Series comparison

-[PULL 00/16] tcg patch queue
+[PULL 00/24] tcg patch queue
-This is v4 of my notdirty + rom patch set with two suggested name
+The following changes since commit 6587b0c1331d427b0939c37e763842550ed581db:
 changes (qemu_build_not_reached, TLB_DISCARD_WRITE) from David and Alex.
+  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2021-10-15' into staging (2021-10-15 14:16:28 -0700)
 r~
 The following changes since commit 240ab11fb72049d6373cbbec8d788f8e411a00bc:
   Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20190924' into staging (2019-09-24 15:36:31 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20190925
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20211016
-for you to fetch changes up to ae57db63acf5a0399232f852acc5c1d83ef63400:
+for you to fetch changes up to 995b87dedc78b0467f5f18bbc3546072ba97516a:
-  cputlb: Pass retaddr to tb_check_watchpoint (2019-09-25 10:56:28 -0700)
+  Revert "cpu: Move cpu_common_props to hw/core/cpu.c" (2021-10-15 16:39:15 -0700)
 ----------------------------------------------------------------
-Fixes for TLB_BSWAP
+Move gdb singlestep to generic code
-Coversion of NOTDIRTY and ROM handling to cputlb
+Fix cpu_common_props
 Followup cleanups to cputlb
 ----------------------------------------------------------------
-Richard Henderson (16):
+Richard Henderson (24):
-      exec: Use TARGET_PAGE_BITS_MIN for TLB flags
+      accel/tcg: Handle gdb singlestep in cpu_tb_exec
-      cputlb: Disable __always_inline__ without optimization
+      target/alpha: Drop checks for singlestep_enabled
-      qemu/compiler.h: Add qemu_build_not_reached
+      target/avr: Drop checks for singlestep_enabled
-      cputlb: Use qemu_build_not_reached in load/store_helpers
+      target/cris: Drop checks for singlestep_enabled
-      cputlb: Split out load/store_memop
+      target/hexagon: Drop checks for singlestep_enabled
-      cputlb: Introduce TLB_BSWAP
+      target/arm: Drop checks for singlestep_enabled
-      exec: Adjust notdirty tracing
+      target/hppa: Drop checks for singlestep_enabled
-      cputlb: Move ROM handling from I/O path to TLB path
+      target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
-      cputlb: Move NOTDIRTY handling from I/O path to TLB path
+      target/i386: Drop check for singlestep_enabled
-      cputlb: Partially inline memory_region_section_get_iotlb
+      target/m68k: Drop checks for singlestep_enabled
-      cputlb: Merge and move memory_notdirty_write_{prepare,complete}
+      target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
-      cputlb: Handle TLB_NOTDIRTY in probe_access
+      target/microblaze: Drop checks for singlestep_enabled
-      cputlb: Remove cpu->mem_io_vaddr
+      target/mips: Fix single stepping
-      cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
+      target/mips: Drop exit checks for singlestep_enabled
-      cputlb: Pass retaddr to tb_invalidate_phys_page_fast
+      target/openrisc: Drop checks for singlestep_enabled
-      cputlb: Pass retaddr to tb_check_watchpoint
+      target/ppc: Drop exit checks for singlestep_enabled
       target/riscv: Remove dead code after exception
       target/riscv: Remove exit_tb and lookup_and_goto_ptr
       target/rx: Drop checks for singlestep_enabled
       target/s390x: Drop check for singlestep_enabled
       target/sh4: Drop check for singlestep_enabled
       target/tricore: Drop check for singlestep_enabled
       target/xtensa: Drop check for singlestep_enabled
       Revert "cpu: Move cpu_common_props to hw/core/cpu.c"
- accel/tcg/translate-all.h      |   8 +-
+ include/hw/core/cpu.h                          |  1 +
- include/exec/cpu-all.h         |  23 ++-
+ target/i386/helper.h                           |  1 -
- include/exec/cpu-common.h      |   3 -
+ target/rx/helper.h                             |  1 -
- include/exec/exec-all.h        |   6 +-
+ target/sh4/helper.h                            |  1 -
- include/exec/memory-internal.h |  65 --------
+ target/tricore/helper.h                        |  1 -
- include/hw/core/cpu.h          |   2 -
+ accel/tcg/cpu-exec.c                           | 11 ++++
- include/qemu/compiler.h        |  26 +++
+ cpu.c                                          | 21 ++++++++
- accel/tcg/cputlb.c             | 348 +++++++++++++++++++++++++----------------
+ hw/core/cpu-common.c                           | 17 +-----
- accel/tcg/translate-all.c      |  51 +++---
+ target/alpha/translate.c                       | 13 ++---
- exec.c                         | 158 +------------------
+ target/arm/translate-a64.c                     | 10 +---
- hw/core/cpu.c                  |   1 -
+ target/arm/translate.c                         | 36 +++----------
- memory.c                       |  20 ---
+ target/avr/translate.c                         | 19 ++-----
- trace-events                   |   4 +-
+ target/cris/translate.c                        | 16 ------
-files changed, 288 insertions(+), 427 deletions(-)
+ target/hexagon/translate.c                     | 12 +----
  target/hppa/translate.c                        | 17 ++----
  target/i386/tcg/misc_helper.c                  |  8 ---
  target/i386/tcg/translate.c                    |  9 ++--
  target/m68k/translate.c                        | 44 ++++-----------
  target/microblaze/translate.c                  | 18 ++-----
  target/mips/tcg/translate.c                    | 75 ++++++++++++--------------
  target/openrisc/translate.c                    | 18 ++-----
  target/ppc/translate.c                         | 38 +++----------
  target/riscv/translate.c                       | 27 +---------
  target/rx/op_helper.c                          |  8 ---
  target/rx/translate.c                          | 12 +----
  target/s390x/tcg/translate.c                   |  8 +--
  target/sh4/op_helper.c                         |  5 --
  target/sh4/translate.c                         | 14 ++---
  target/tricore/op_helper.c                     |  7 ---
  target/tricore/translate.c                     | 14 +----
  target/xtensa/translate.c                      | 25 +++------
  target/riscv/insn_trans/trans_privileged.c.inc | 10 ++--
  target/riscv/insn_trans/trans_rvi.c.inc        |  8 ++-
  target/riscv/insn_trans/trans_rvv.c.inc        |  2 +-
 files changed, 141 insertions(+), 386 deletions(-)

