = env_cpu(env);
         CPUClass *cc = CPU_GET_CLASS(cpu);
-
-        cc->tlb_fill(cpu, addr, size, MMU_DATA_STORE, MMU_USER_IDX, false,
+        cc->tlb_fill(cpu, addr, size, access_type, MMU_USER_IDX, false,
                      retaddr);
         g_assert_not_reached();
     }
-- 
2.17.1

The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221

for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:

sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)

----------------------------------------------------------------
tcg: Allow first half of insn in ram, and second half in mmio
linux-user/sparc: SIGILL for unknown trap vectors
linux-user/microblaze: SIGILL for privileged insns
linux-user: Fix deadlock while exiting due to signal
target/microblaze: Add gdbstub xml
util: Adjust cacheflush for windows-arm64
include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64

----------------------------------------------------------------
Ilya Leoshkevich (3):
      linux-user: Always exit from exclusive state in fork_end()
      cpus: Make {start,end}_exclusive() recursive
      linux-user/microblaze: Handle privileged exception

Pierrick Bouvier (2):
      util/cacheflush: fix cache on windows-arm64
      sysemu/os-win32: fix setjmp/longjmp on windows-arm64

Richard Henderson (3):
      accel/tcg: Allow the second page of an instruction to be MMIO
      linux-user/sparc: Raise SIGILL for all unhandled software traps
      target/microblaze: Add gdbstub xml

include/hw/core/cpu.h                       |  4 +-
 include/sysemu/os-win32.h                   | 28 ++++++++++--
 target/microblaze/cpu.h                     |  2 +
 accel/tcg/translator.c                      | 12 +++++-
 cpus-common.c                               | 12 +++++-
 linux-user/main.c                           | 10 +++--
 linux-user/microblaze/cpu_loop.c            | 10 ++++-
 linux-user/sparc/cpu_loop.c                 |  8 ++++
 linux-user/syscall.c                        |  1 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
 util/cacheflush.c                           | 14 ++++--
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
 meson.build                                 | 21 +++++++++
 19 files changed, 229 insertions(+), 34 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

If an instruction straddles a page boundary, and the first page
was ram, but the second page was MMIO, we would abort.  Handle
this as if both pages are MMIO, by setting the ram_addr_t for
the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>
Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
         if (host == NULL) {
             tb_page_addr_t phys_page =
                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-            /* We cannot handle MMIO as second page. */
-            assert(phys_page != -1);
+
+            /*
+             * If the second page is MMIO, treat as if the first page
+             * was MMIO as well, so that we do not cache the TB.
+             */
+            if (unlikely(phys_page == -1)) {
+                tb_set_page_addr0(tb, -1);
+                return NULL;
+            }
+
             tb_set_page_addr1(tb, phys_page);
 #ifdef CONFIG_USER_ONLY
             page_protect(end);
-- 
2.34.1

The linux kernel's trap tables vector all unassigned trap
numbers to BAD_TRAP, which then raises SIGILL.

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sparc/cpu_loop.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
             cpu_exec_step_atomic(cs);
             break;
         default:
+            /*
+             * Most software trap numbers vector to BAD_TRAP.
+             * Handle anything not explicitly matched above.
+             */
+            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
+                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
+                break;
+            }
             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
             cpu_dump_state(cs, stderr, 0);
             exit(EXIT_FAILURE);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

fork()ed processes currently start with
current_cpu->in_exclusive_context set, which is, strictly speaking, not
correct, but does not cause problems (even assertion failures).

With one of the next patches, the code begins to rely on this value, so
fix it by always calling end_exclusive() in fork_end().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c    | 10 ++++++----
 linux-user/syscall.c |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
         }
         qemu_init_cpu_list();
         gdbserver_fork(thread_cpu);
-        /* qemu_init_cpu_list() takes care of reinitializing the
-         * exclusive state, so we don't need to end_exclusive() here.
-         */
     } else {
         cpu_list_unlock();
-        end_exclusive();
     }
+    /*
+     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
+     * also need to keep current_cpu consistent, so call end_exclusive() for
+     * both child and parent.
+     */
+    end_exclusive();
 }
 
 __thread CPUState *thread_cpu;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
             cpu_clone_regs_parent(env, flags);
             fork_end(0);
         }
+        g_assert(!cpu_in_exclusive_context(cpu));
     }
     return ret;
 }
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently dying to one of the core_dump_signal()s deadlocks, because
dump_core_and_abort() calls start_exclusive() two times: first via
stop_all_tasks(), and then via preexit_cleanup() ->
qemu_plugin_user_exit().