-[PULL 10/16] cputlb: Partially inline memory_region_section_get_iotlb
+[PULL 01/24] accel/tcg: Handle gdb singlestep in cpu_tb_exec
-There is only one caller, tlb_set_page_with_attrs.  We cannot
+Currently the change in cpu_tb_exec is masked by the debug exception
-inline the entire function because the AddressSpaceDispatch
+being raised by the translators.  But this allows us to remove that code.
 structure is private to exec.c, and cannot easily be moved to
 include/exec/memory-internal.h.
-Compute is_ram and is_romd once within tlb_set_page_with_attrs.
-Fold the number of tests against these predicates.  Compute
-cpu_physical_memory_is_clean outside of the tlb lock region.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h |  6 +---
+ accel/tcg/cpu-exec.c | 11 +++++++++++
- accel/tcg/cputlb.c      | 68 ++++++++++++++++++++++++++---------------
+file changed, 11 insertions(+)
  exec.c                  | 22 ++-----------
 files changed, 47 insertions(+), 49 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/accel/tcg/cpu-exec.c
-+++ b/include/exec/exec-all.h
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-                                   hwaddr *xlat, hwaddr *plen,
+             cc->set_pc(cpu, last_tb->pc);
-                                   MemTxAttrs attrs, int *prot);
+         }
  hwaddr memory_region_section_get_iotlb(CPUState *cpu,
 -                                       MemoryRegionSection *section,
 -                                       target_ulong vaddr,
 -                                       hwaddr paddr, hwaddr xlat,
 -                                       int prot,
 -                                       target_ulong *address);
 +                                       MemoryRegionSection *section);
  #endif
  /* vl.c */
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      MemoryRegionSection *section;
      unsigned int index;
      target_ulong address;
 -    target_ulong code_address;
 +    target_ulong write_address;
      uintptr_t addend;
      CPUTLBEntry *te, tn;
      hwaddr iotlb, xlat, sz, paddr_page;
      target_ulong vaddr_page;
      int asidx = cpu_asidx_from_attrs(cpu, attrs);
      int wp_flags;
 +    bool is_ram, is_romd;
      assert_cpu_is_self(cpu);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      if (attrs.byte_swap) {
          address |= TLB_BSWAP;
      }
--    if (!memory_region_is_ram(section->mr) &&
--        !memory_region_is_romd(section->mr)) {
--        /* IO memory case */
--        address |= TLB_MMIO;
--        addend = 0;
--    } else {
 +
-+    is_ram = memory_region_is_ram(section->mr);
++    /*
-+    is_romd = memory_region_is_romd(section->mr);
++     * If gdb single-step, and we haven't raised another exception,
-+
++     * raise a debug exception.  Single-step with another exception
-+    if (is_ram || is_romd) {
++     * is handled in cpu_handle_exception.
-+        /* RAM and ROMD both have associated host memory. */
++     */
-         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
++    if (unlikely(cpu->singlestep_enabled) && cpu->exception_index == -1) {
-+    } else {
++        cpu->exception_index = EXCP_DEBUG;
-+        /* I/O does not; force the host address to NULL. */
++        cpu_loop_exit(cpu);
 +        addend = 0;
 +    }
 +
-+    write_address = address;
+     return last_tb;
 +    if (is_ram) {
 +        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
 +        /*
 +         * Computing is_clean is expensive; avoid all that unless
 +         * the page is actually writable.
 +         */
 +        if (prot & PAGE_WRITE) {
 +            if (section->readonly) {
 +                write_address |= TLB_DISCARD_WRITE;
 +            } else if (cpu_physical_memory_is_clean(iotlb)) {
 +                write_address |= TLB_NOTDIRTY;
 +            }
 +        }
 +    } else {
 +        /* I/O or ROMD */
 +        iotlb = memory_region_section_get_iotlb(cpu, section) + xlat;
 +        /*
 +         * Writes to romd devices must go through MMIO to enable write.
 +         * Reads to romd devices go through the ram_ptr found above,
 +         * but of course reads to I/O must go through MMIO.
 +         */
 +        write_address |= TLB_MMIO;
 +        if (!is_romd) {
 +            address = write_address;
 +        }
      }
 -    code_address = address;
 -    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
 -                                            paddr_page, xlat, prot, &address);
      wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
                                                TARGET_PAGE_SIZE);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      /*
       * At this point iotlb contains a physical section number in the lower
       * TARGET_PAGE_BITS, and either
 -     *  + the ram_addr_t of the page base of the target RAM (if NOTDIRTY or ROM)
 -     *  + the offset within section->mr of the page base (otherwise)
 +     *  + the ram_addr_t of the page base of the target RAM (RAM)
 +     *  + the offset within section->mr of the page base (I/O, ROMD)
       * We subtract the vaddr_page (which is page aligned and thus won't
       * disturb the low bits) to give an offset which can be added to the
       * (non-page-aligned) vaddr of the eventual memory access to get
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      }
      if (prot & PAGE_EXEC) {
 -        tn.addr_code = code_address;
 +        tn.addr_code = address;
      } else {
          tn.addr_code = -1;
      }
      tn.addr_write = -1;
      if (prot & PAGE_WRITE) {
 -        tn.addr_write = address;
 -        if (memory_region_is_romd(section->mr)) {
 -            /* Use the MMIO path so that the device can switch states. */
 -            tn.addr_write |= TLB_MMIO;
 -        } else if (memory_region_is_ram(section->mr)) {
 -            if (section->readonly) {
 -                tn.addr_write |= TLB_DISCARD_WRITE;
 -            } else if (cpu_physical_memory_is_clean(
 -                        memory_region_get_ram_addr(section->mr) + xlat)) {
 -                tn.addr_write |= TLB_NOTDIRTY;
 -            }
 -        }
 +        tn.addr_write = write_address;
          if (prot & PAGE_WRITE_INV) {
              tn.addr_write |= TLB_INVALID_MASK;
          }
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
  /* Called from RCU critical section */
  hwaddr memory_region_section_get_iotlb(CPUState *cpu,
 -                                       MemoryRegionSection *section,
 -                                       target_ulong vaddr,
 -                                       hwaddr paddr, hwaddr xlat,
 -                                       int prot,
 -                                       target_ulong *address)
 +                                       MemoryRegionSection *section)
  {
 -    hwaddr iotlb;
 -
 -    if (memory_region_is_ram(section->mr)) {
 -        /* Normal RAM.  */
 -        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
 -    } else {
 -        AddressSpaceDispatch *d;
 -
 -        d = flatview_to_dispatch(section->fv);
 -        iotlb = section - d->map.sections;
 -        iotlb += xlat;
 -    }
 -
 -    return iotlb;
 +    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
 +    return section - d->map.sections;
  }
- #endif /* defined(CONFIG_USER_ONLY) */
 --
-.17.1
+.25.1

-New patch
+[PULL 02/24] target/alpha: Drop checks for singlestep_enabled
+GDB single-stepping is now handled generically.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/alpha/translate.c | 13 +++----------
+file changed, 3 insertions(+), 10 deletions(-)
+diff --git a/target/alpha/translate.c b/target/alpha/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/translate.c
++++ b/target/alpha/translate.c
+@@ -XXX,XX +XXX,XX @@ static void alpha_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+         tcg_gen_movi_i64(cpu_pc, ctx->base.pc_next);
+         /* FALLTHRU */
+     case DISAS_PC_UPDATED:
+-        if (!ctx->base.singlestep_enabled) {
+-            tcg_gen_lookup_and_goto_ptr();
+-            break;
+-        }
+-        /* FALLTHRU */
++        tcg_gen_lookup_and_goto_ptr();
++        break;
+     case DISAS_PC_UPDATED_NOCHAIN:
+-        if (ctx->base.singlestep_enabled) {
+-            gen_excp_1(EXCP_DEBUG, 0);
+-        } else {
+-            tcg_gen_exit_tb(NULL, 0);
+-        }
++        tcg_gen_exit_tb(NULL, 0);
+         break;
+     default:
+         g_assert_not_reached();
+--
+.25.1

-New patch
+[PULL 03/24] target/avr: Drop checks for singlestep_enabled
+GDB single-stepping is now handled generically.
+Tested-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/avr/translate.c | 19 ++++---------------
+file changed, 4 insertions(+), 15 deletions(-)
+diff --git a/target/avr/translate.c b/target/avr/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/avr/translate.c
++++ b/target/avr/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+         tcg_gen_exit_tb(tb, n);
+     } else {
+         tcg_gen_movi_i32(cpu_pc, dest);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_helper_debug(cpu_env);
+-        } else {
+-            tcg_gen_lookup_and_goto_ptr();
+-        }
++        tcg_gen_lookup_and_goto_ptr();
+     }
+     ctx->base.is_jmp = DISAS_NORETURN;
+ }
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+         tcg_gen_movi_tl(cpu_pc, ctx->npc);
+         /* fall through */
+     case DISAS_LOOKUP:
+-        if (!ctx->base.singlestep_enabled) {
+-            tcg_gen_lookup_and_goto_ptr();
+-            break;
+-        }
+-        /* fall through */
++        tcg_gen_lookup_and_goto_ptr();
++        break;
+     case DISAS_EXIT:
+-        if (ctx->base.singlestep_enabled) {
+-            gen_helper_debug(cpu_env);
+-        } else {
+-            tcg_gen_exit_tb(NULL, 0);
+-        }
++        tcg_gen_exit_tb(NULL, 0);
+         break;
+     default:
+         g_assert_not_reached();
+--
+.25.1

-[PULL 12/16] cputlb: Handle TLB_NOTDIRTY in probe_access
+[PULL 04/24] target/cris: Drop checks for singlestep_enabled
-We can use notdirty_write for the write and return a valid host
+GDB single-stepping is now handled generically.
 pointer for this case.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 26 +++++++++++++++++---------
+ target/cris/translate.c | 16 ----------------
-file changed, 17 insertions(+), 9 deletions(-)
+file changed, 16 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/cris/translate.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/cris/translate.c
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+@@ -XXX,XX +XXX,XX @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-         return NULL;
+         }
      }
--    /* Handle watchpoints.  */
+-    if (unlikely(dc->base.singlestep_enabled)) {
--    if (tlb_addr & TLB_WATCHPOINT) {
+-        switch (is_jmp) {
--        cpu_check_watchpoint(env_cpu(env), addr, size,
+-        case DISAS_TOO_MANY:
--                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+-        case DISAS_UPDATE_NEXT:
--                             wp_access, retaddr);
+-            tcg_gen_movi_tl(env_pc, npc);
 -            /* fall through */
 -        case DISAS_JUMP:
 -        case DISAS_UPDATE:
 -            t_gen_raise_exception(EXCP_DEBUG);
 -            return;
 -        default:
 -            break;
 -        }
 -        g_assert_not_reached();
 -    }
-+    if (unlikely(tlb_addr & TLB_FLAGS_MASK)) {
+-
-+        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+     switch (is_jmp) {
+     case DISAS_TOO_MANY:
--    /* Reject I/O access, or other required slow-path.  */
+         gen_goto_tb(dc, 0, npc);
 -    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
 -        return NULL;
 +        /* Reject I/O access, or other required slow-path.  */
 +        if (tlb_addr & (TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
 +            return NULL;
 +        }
 +
 +        /* Handle watchpoints.  */
 +        if (tlb_addr & TLB_WATCHPOINT) {
 +            cpu_check_watchpoint(env_cpu(env), addr, size,
 +                                 iotlbentry->attrs, wp_access, retaddr);
 +        }
 +
 +        /* Handle clean RAM pages.  */
 +        if (tlb_addr & TLB_NOTDIRTY) {
 +            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
 +        }
      }
      return (void *)((uintptr_t)addr + entry->addend);
 --
-.17.1
+.25.1

-New patch
+[PULL 05/24] target/hexagon: Drop checks for singlestep_enabled
+GDB single-stepping is now handled generically.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/hexagon/translate.c | 12 ++----------
+file changed, 2 insertions(+), 10 deletions(-)
+diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/translate.c
++++ b/target/hexagon/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_end_tb(DisasContext *ctx)
+ {
+     gen_exec_counters(ctx);
+     tcg_gen_mov_tl(hex_gpr[HEX_REG_PC], hex_next_PC);
+-    if (ctx->base.singlestep_enabled) {
+-        gen_exception_raw(EXCP_DEBUG);
+-    } else {
+-        tcg_gen_exit_tb(NULL, 0);
+-    }
++    tcg_gen_exit_tb(NULL, 0);
+     ctx->base.is_jmp = DISAS_NORETURN;
+ }
+@@ -XXX,XX +XXX,XX @@ static void hexagon_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+     case DISAS_TOO_MANY:
+         gen_exec_counters(ctx);
+         tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], ctx->base.pc_next);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_exception_raw(EXCP_DEBUG);
+-        } else {
+-            tcg_gen_exit_tb(NULL, 0);
+-        }
++        tcg_gen_exit_tb(NULL, 0);
+         break;
+     case DISAS_NORETURN:
+         break;
+--
+.25.1