There are a number of ways to solve this: resume after dumping core;
check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
{start,end}_exclusive() recursive. Pick the last option, since it's
the most straightforward one.

Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  4 ++--
 cpus-common.c         | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     bool unplug;
     bool crash_occurred;
     bool exit_request;
-    bool in_exclusive_context;
+    int exclusive_context_count;
     uint32_t cflags_next_tb;
     /* updates protected by BQL */
     uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
  */
 static inline bool cpu_in_exclusive_context(const CPUState *cpu)
 {
-    return cpu->in_exclusive_context;
+    return cpu->exclusive_context_count;
 }
 
 /**
diff --git a/cpus-common.c b/cpus-common.c
index XXXXXXX..XXXXXXX 100644
--- a/cpus-common.c
+++ b/cpus-common.c
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
     CPUState *other_cpu;
     int running_cpus;
 
+    if (current_cpu->exclusive_context_count) {
+        current_cpu->exclusive_context_count++;
+        return;
+    }
+
     qemu_mutex_lock(&qemu_cpu_list_lock);
     exclusive_idle();
 
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
      */
     qemu_mutex_unlock(&qemu_cpu_list_lock);
 
-    current_cpu->in_exclusive_context = true;
+    current_cpu->exclusive_context_count = 1;
 }
 
 /* Finish an exclusive operation.  */
 void end_exclusive(void)
 {
-    current_cpu->in_exclusive_context = false;
+    current_cpu->exclusive_context_count--;
+    if (current_cpu->exclusive_context_count) {
+        return;
+    }
 
     qemu_mutex_lock(&qemu_cpu_list_lock);
     qatomic_set(&pending_cpus, 0);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Follow what kernel's full_exception() is doing.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/cpu_loop.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 
 void cpu_loop(CPUMBState *env)
 {
+    int trapnr, ret, si_code, sig;
     CPUState *cs = env_cpu(env);
-    int trapnr, ret, si_code;
 
     while (1) {
         cpu_exec_start(cs);
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             switch (env->esr & 31) {
             case ESR_EC_DIVZERO:
+                sig = TARGET_SIGFPE;
                 si_code = TARGET_FPE_INTDIV;
                 break;
             case ESR_EC_FPU:
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                  * if there's no recognized bit set.  Possibly this
                  * implies that si_code is 0, but follow the structure.
                  */
+                sig = TARGET_SIGFPE;
                 si_code = env->fsr;
                 if (si_code & FSR_IO) {
                     si_code = TARGET_FPE_FLTINV;
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                     si_code = TARGET_FPE_FLTRES;
                 }
                 break;
+            case ESR_EC_PRIVINSN:
+                sig = SIGILL;
+                si_code = ILL_PRVOPC;
+                break;
             default:
                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
                         env->esr & ESR_EC_MASK);
                 cpu_dump_state(cs, stderr, 0);
                 exit(EXIT_FAILURE);
             }
-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
+            force_sig_fault(sig, si_code, env->pc);
             break;
 
         case EXCP_DEBUG:
-- 
2.34.1

Mirroring the upstream gdb xml files, the two stack boundary
registers are separated out.

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h                     |  2 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 +++++++++++-----
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 9 files changed, 128 insertions(+), 15 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
 int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
+int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
 
 static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
 {
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
 #include "exec/exec-all.h"
+#include "exec/gdbstub.h"
 #include "fpu/softfloat-helpers.h"
 
 static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
     CPUMBState *env = &cpu->env;
 
     cpu_set_cpustate_pointers(cpu);
+    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
+                             mb_cpu_gdb_write_stack_protect, 2,
+                             "microblaze-stack-protect.xml", 0);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
 