-[PULL 11/16] cputlb: Merge and move memory_notdirty_write_{prepare, complete}
+[PULL 06/24] target/arm: Drop checks for singlestep_enabled
-Since 9458a9a1df1a, all readers of the dirty bitmaps wait
+GDB single-stepping is now handled generically.
 for the rcu lock, which means that they wait until the end
 of any executing TranslationBlock.
-As a consequence, there is no need for the actual access
-to happen in between the _prepare and _complete.  Therefore,
-we can improve things by merging the two functions into
-notdirty_write and dropping the NotDirtyInfo structure.
-In addition, the only users of notdirty_write are in cputlb.c,
-so move the merged function there.  Pass in the CPUIOTLBEntry
-from which the ram_addr_t may be computed.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/memory-internal.h | 65 -----------------------------
+ target/arm/translate-a64.c | 10 ++--------
- accel/tcg/cputlb.c             | 76 +++++++++++++++++++---------------
+ target/arm/translate.c     | 36 ++++++------------------------------
- exec.c                         | 44 --------------------
+files changed, 8 insertions(+), 38 deletions(-)
 files changed, 42 insertions(+), 143 deletions(-)
-diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memory-internal.h
+--- a/target/arm/translate-a64.c
-+++ b/include/exec/memory-internal.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void address_space_dispatch_free(AddressSpaceDispatch *d);
+@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
+         gen_a64_set_pc_im(dest);
- void mtree_print_dispatch(struct AddressSpaceDispatch *d,
+         if (s->ss_active) {
-                           MemoryRegion *root);
+             gen_step_complete_exception(s);
--
+-        } else if (s->base.singlestep_enabled) {
--struct page_collection;
+-            gen_exception_internal(EXCP_DEBUG);
--
+         } else {
--/* Opaque struct for passing info from memory_notdirty_write_prepare()
+             tcg_gen_lookup_and_goto_ptr();
-- * to memory_notdirty_write_complete(). Callers should treat all fields
+             s->base.is_jmp = DISAS_NORETURN;
-- * as private, with the exception of @active.
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-- *
+ {
-- * @active is a field which is not touched by either the prepare or
+     DisasContext *dc = container_of(dcbase, DisasContext, base);
-- * complete functions, but which the caller can use if it wishes to
-- * track whether it has called prepare for this struct and so needs
+-    if (unlikely(dc->base.singlestep_enabled || dc->ss_active)) {
-- * to later call the complete function.
++    if (unlikely(dc->ss_active)) {
-- */
+         /* Note that this means single stepping WFI doesn't halt the CPU.
--typedef struct {
+          * For conditional branch insns this is harmless unreachable code as
--    CPUState *cpu;
+          * gen_goto_tb() has already handled emitting the debug exception
--    struct page_collection *pages;
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
--    ram_addr_t ram_addr;
+             /* fall through */
--    vaddr mem_vaddr;
+         case DISAS_EXIT:
--    unsigned size;
+         case DISAS_JUMP:
--    bool active;
+-            if (dc->base.singlestep_enabled) {
--} NotDirtyInfo;
+-                gen_exception_internal(EXCP_DEBUG);
--
+-            } else {
--/**
+-                gen_step_complete_exception(dc);
-- * memory_notdirty_write_prepare: call before writing to non-dirty memory
+-            }
-- * @ndi: pointer to opaque NotDirtyInfo struct
++            gen_step_complete_exception(dc);
-- * @cpu: CPU doing the write
+             break;
-- * @mem_vaddr: virtual address of write
+         case DISAS_NORETURN:
-- * @ram_addr: the ram address of the write
+             break;
-- * @size: size of write in bytes
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 - *
 - * Any code which writes to the host memory corresponding to
 - * guest RAM which has been marked as NOTDIRTY must wrap those
 - * writes in calls to memory_notdirty_write_prepare() and
 - * memory_notdirty_write_complete():
 - *
 - *  NotDirtyInfo ndi;
 - *  memory_notdirty_write_prepare(&ndi, ....);
 - *  ... perform write here ...
 - *  memory_notdirty_write_complete(&ndi);
 - *
 - * These calls will ensure that we flush any TCG translated code for
 - * the memory being written, update the dirty bits and (if possible)
 - * remove the slowpath callback for writing to the memory.
 - *
 - * This must only be called if we are using TCG; it will assert otherwise.
 - *
 - * We may take locks in the prepare call, so callers must ensure that
 - * they don't exit (via longjump or otherwise) without calling complete.
 - *
 - * This call must only be made inside an RCU critical section.
 - * (Note that while we're executing a TCG TB we're always in an
 - * RCU critical section, which is likely to be the case for callers
 - * of these functions.)
 - */
 -void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
 -                                   CPUState *cpu,
 -                                   vaddr mem_vaddr,
 -                                   ram_addr_t ram_addr,
 -                                   unsigned size);
 -/**
 - * memory_notdirty_write_complete: finish write to non-dirty memory
 - * @ndi: pointer to the opaque NotDirtyInfo struct which was initialized
 - * by memory_not_dirty_write_prepare().
 - */
 -void memory_notdirty_write_complete(NotDirtyInfo *ndi);
 -
  #endif
  #endif
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/arm/translate.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
- #include "exec/helper-proto.h"
+     tcg_temp_free_i32(tcg_excp);
  #include "qemu/atomic.h"
  #include "qemu/atomic128.h"
 +#include "translate-all.h"
  /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
  /* #define DEBUG_TLB */
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
      return qemu_ram_addr_from_host_nofail(p);
  }
-+static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+-static void gen_step_complete_exception(DisasContext *s)
-+                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
++static void gen_singlestep_exception(DisasContext *s)
 +{
 +    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
 +
 +    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
 +
 +    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
 +        struct page_collection *pages
 +            = page_collection_lock(ram_addr, ram_addr + size);
 +
 +        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 +        cpu->mem_io_pc = retaddr;
 +
 +        tb_invalidate_phys_page_fast(pages, ram_addr, size);
 +        page_collection_unlock(pages);
 +    }
 +
 +    /*
 +     * Set both VGA and migration bits for simplicity and to remove
 +     * the notdirty callback faster.
 +     */
 +    cpu_physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
 +
 +    /* We remove the notdirty callback only if the code has been flushed. */
 +    if (!cpu_physical_memory_is_clean(ram_addr)) {
 +        trace_memory_notdirty_set_dirty(mem_vaddr);
 +        tlb_set_dirty(cpu, mem_vaddr);
 +    }
 +}
 +
  /*
   * Probe for whether the specified guest access is permitted. If it is not
   * permitted then an exception will be taken in the same way as if this
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
  /* Probe for a read-modify-write atomic operation.  Do not allow unaligned
   * operations, or io operations to proceed.  Return the host address.  */
  static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 -                               TCGMemOpIdx oi, uintptr_t retaddr,
 -                               NotDirtyInfo *ndi)
 +                               TCGMemOpIdx oi, uintptr_t retaddr)
  {
-     size_t mmu_idx = get_mmuidx(oi);
+     /* We just completed step of an insn. Move from Active-not-pending
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
+      * to Active-pending, and then also take the swstep exception.
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
+     s->base.is_jmp = DISAS_NORETURN;
      hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
 -    ndi->active = false;
      if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
 -        ndi->active = true;
 -        memory_notdirty_write_prepare(ndi, env_cpu(env), addr,
 -                                      qemu_ram_addr_from_host_nofail(hostaddr),
 -                                      1 << s_bits);
 +        notdirty_write(env_cpu(env), addr, 1 << s_bits,
 +                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
      }
      return hostaddr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              return;
          }
 -        haddr = (void *)((uintptr_t)addr + entry->addend);
 -
          /* Handle clean RAM pages.  */
          if (tlb_addr & TLB_NOTDIRTY) {
 -            NotDirtyInfo ndi;
 -
 -            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 -            env_cpu(env)->mem_io_pc = retaddr;
 -
 -            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
 -                                          addr + iotlbentry->addr, size);
 -
 -            if (unlikely(need_swap)) {
 -                store_memop(haddr, val, op ^ MO_BSWAP);
 -            } else {
 -                store_memop(haddr, val, op);
 -            }
 -
 -            memory_notdirty_write_complete(&ndi);
 -            return;
 +            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
          }
 +        haddr = (void *)((uintptr_t)addr + entry->addend);
 +
          /*
           * Keep these two store_memop separate to ensure that the compiler
           * is able to fold the entire function to a single instruction.
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
  #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
  #define ATOMIC_NAME(X) \
      HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
 -#define ATOMIC_MMU_DECLS NotDirtyInfo ndi
 -#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr, &ndi)
 -#define ATOMIC_MMU_CLEANUP                              \
 -    do {                                                \
 -        if (unlikely(ndi.active)) {                     \
 -            memory_notdirty_write_complete(&ndi);       \
 -        }                                               \
 -    } while (0)
 +#define ATOMIC_MMU_DECLS
 +#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
 +#define ATOMIC_MMU_CLEANUP
  #define DATA_SIZE 1
  #include "atomic_template.h"
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
  #undef ATOMIC_MMU_LOOKUP
  #define EXTRA_ARGS         , TCGMemOpIdx oi
  #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
 -#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC(), &ndi)
 +#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
  #define DATA_SIZE 1
  #include "atomic_template.h"
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
      return block->offset + offset;
  }
--/* Called within RCU critical section. */
+-static void gen_singlestep_exception(DisasContext *s)
 -void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
 -                          CPUState *cpu,
 -                          vaddr mem_vaddr,
 -                          ram_addr_t ram_addr,
 -                          unsigned size)
 -{
--    ndi->cpu = cpu;
+-    /* Generate the right kind of exception for singlestep, which is
--    ndi->ram_addr = ram_addr;
+-     * either the architectural singlestep or EXCP_DEBUG for QEMU's
--    ndi->mem_vaddr = mem_vaddr;
+-     * gdb singlestepping.
--    ndi->size = size;
+-     */
--    ndi->pages = NULL;
+-    if (s->ss_active) {
--
+-        gen_step_complete_exception(s);
--    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+-    } else {
--
+-        gen_exception_internal(EXCP_DEBUG);
 -    assert(tcg_enabled());
 -    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
 -        ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
 -        tb_invalidate_phys_page_fast(ndi->pages, ram_addr, size);
 -    }
 -}
 -
--/* Called within RCU critical section. */
+-static inline bool is_singlestepping(DisasContext *s)
 -void memory_notdirty_write_complete(NotDirtyInfo *ndi)
 -{
--    if (ndi->pages) {
+-    /* Return true if we are singlestepping either because of
--        assert(tcg_enabled());
+-     * architectural singlestep or QEMU gdbstub singlestep. This does
--        page_collection_unlock(ndi->pages);
+-     * not include the command line '-singlestep' mode which is rather
--        ndi->pages = NULL;
+-     * misnamed as it only means "one instruction per TB" and doesn't
--    }
+-     * affect the code we generate.
 -
 -    /* Set both VGA and migration bits for simplicity and to remove
 -     * the notdirty callback faster.
 -     */
--    cpu_physical_memory_set_dirty_range(ndi->ram_addr, ndi->size,
+-    return s->base.singlestep_enabled || s->ss_active;
 -                                        DIRTY_CLIENTS_NOCODE);
 -    /* we remove the notdirty callback only if the code has been
 -       flushed */
 -    if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
 -        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
 -        tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
 -    }
 -}
 -
- /* Generate a debug exception if a watchpoint has been hit.  */
+ void clear_eci_state(DisasContext *s)
- void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+ {
-                           MemTxAttrs attrs, int flags, uintptr_t ra)
+     /*
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
      /* Is the new PC value in the magic range indicating exception return? */
      tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
      /* No: end the TB as we would for a DISAS_JMP */
 -    if (is_singlestepping(s)) {
 +    if (s->ss_active) {
          gen_singlestep_exception(s);
      } else {
          tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
  /* Jump, specifying which TB number to use if we gen_goto_tb() */
  static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
  {
 -    if (unlikely(is_singlestepping(s))) {
 +    if (unlikely(s->ss_active)) {
          /* An indirect jump so that we still trigger the debug exception.  */
          gen_set_pc_im(s, dest);
          s->base.is_jmp = DISAS_JUMP;
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
      /* If architectural single step active, limit to 1.  */
 -    if (is_singlestepping(dc)) {
 +    if (dc->ss_active) {
          dc->base.max_insns = 1;
      }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
           * insn codepath itself.
           */
          gen_bx_excret_final_code(dc);
 -    } else if (unlikely(is_singlestepping(dc))) {
 +    } else if (unlikely(dc->ss_active)) {
          /* Unconditional and "condition passed" instruction codepath. */
          switch (dc->base.is_jmp) {
          case DISAS_SWI:
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          /* "Condition failed" instruction codepath for the branch/trap insn */
          gen_set_label(dc->condlabel);
          gen_set_condexec(dc);
 -        if (unlikely(is_singlestepping(dc))) {
 +        if (unlikely(dc->ss_active)) {
              gen_set_pc_im(dc, dc->base.pc_next);
              gen_singlestep_exception(dc);
          } else {
 --
-.17.1
+.25.1

-New patch
+[PULL 07/24] target/hppa: Drop checks for singlestep_enabled
+GDB single-stepping is now handled generically.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/hppa/translate.c | 17 ++++-------------
+file changed, 4 insertions(+), 13 deletions(-)
+diff --git a/target/hppa/translate.c b/target/hppa/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/translate.c
++++ b/target/hppa/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int which,
+     } else {
+         copy_iaoq_entry(cpu_iaoq_f, f, cpu_iaoq_b);
+         copy_iaoq_entry(cpu_iaoq_b, b, ctx->iaoq_n_var);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_excp_1(EXCP_DEBUG);
+-        } else {
+-            tcg_gen_lookup_and_goto_ptr();
+-        }
++        tcg_gen_lookup_and_goto_ptr();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_rfi(DisasContext *ctx, bool rfi_r)
+         gen_helper_rfi(cpu_env);
+     }
+     /* Exit the TB to recognize new interrupts.  */
+-    if (ctx->base.singlestep_enabled) {
+-        gen_excp_1(EXCP_DEBUG);
+-    } else {
+-        tcg_gen_exit_tb(NULL, 0);
+-    }
++    tcg_gen_exit_tb(NULL, 0);
+     ctx->base.is_jmp = DISAS_NORETURN;
+     return nullify_end(ctx);
+@@ -XXX,XX +XXX,XX @@ static void hppa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+         nullify_save(ctx);
+         /* FALLTHRU */
+     case DISAS_IAQ_N_UPDATED:
+-        if (ctx->base.singlestep_enabled) {
+-            gen_excp_1(EXCP_DEBUG);
+-        } else if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
++        if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
+             tcg_gen_lookup_and_goto_ptr();
++            break;
+         }
+         /* FALLTHRU */
+     case DISAS_EXIT:
+--
+.25.1

-New patch
+[PULL 08/24] target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
+We were using singlestep_enabled as a proxy for whether
+translator_use_goto_tb would always return false.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/i386/tcg/translate.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
+     DisasContext *dc = container_of(dcbase, DisasContext, base);
+     CPUX86State *env = cpu->env_ptr;
+     uint32_t flags = dc->base.tb->flags;
++    uint32_t cflags = tb_cflags(dc->base.tb);
+     int cpl = (flags >> HF_CPL_SHIFT) & 3;
+     int iopl = (flags >> IOPL_SHIFT) & 3;
+@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
+     dc->cpuid_ext3_features = env->features[FEAT_8000_0001_ECX];
+     dc->cpuid_7_0_ebx_features = env->features[FEAT_7_0_EBX];
+     dc->cpuid_xsave_features = env->features[FEAT_XSAVE];
+-    dc->jmp_opt = !(dc->base.singlestep_enabled ||
++    dc->jmp_opt = !((cflags & CF_NO_GOTO_TB) ||
+                     (flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)));
+     /*
+      * If jmp_opt, we want to handle each string instruction individually.
+      * For icount also disable repz optimization so that each iteration
+      * is accounted separately.
+      */
+-    dc->repz_opt = !dc->jmp_opt && !(tb_cflags(dc->base.tb) & CF_USE_ICOUNT);
++    dc->repz_opt = !dc->jmp_opt && !(cflags & CF_USE_ICOUNT);
+     dc->T0 = tcg_temp_new();
+     dc->T1 = tcg_temp_new();
+--
+.25.1

-New patch
+[PULL 09/24] target/i386: Drop check for singlestep_enabled
+GDB single-stepping is now handled generically.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/i386/helper.h          | 1 -
+ target/i386/tcg/misc_helper.c | 8 --------
+ target/i386/tcg/translate.c   | 4 +---
+files changed, 1 insertion(+), 12 deletions(-)
+diff --git a/target/i386/helper.h b/target/i386/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/helper.h
++++ b/target/i386/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
+ DEF_HELPER_2(sysret, void, env, int)
+ #endif
+ DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
+-DEF_HELPER_FLAGS_1(debug, TCG_CALL_NO_WG, noreturn, env)
+ DEF_HELPER_1(reset_rf, void, env)
+ DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
+ DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
+diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/misc_helper.c
++++ b/target/i386/tcg/misc_helper.c
+@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_pause(CPUX86State *env, int next_eip_addend)
+     do_pause(env);
+ }
+-void QEMU_NORETURN helper_debug(CPUX86State *env)
+-{
+-    CPUState *cs = env_cpu(env);
+-
+-    cs->exception_index = EXCP_DEBUG;
+-    cpu_loop_exit(cs);
+-}
+-
+ uint64_t helper_rdpkru(CPUX86State *env, uint32_t ecx)
+ {
+     if ((env->cr[4] & CR4_PKE_MASK) == 0) {
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
+     if (s->base.tb->flags & HF_RF_MASK) {
+         gen_helper_reset_rf(cpu_env);
+     }
+-    if (s->base.singlestep_enabled) {
+-        gen_helper_debug(cpu_env);
+-    } else if (recheck_tf) {
++    if (recheck_tf) {
+         gen_helper_rechecking_single_step(cpu_env);
+         tcg_gen_exit_tb(NULL, 0);
+     } else if (s->flags & HF_TF_MASK) {
+--
+.25.1

-[PULL 09/16] cputlb: Move NOTDIRTY handling from I/O path to TLB path
+[PULL 10/24] target/m68k: Drop checks for singlestep_enabled
-Pages that we want to track for NOTDIRTY are RAM.  We do not
+GDB single-stepping is now handled generically.
 really need to go through the I/O path to handle them.
-Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Laurent Vivier <laurent@vivier.eu>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-common.h |  2 --
+ target/m68k/translate.c | 44 +++++++++--------------------------------
- accel/tcg/cputlb.c        | 26 +++++++++++++++++---
+file changed, 9 insertions(+), 35 deletions(-)
  exec.c                    | 50 ---------------------------------------
  memory.c                  | 16 -------------
 files changed, 23 insertions(+), 71 deletions(-)
-diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-common.h
+--- a/target/m68k/translate.c
-+++ b/include/exec/cpu-common.h
++++ b/target/m68k/translate.c
-@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
+@@ -XXX,XX +XXX,XX @@ static void do_writebacks(DisasContext *s)
  void cpu_flush_icache_range(hwaddr start, hwaddr len);
 -extern struct MemoryRegion io_mem_notdirty;
 -
  typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
  int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
      cpu->mem_io_pc = retaddr;
 -    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 -    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
      cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
          /* Handle I/O access.  */
 -        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
 +        if (tlb_addr & TLB_MMIO) {
              io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
                        op ^ (need_swap * MO_BSWAP));
              return;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          haddr = (void *)((uintptr_t)addr + entry->addend);
 +        /* Handle clean RAM pages.  */
 +        if (tlb_addr & TLB_NOTDIRTY) {
 +            NotDirtyInfo ndi;
 +
 +            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 +            env_cpu(env)->mem_io_pc = retaddr;
 +
 +            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
 +                                          addr + iotlbentry->addr, size);
 +
 +            if (unlikely(need_swap)) {
 +                store_memop(haddr, val, op ^ MO_BSWAP);
 +            } else {
 +                store_memop(haddr, val, op);
 +            }
 +
 +            memory_notdirty_write_complete(&ndi);
 +            return;
 +        }
 +
          /*
           * Keep these two store_memop separate to ensure that the compiler
           * is able to fold the entire function to a single instruction.
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
  AddressSpace address_space_io;
  AddressSpace address_space_memory;
 -MemoryRegion io_mem_notdirty;
  static MemoryRegion io_mem_unassigned;
  #endif
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
  } subpage_t;
  #define PHYS_SECTION_UNASSIGNED 0
 -#define PHYS_SECTION_NOTDIRTY 1
  static void io_mem_init(void);
  static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
      if (memory_region_is_ram(section->mr)) {
          /* Normal RAM.  */
          iotlb = memory_region_get_ram_addr(section->mr) + xlat;
 -        if (!section->readonly) {
 -            iotlb |= PHYS_SECTION_NOTDIRTY;
 -        }
      } else {
          AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
      }
  }
--/* Called within RCU critical section.  */
+-static bool is_singlestepping(DisasContext *s)
 -static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
 -                               uint64_t val, unsigned size)
 -{
--    NotDirtyInfo ndi;
+-    /*
--
+-     * Return true if we are singlestepping either because of
--    memory_notdirty_write_prepare(&ndi, current_cpu, current_cpu->mem_io_vaddr,
+-     * architectural singlestep or QEMU gdbstub singlestep. This does
--                         ram_addr, size);
+-     * not include the command line '-singlestep' mode which is rather
--
+-     * misnamed as it only means "one instruction per TB" and doesn't
--    stn_p(qemu_map_ram_ptr(NULL, ram_addr), size, val);
+-     * affect the code we generate.
--    memory_notdirty_write_complete(&ndi);
+-     */
 -    return s->base.singlestep_enabled || s->ss_active;
 -}
 -
--static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
+ /* is_jmp field values */
--                                 unsigned size, bool is_write,
+ #define DISAS_JUMP      DISAS_TARGET_0 /* only pc was modified dynamically */
--                                 MemTxAttrs attrs)
+ #define DISAS_EXIT      DISAS_TARGET_1 /* cpu state was modified dynamically */
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *s, uint32_t dest, int nr)
      s->base.is_jmp = DISAS_NORETURN;
  }
 -static void gen_singlestep_exception(DisasContext *s)
 -{
--    return is_write;
+-    /*
 -     * Generate the right kind of exception for singlestep, which is
 -     * either the architectural singlestep or EXCP_DEBUG for QEMU's
 -     * gdb singlestepping.
 -     */
 -    if (s->ss_active) {
 -        gen_raise_exception(EXCP_TRACE);
 -    } else {
 -        gen_raise_exception(EXCP_DEBUG);
 -    }
 -}
 -
--static const MemoryRegionOps notdirty_mem_ops = {
+ static inline void gen_addr_fault(DisasContext *s)
 -    .write = notdirty_mem_write,
 -    .valid.accepts = notdirty_mem_accepts,
 -    .endianness = DEVICE_NATIVE_ENDIAN,
 -    .valid = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -    .impl = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -};
 -
  /* Generate a debug exception if a watchpoint has been hit.  */
  void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                            MemTxAttrs attrs, int flags, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
  {
-     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
+     gen_exception(s, s->base.pc_next, EXCP_ADDRESS);
-                           NULL, UINT64_MAX);
+@@ -XXX,XX +XXX,XX @@ static void gen_exit_tb(DisasContext *s)
--
+ /* Generate a jump to an immediate address.  */
--    /* io_mem_notdirty calls tb_invalidate_phys_page_fast,
+ static void gen_jmp_tb(DisasContext *s, int n, uint32_t dest)
--     * which can be called without the iothread mutex.
+ {
--     */
+-    if (unlikely(is_singlestepping(s))) {
--    memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
++    if (unlikely(s->ss_active)) {
--                          NULL, UINT64_MAX);
+         update_cc_op(s);
--    memory_region_clear_global_locking(&io_mem_notdirty);
+         tcg_gen_movi_i32(QREG_PC, dest);
 -        gen_singlestep_exception(s);
 +        gen_raise_exception(EXCP_TRACE);
      } else if (translator_use_goto_tb(&s->base, dest)) {
          tcg_gen_goto_tb(n);
          tcg_gen_movi_i32(QREG_PC, dest);
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
      dc->ss_active = (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS);
      /* If architectural single step active, limit to 1 */
 -    if (is_singlestepping(dc)) {
 +    if (dc->ss_active) {
          dc->base.max_insns = 1;
      }
  }
+@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
- AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
+         break;
-@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
+     case DISAS_TOO_MANY:
+         update_cc_op(dc);
-     n = dummy_section(&d->map, fv, &io_mem_unassigned);
+-        if (is_singlestepping(dc)) {
-     assert(n == PHYS_SECTION_UNASSIGNED);
++        if (dc->ss_active) {
--    n = dummy_section(&d->map, fv, &io_mem_notdirty);
+             tcg_gen_movi_i32(QREG_PC, dc->pc);
--    assert(n == PHYS_SECTION_NOTDIRTY);
+-            gen_singlestep_exception(dc);
++            gen_raise_exception(EXCP_TRACE);
-     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
+         } else {
+             gen_jmp_tb(dc, 0, dc->pc);
-diff --git a/memory.c b/memory.c
+         }
-index XXXXXXX..XXXXXXX 100644
+         break;
---- a/memory.c
+     case DISAS_JUMP:
-+++ b/memory.c
+         /* We updated CC_OP and PC in gen_jmp/gen_jmp_im.  */
-@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
+-        if (is_singlestepping(dc)) {
-     tmp = mr->ops->read(mr->opaque, addr, size);
+-            gen_singlestep_exception(dc);
-     if (mr->subpage) {
++        if (dc->ss_active) {
-         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
++            gen_raise_exception(EXCP_TRACE);
--    } else if (mr == &io_mem_notdirty) {
+         } else {
--        /* Accesses to code which has previously been translated into a TB show
+             tcg_gen_lookup_and_goto_ptr();
--         * up in the MMIO path, as accesses to the io_mem_notdirty
+         }
--         * MemoryRegion. */
+@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
+          * We updated CC_OP and PC in gen_exit_tb, but also modified
-         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
+          * other state that may require returning to the main loop.
-         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
+          */
-@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
+-        if (is_singlestepping(dc)) {
-     r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs);
+-            gen_singlestep_exception(dc);
-     if (mr->subpage) {
++        if (dc->ss_active) {
-         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
++            gen_raise_exception(EXCP_TRACE);
--    } else if (mr == &io_mem_notdirty) {
+         } else {
--        /* Accesses to code which has previously been translated into a TB show
+             tcg_gen_exit_tb(NULL, 0);
--         * up in the MMIO path, as accesses to the io_mem_notdirty
+         }
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
      if (mr->subpage) {
          trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
      if (mr->subpage) {
          trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
 --
-.17.1
+.25.1