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->sysemu_ops = &mb_sysemu_ops;
 #endif
     device_class_set_props(dc, mb_properties);
-    cc->gdb_num_core_regs = 32 + 27;
+    cc->gdb_num_core_regs = 32 + 25;
+    cc->gdb_core_xml_file = "microblaze-core.xml";
 
     cc->disas_set_info = mb_disas_set_info;
     cc->tcg_ops = &mb_tcg_ops;
diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/gdbstub.c
+++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
     GDB_PVR0  = 32 + 6,
     GDB_PVR11 = 32 + 17,
     GDB_EDR   = 32 + 18,
-    GDB_SLR   = 32 + 25,
-    GDB_SHR   = 32 + 26,
+};
+
+enum {
+    GDB_SP_SHL,
+    GDB_SP_SHR,
 };
 
 int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     case GDB_EDR:
         val = env->edr;
         break;
-    case GDB_SLR:
-        val = env->slr;
-        break;
-    case GDB_SHR:
-        val = env->shr;
-        break;
     default:
         /* Other SRegs aren't modeled, so report a value of 0 */
         val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     return gdb_get_reg32(mem_buf, val);
 }
 
+int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
+{
+    uint32_t val;
+
+    switch (n) {
+    case GDB_SP_SHL:
+        val = env->slr;
+        break;
+    case GDB_SP_SHR:
+        val = env->shr;
+        break;
+    default:
+        return 0;
+    }
+    return gdb_get_reg32(mem_buf, val);
+}
+
 int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     case GDB_EDR:
         env->edr = tmp;
         break;
-    case GDB_SLR:
-        env->slr = tmp;
-        break;
-    case GDB_SHR:
-        env->shr = tmp;
-        break;
+    }
+    return 4;
+}
+
+int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case GDB_SP_SHL:
+        env->slr = ldl_p(mem_buf);
+        break;
+    case GDB_SP_SHR:
+        env->shr = ldl_p(mem_buf);
+        break;
+    default:
+        return 0;
     }
     return 4;
 }
diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-linux-user.mak
+++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_BIG_ENDIAN=y
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_BIG_ENDIAN=y
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-linux-user.mak
+++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=microblaze
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-core.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.core">
+  <reg name="r0" bitsize="32" regnum="0"/>
+  <reg name="r1" bitsize="32" type="data_ptr"/>
+  <reg name="r2" bitsize="32"/>
+  <reg name="r3" bitsize="32"/>
+  <reg name="r4" bitsize="32"/>
+  <reg name="r5" bitsize="32"/>
+  <reg name="r6" bitsize="32"/>
+  <reg name="r7" bitsize="32"/>
+  <reg name="r8" bitsize="32"/>
+  <reg name="r9" bitsize="32"/>
+  <reg name="r10" bitsize="32"/>
+  <reg name="r11" bitsize="32"/>
+  <reg name="r12" bitsize="32"/>
+  <reg name="r13" bitsize="32"/>
+  <reg name="r14" bitsize="32"/>
+  <reg name="r15" bitsize="32"/>
+  <reg name="r16" bitsize="32"/>
+  <reg name="r17" bitsize="32"/>
+  <reg name="r18" bitsize="32"/>
+  <reg name="r19" bitsize="32"/>
+  <reg name="r20" bitsize="32"/>
+  <reg name="r21" bitsize="32"/>
+  <reg name="r22" bitsize="32"/>
+  <reg name="r23" bitsize="32"/>
+  <reg name="r24" bitsize="32"/>
+  <reg name="r25" bitsize="32"/>
+  <reg name="r26" bitsize="32"/>
+  <reg name="r27" bitsize="32"/>
+  <reg name="r28" bitsize="32"/>
+  <reg name="r29" bitsize="32"/>
+  <reg name="r30" bitsize="32"/>
+  <reg name="r31" bitsize="32"/>
+  <reg name="rpc" bitsize="32" type="code_ptr"/>
+  <reg name="rmsr" bitsize="32"/>
+  <reg name="rear" bitsize="32"/>
+  <reg name="resr" bitsize="32"/>
+  <reg name="rfsr" bitsize="32"/>
+  <reg name="rbtr" bitsize="32"/>
+  <reg name="rpvr0" bitsize="32"/>
+  <reg name="rpvr1" bitsize="32"/>
+  <reg name="rpvr2" bitsize="32"/>
+  <reg name="rpvr3" bitsize="32"/>
+  <reg name="rpvr4" bitsize="32"/>
+  <reg name="rpvr5" bitsize="32"/>
+  <reg name="rpvr6" bitsize="32"/>
+  <reg name="rpvr7" bitsize="32"/>
+  <reg name="rpvr8" bitsize="32"/>
+  <reg name="rpvr9" bitsize="32"/>
+  <reg name="rpvr10" bitsize="32"/>
+  <reg name="rpvr11" bitsize="32"/>
+  <reg name="redr" bitsize="32"/>
+  <reg name="rpid" bitsize="32"/>
+  <reg name="rzpr" bitsize="32"/>
+  <reg name="rtlbx" bitsize="32"/>
+  <reg name="rtlbsx" bitsize="32"/>
+  <reg name="rtlblo" bitsize="32"/>
+  <reg name="rtlbhi" bitsize="32"/>
+</feature>
diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-stack-protect.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.stack-protect">
+  <reg name="rslr" bitsize="32"/>
+  <reg name="rshr" bitsize="32"/>
+</feature>
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