-New patch
+[PULL 11/24] target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
+We were using singlestep_enabled as a proxy for whether
+translator_use_goto_tb would always return false.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/microblaze/translate.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/translate.c
++++ b/target/microblaze/translate.c
+@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
+         break;
+     case DISAS_JUMP:
+-        if (dc->jmp_dest != -1 && !cs->singlestep_enabled) {
++        if (dc->jmp_dest != -1 && !(tb_cflags(dc->base.tb) & CF_NO_GOTO_TB)) {
+             /* Direct jump. */
+             tcg_gen_discard_i32(cpu_btarget);
+@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
+             return;
+         }
+-        /* Indirect jump (or direct jump w/ singlestep) */
++        /* Indirect jump (or direct jump w/ goto_tb disabled) */
+         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
+         tcg_gen_discard_i32(cpu_btarget);
+--
+.25.1

-New patch
+[PULL 12/24] target/microblaze: Drop checks for singlestep_enabled
+GDB single-stepping is now handled generically.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/microblaze/translate.c | 14 ++------------
+file changed, 2 insertions(+), 12 deletions(-)
+diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/translate.c
++++ b/target/microblaze/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
+ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
+ {
+-    if (dc->base.singlestep_enabled) {
+-        TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
+-        tcg_gen_movi_i32(cpu_pc, dest);
+-        gen_helper_raise_exception(cpu_env, tmp);
+-        tcg_temp_free_i32(tmp);
+-    } else if (translator_use_goto_tb(&dc->base, dest)) {
++    if (translator_use_goto_tb(&dc->base, dest)) {
+         tcg_gen_goto_tb(n);
+         tcg_gen_movi_i32(cpu_pc, dest);
+         tcg_gen_exit_tb(dc->base.tb, n);
+@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
+         /* Indirect jump (or direct jump w/ goto_tb disabled) */
+         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
+         tcg_gen_discard_i32(cpu_btarget);
+-
+-        if (unlikely(cs->singlestep_enabled)) {
+-            gen_raise_exception(dc, EXCP_DEBUG);
+-        } else {
+-            tcg_gen_lookup_and_goto_ptr();
+-        }
++        tcg_gen_lookup_and_goto_ptr();
+         return;
+     default:
+--
+.25.1

-[PULL 15/16] cputlb: Pass retaddr to tb_invalidate_phys_page_fast
+[PULL 13/24] target/mips: Fix single stepping
-Rather than rely on cpu->mem_io_pc, pass retaddr down directly.
+As per an ancient comment in mips_tr_translate_insn about the
 expectations of gdb, when restarting the insn in a delay slot
 we also re-execute the branch.  Which means that we are
 expected to execute two insns in this case.
-Within tb_invalidate_phys_page_range__locked, the is_cpu_write_access
+This has been broken since 8b86d6d2580, where we forced max_insns
-parameter is non-zero exactly when retaddr would be non-zero, so that
+to 1 while single-stepping.  This resulted in an exit from the
-is a simple replacement.
+translator loop after the branch but before the delay slot is
 translated.
-Recognize that current_tb_not_found is true only when mem_io_pc
+Increase the max_insns to 2 for this case.  In addition, bypass
-(and now retaddr) are also non-zero, so remove a redundant test.
+the end-of-page check, for when the branch itself ends the page.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h |  3 ++-
+ target/mips/tcg/translate.c | 25 ++++++++++++++++---------
- accel/tcg/cputlb.c        |  6 +-----
+file changed, 16 insertions(+), 9 deletions(-)
  accel/tcg/translate-all.c | 39 +++++++++++++++++++--------------------
 files changed, 22 insertions(+), 26 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/target/mips/tcg/translate.c
-+++ b/accel/tcg/translate-all.h
++++ b/target/mips/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
+@@ -XXX,XX +XXX,XX @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-                                              tb_page_addr_t end);
+     ctx->default_tcg_memop_mask = (ctx->insn_flags & (ISA_MIPS_R6 |
- void page_collection_unlock(struct page_collection *set);
+                                   INSN_LOONGSON3A)) ? MO_UNALN : MO_ALIGN;
- void tb_invalidate_phys_page_fast(struct page_collection *pages,
--                                  tb_page_addr_t start, int len);
++    /*
-+                                  tb_page_addr_t start, int len,
++     * Execute a branch and its delay slot as a single instruction.
-+                                  uintptr_t retaddr);
++     * This is what GDB expects and is consistent with what the
- void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
++     * hardware does (e.g. if a delay slot instruction faults, the
- void tb_check_watchpoint(CPUState *cpu);
++     * reported PC is the PC of the branch).
++     */
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
++    if (ctx->base.singlestep_enabled && (ctx->hflags & MIPS_HFLAG_BMASK)) {
-index XXXXXXX..XXXXXXX 100644
++        ctx->base.max_insns = 2;
---- a/accel/tcg/cputlb.c
++    }
-+++ b/accel/tcg/cputlb.c
++
-@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+     LOG_DISAS("\ntb %p idx %d hflags %04x\n", ctx->base.tb, ctx->mem_idx,
-     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
+               ctx->hflags);
-         struct page_collection *pages
+ }
-             = page_collection_lock(ram_addr, ram_addr + size);
+@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
--
+     if (ctx->base.is_jmp != DISAS_NEXT) {
--        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
+         return;
 -        cpu->mem_io_pc = retaddr;
 -
 -        tb_invalidate_phys_page_fast(pages, ram_addr, size);
 +        tb_invalidate_phys_page_fast(pages, ram_addr, size, retaddr);
          page_collection_unlock(pages);
      }
++
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
+     /*
-index XXXXXXX..XXXXXXX 100644
+-     * Execute a branch and its delay slot as a single instruction.
---- a/accel/tcg/translate-all.c
+-     * This is what GDB expects and is consistent with what the
-+++ b/accel/tcg/translate-all.c
+-     * hardware does (e.g. if a delay slot instruction faults, the
-@@ -XXX,XX +XXX,XX @@ static void
+-     * reported PC is the PC of the branch).
- tb_invalidate_phys_page_range__locked(struct page_collection *pages,
++     * End the TB on (most) page crossings.
-                                       PageDesc *p, tb_page_addr_t start,
++     * See mips_tr_init_disas_context about single-stepping a branch
-                                       tb_page_addr_t end,
++     * together with its delay slot.
--                                      int is_cpu_write_access)
+      */
-+                                      uintptr_t retaddr)
+-    if (ctx->base.singlestep_enabled &&
- {
+-        (ctx->hflags & MIPS_HFLAG_BMASK) == 0) {
-     TranslationBlock *tb;
+-        ctx->base.is_jmp = DISAS_TOO_MANY;
-     tb_page_addr_t tb_start, tb_end;
+-    }
-@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
+-    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE) {
- #ifdef TARGET_HAS_PRECISE_SMC
++    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE
-     CPUState *cpu = current_cpu;
++        && !ctx->base.singlestep_enabled) {
-     CPUArchState *env = NULL;
+         ctx->base.is_jmp = DISAS_TOO_MANY;
 -    int current_tb_not_found = is_cpu_write_access;
 +    bool current_tb_not_found = retaddr != 0;
 +    bool current_tb_modified = false;
      TranslationBlock *current_tb = NULL;
 -    int current_tb_modified = 0;
      target_ulong current_pc = 0;
      target_ulong current_cs_base = 0;
      uint32_t current_flags = 0;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
          if (!(tb_end <= start || tb_start >= end)) {
  #ifdef TARGET_HAS_PRECISE_SMC
              if (current_tb_not_found) {
 -                current_tb_not_found = 0;
 -                current_tb = NULL;
 -                if (cpu->mem_io_pc) {
 -                    /* now we have a real cpu fault */
 -                    current_tb = tcg_tb_lookup(cpu->mem_io_pc);
 -                }
 +                current_tb_not_found = false;
 +                /* now we have a real cpu fault */
 +                current_tb = tcg_tb_lookup(retaddr);
              }
              if (current_tb == tb &&
                  (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
 -                /* If we are modifying the current TB, we must stop
 -                its execution. We could be more precise by checking
 -                that the modification is after the current PC, but it
 -                would require a specialized function to partially
 -                restore the CPU state */
 -
 -                current_tb_modified = 1;
 -                cpu_restore_state_from_tb(cpu, current_tb,
 -                                          cpu->mem_io_pc, true);
 +                /*
 +                 * If we are modifying the current TB, we must stop
 +                 * its execution. We could be more precise by checking
 +                 * that the modification is after the current PC, but it
 +                 * would require a specialized function to partially
 +                 * restore the CPU state.
 +                 */
 +                current_tb_modified = true;
 +                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
                  cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                       &current_flags);
              }
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(target_ulong start, target_ulong end)
   * Call with all @pages in the range [@start, @start + len[ locked.
   */
  void tb_invalidate_phys_page_fast(struct page_collection *pages,
 -                                  tb_page_addr_t start, int len)
 +                                  tb_page_addr_t start, int len,
 +                                  uintptr_t retaddr)
  {
      PageDesc *p;
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
          }
      } else {
      do_invalidate:
 -        tb_invalidate_phys_page_range__locked(pages, p, start, start + len, 1);
 +        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
 +                                              retaddr);
      }
  }
- #else
 --
-.17.1
+.25.1

-[PULL 05/16] cputlb: Split out load/store_memop
+[PULL 14/24] target/mips: Drop exit checks for singlestep_enabled
-We will shortly be using these more than once.
+GDB single-stepping is now handled generically.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 107 +++++++++++++++++++++++----------------------
+ target/mips/tcg/translate.c | 50 +++++++++++++------------------------
-file changed, 55 insertions(+), 52 deletions(-)
+file changed, 18 insertions(+), 32 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/mips/tcg/translate.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/mips/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
- typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
+         tcg_gen_exit_tb(ctx->base.tb, n);
-                                 TCGMemOpIdx oi, uintptr_t retaddr);
+     } else {
+         gen_save_pc(dest);
-+static inline uint64_t QEMU_ALWAYS_INLINE
+-        if (ctx->base.singlestep_enabled) {
-+load_memop(const void *haddr, MemOp op)
+-            save_cpu_state(ctx, 0);
-+{
+-            gen_helper_raise_exception_debug(cpu_env);
-+    switch (op) {
+-        } else {
-+    case MO_UB:
+-            tcg_gen_lookup_and_goto_ptr();
-+        return ldub_p(haddr);
+-        }
-+    case MO_BEUW:
++        tcg_gen_lookup_and_goto_ptr();
-+        return lduw_be_p(haddr);
+     }
 +    case MO_LEUW:
 +        return lduw_le_p(haddr);
 +    case MO_BEUL:
 +        return (uint32_t)ldl_be_p(haddr);
 +    case MO_LEUL:
 +        return (uint32_t)ldl_le_p(haddr);
 +    case MO_BEQ:
 +        return ldq_be_p(haddr);
 +    case MO_LEQ:
 +        return ldq_le_p(haddr);
 +    default:
 +        qemu_build_not_reached();
 +    }
 +}
 +
  static inline uint64_t QEMU_ALWAYS_INLINE
  load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              uintptr_t retaddr, MemOp op, bool code_read,
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
   do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
 -    switch (op) {
 -    case MO_UB:
 -        res = ldub_p(haddr);
 -        break;
 -    case MO_BEUW:
 -        res = lduw_be_p(haddr);
 -        break;
 -    case MO_LEUW:
 -        res = lduw_le_p(haddr);
 -        break;
 -    case MO_BEUL:
 -        res = (uint32_t)ldl_be_p(haddr);
 -        break;
 -    case MO_LEUL:
 -        res = (uint32_t)ldl_le_p(haddr);
 -        break;
 -    case MO_BEQ:
 -        res = ldq_be_p(haddr);
 -        break;
 -    case MO_LEQ:
 -        res = ldq_le_p(haddr);
 -        break;
 -    default:
 -        qemu_build_not_reached();
 -    }
 -
 -    return res;
 +    return load_memop(haddr, op);
  }
- /*
+@@ -XXX,XX +XXX,XX @@ static void gen_branch(DisasContext *ctx, int insn_bytes)
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
+             } else {
-  * Store Helpers
+                 tcg_gen_mov_tl(cpu_PC, btarget);
-  */
+             }
+-            if (ctx->base.singlestep_enabled) {
-+static inline void QEMU_ALWAYS_INLINE
+-                save_cpu_state(ctx, 0);
-+store_memop(void *haddr, uint64_t val, MemOp op)
+-                gen_helper_raise_exception_debug(cpu_env);
-+{
+-            }
-+    switch (op) {
+             tcg_gen_lookup_and_goto_ptr();
-+    case MO_UB:
+             break;
-+        stb_p(haddr, val);
+         default:
@@ -XXX,XX +XXX,XX @@ static void mips_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
  {
      DisasContext *ctx = container_of(dcbase, DisasContext, base);
 -    if (ctx->base.singlestep_enabled && ctx->base.is_jmp != DISAS_NORETURN) {
 -        save_cpu_state(ctx, ctx->base.is_jmp != DISAS_EXIT);
 -        gen_helper_raise_exception_debug(cpu_env);
 -    } else {
 -        switch (ctx->base.is_jmp) {
 -        case DISAS_STOP:
 -            gen_save_pc(ctx->base.pc_next);
 -            tcg_gen_lookup_and_goto_ptr();
 -            break;
 -        case DISAS_NEXT:
 -        case DISAS_TOO_MANY:
 -            save_cpu_state(ctx, 0);
 -            gen_goto_tb(ctx, 0, ctx->base.pc_next);
 -            break;
 -        case DISAS_EXIT:
 -            tcg_gen_exit_tb(NULL, 0);
 -            break;
 -        case DISAS_NORETURN:
 -            break;
 -        default:
 -            g_assert_not_reached();
 -        }
 +    switch (ctx->base.is_jmp) {
 +    case DISAS_STOP:
 +        gen_save_pc(ctx->base.pc_next);
 +        tcg_gen_lookup_and_goto_ptr();
 +        break;
-+    case MO_BEUW:
++    case DISAS_NEXT:
-+        stw_be_p(haddr, val);
++    case DISAS_TOO_MANY:
 +        save_cpu_state(ctx, 0);
 +        gen_goto_tb(ctx, 0, ctx->base.pc_next);
 +        break;
-+    case MO_LEUW:
++    case DISAS_EXIT:
-+        stw_le_p(haddr, val);
++        tcg_gen_exit_tb(NULL, 0);
 +        break;
-+    case MO_BEUL:
++    case DISAS_NORETURN:
 +        stl_be_p(haddr, val);
 +        break;
 +    case MO_LEUL:
 +        stl_le_p(haddr, val);
 +        break;
 +    case MO_BEQ:
 +        stq_be_p(haddr, val);
 +        break;
 +    case MO_LEQ:
 +        stq_le_p(haddr, val);
 +        break;
 +    default:
-+        qemu_build_not_reached();
++        g_assert_not_reached();
-+    }
+     }
 +}
 +
  static inline void QEMU_ALWAYS_INLINE
  store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
               TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
   do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
 -    switch (op) {
 -    case MO_UB:
 -        stb_p(haddr, val);
 -        break;
 -    case MO_BEUW:
 -        stw_be_p(haddr, val);
 -        break;
 -    case MO_LEUW:
 -        stw_le_p(haddr, val);
 -        break;
 -    case MO_BEUL:
 -        stl_be_p(haddr, val);
 -        break;
 -    case MO_LEUL:
 -        stl_le_p(haddr, val);
 -        break;
 -    case MO_BEQ:
 -        stq_be_p(haddr, val);
 -        break;
 -    case MO_LEQ:
 -        stq_le_p(haddr, val);
 -        break;
 -    default:
 -        qemu_build_not_reached();
 -    }
 +    store_memop(haddr, val, op);
  }
- void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
 --
-.17.1
+.25.1