ctr_el0 access is privileged on this platform and fails as an illegal
instruction.

Windows does not offer a way to flush data cache from userspace, and
only FlushInstructionCache is available in Windows API.

The generic implementation of flush_idcache_range uses,
__builtin___clear_cache, which already use the FlushInstructionCache
function. So we rely on that.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/cacheflush.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/util/cacheflush.c b/util/cacheflush.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static bool have_coherent_icache;
 #endif
 
-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
+#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
+/*
+ * Apple does not expose CTR_EL0, so we must use system interfaces.
+ * Windows neither, but we use a generic implementation of flush_idcache_range
+ * in this case.
+ */
 static uint64_t save_ctr_el0;
 static void arch_cache_info(int *isize, int *dsize)
 {
@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
 
 /* Caches are coherent and do not require flushing; symbol inline. */
 
-#elif defined(__aarch64__)
+#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
+/*
+ * For Windows, we use generic implementation of flush_idcache_range, that
+ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
+ */
 
 #ifdef CONFIG_DARWIN
 /* Apple does not expose CTR_EL0, so we must use system interfaces. */
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Windows implementation of setjmp/longjmp is done in
C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
perform stack unwinding, which crashes from generated code.

By using alternative implementation built in mingw, we avoid doing stack
unwinding and this fixes crash when calling longjmp.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
 meson.build               | 21 +++++++++++++++++++++
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
 extern "C" {
 #endif
 
-#if defined(_WIN64)
-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
+#if defined(__aarch64__)
+/*
+ * On windows-arm64, setjmp is available in only one variant, and longjmp always
+ * does stack unwinding. This crash with generated code.
+ * Thus, we use another implementation of setjmp (not windows one), coming from
+ * mingw, which never performs stack unwinding.
+ */
+#undef setjmp
+#undef longjmp
+/*
+ * These functions are not declared in setjmp.h because __aarch64__ defines
+ * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
+ * which gets linked automatically.
+ */
+extern int __mingw_setjmp(jmp_buf);
+extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+#define setjmp(env) __mingw_setjmp(env)
+#define longjmp(env, val) __mingw_longjmp(env, val)
+#elif defined(_WIN64)
+/*
+ * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
  * If this parameter is NULL, longjump does no stack unwinding.
  * That is what we need for QEMU. Passing the value of register rsp (default)
- * lets longjmp try a stack unwinding which will crash with generated code. */
+ * lets longjmp try a stack unwinding which will crash with generated code.
+ */
 # undef setjmp
 # define setjmp(env) _setjmp(env, NULL)
-#endif
+#endif /* __aarch64__ */
 /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
  * "longjmp and don't touch the signal masks". Since we know that the
  * savemask parameter will always be zero we can safely define these
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
     }''', name: '_lock_file and _unlock_file'))
 endif
 
+if targetos == 'windows'
+  mingw_has_setjmp_longjmp = cc.links('''
+    #include <setjmp.h>
+    int main(void) {
+      /*
+       * These functions are not available in setjmp header, but may be
+       * available at link time, from libmingwex.a.
+       */
+      extern int __mingw_setjmp(jmp_buf);
+      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+      jmp_buf env;
+      __mingw_setjmp(env);
+      __mingw_longjmp(env, 0);
+    }
+  ''', name: 'mingw setjmp and longjmp')
+
+  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
+    error('mingw must provide setjmp/longjmp for windows-arm64')
+  endif
+endif
+
 ########################
 # Target configuration #
 ########################
-- 
2.34.1