-[PULL 16/16] cputlb: Pass retaddr to tb_check_watchpoint
+[PULL 15/24] target/openrisc: Drop checks for singlestep_enabled
-Fixes the previous TLB_WATCHPOINT patches because we are currently
+GDB single-stepping is now handled generically.
 failing to set cpu->mem_io_pc with the call to cpu_check_watchpoint.
 Pass down the retaddr directly because it's readily available.
-Fixes: 50b107c5d61
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h | 2 +-
+ target/openrisc/translate.c | 18 +++---------------
- accel/tcg/translate-all.c | 6 +++---
+file changed, 3 insertions(+), 15 deletions(-)
  exec.c                    | 2 +-
 files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/target/openrisc/translate.c
-+++ b/accel/tcg/translate-all.h
++++ b/target/openrisc/translate.c
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
+@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-                                   tb_page_addr_t start, int len,
+             /* The jump destination is indirect/computed; use jmp_pc.  */
-                                   uintptr_t retaddr);
+             tcg_gen_mov_tl(cpu_pc, jmp_pc);
- void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
+             tcg_gen_discard_tl(jmp_pc);
--void tb_check_watchpoint(CPUState *cpu);
+-            if (unlikely(dc->base.singlestep_enabled)) {
-+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
+-                gen_exception(dc, EXCP_DEBUG);
+-            } else {
- #ifdef CONFIG_USER_ONLY
+-                tcg_gen_lookup_and_goto_ptr();
- int page_unprotect(target_ulong address, uintptr_t pc);
+-            }
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
++            tcg_gen_lookup_and_goto_ptr();
-index XXXXXXX..XXXXXXX 100644
+             break;
---- a/accel/tcg/translate-all.c
+         }
-+++ b/accel/tcg/translate-all.c
+         /* The jump destination is direct; use jmp_pc_imm.
-@@ -XXX,XX +XXX,XX @@ static bool tb_invalidate_phys_page(tb_page_addr_t addr, uintptr_t pc)
+@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
- #endif
+             break;
+         }
- /* user-mode: call with mmap_lock held */
+         tcg_gen_movi_tl(cpu_pc, jmp_dest);
--void tb_check_watchpoint(CPUState *cpu)
+-        if (unlikely(dc->base.singlestep_enabled)) {
-+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
+-            gen_exception(dc, EXCP_DEBUG);
- {
+-        } else {
-     TranslationBlock *tb;
+-            tcg_gen_lookup_and_goto_ptr();
+-        }
-     assert_memory_lock();
++        tcg_gen_lookup_and_goto_ptr();
+         break;
--    tb = tcg_tb_lookup(cpu->mem_io_pc);
-+    tb = tcg_tb_lookup(retaddr);
+     case DISAS_EXIT:
-     if (tb) {
+-        if (unlikely(dc->base.singlestep_enabled)) {
-         /* We can use retranslation to find the PC.  */
+-            gen_exception(dc, EXCP_DEBUG);
--        cpu_restore_state_from_tb(cpu, tb, cpu->mem_io_pc, true);
+-        } else {
-+        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
+-            tcg_gen_exit_tb(NULL, 0);
-         tb_phys_invalidate(tb, -1);
+-        }
-     } else {
++        tcg_gen_exit_tb(NULL, 0);
-         /* The exception probably happened in a helper.  The CPU state should
+         break;
-diff --git a/exec.c b/exec.c
+     default:
-index XXXXXXX..XXXXXXX 100644
+         g_assert_not_reached();
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                  cpu->watchpoint_hit = wp;
                  mmap_lock();
 -                tb_check_watchpoint(cpu);
 +                tb_check_watchpoint(cpu, ra);
                  if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                      cpu->exception_index = EXCP_DEBUG;
                      mmap_unlock();
 --
-.17.1
+.25.1

-[PULL 06/16] cputlb: Introduce TLB_BSWAP
+[PULL 16/24] target/ppc: Drop exit checks for singlestep_enabled
-Handle bswap on ram directly in load/store_helper.  This fixes a
+GDB single-stepping is now handled generically.
-bug with the previous implementation in that one cannot use the
+Reuse gen_debug_exception to handle architectural debug exceptions.
 I/O path for RAM.
-Fixes: a26fc6f5152b47f1
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h |  4 ++-
+ target/ppc/translate.c | 38 ++++++++------------------------------
- accel/tcg/cputlb.c     | 72 +++++++++++++++++++++++++-----------------
+file changed, 8 insertions(+), 30 deletions(-)
 files changed, 46 insertions(+), 30 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/target/ppc/translate.c
-+++ b/include/exec/cpu-all.h
++++ b/target/ppc/translate.c
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
+@@ -XXX,XX +XXX,XX @@
- #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
- /* Set if TLB entry contains a watchpoint.  */
+ #define CPU_SINGLE_STEP 0x1
- #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+ #define CPU_BRANCH_STEP 0x2
-+/* Set if TLB entry requires byte swap.  */
+-#define GDBSTUB_SINGLE_STEP 0x4
-+#define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
+ /* Include definitions for instructions classes and implementations flags */
- /* Use this mask to check interception with an alignment mask
+ /* #define PPC_DEBUG_DISAS */
-  * in a TCG backend.
+@@ -XXX,XX +XXX,XX @@ static uint32_t gen_prep_dbgex(DisasContext *ctx)
-  */
- #define TLB_FLAGS_MASK \
+ static void gen_debug_exception(DisasContext *ctx)
--    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
+ {
-+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
+-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
++    gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
- /**
+     ctx->base.is_jmp = DISAS_NORETURN;
-  * tlb_hit_page: return true if page aligned @addr is a hit against the
+ }
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *ctx, target_ulong dest)
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
+ static void gen_lookup_and_goto_ptr(DisasContext *ctx)
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+ {
-         address |= TLB_INVALID_MASK;
+-    int sse = ctx->singlestep_enabled;
 -    if (unlikely(sse)) {
 -        if (sse & GDBSTUB_SINGLE_STEP) {
 -            gen_debug_exception(ctx);
 -        } else if (sse & (CPU_SINGLE_STEP | CPU_BRANCH_STEP)) {
 -            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
 -        } else {
 -            tcg_gen_exit_tb(NULL, 0);
 -        }
 +    if (unlikely(ctx->singlestep_enabled)) {
 +        gen_debug_exception(ctx);
      } else {
          tcg_gen_lookup_and_goto_ptr();
      }
-     if (attrs.byte_swap) {
+@@ -XXX,XX +XXX,XX @@ static void ppc_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
--        /* Force the access through the I/O slow path.  */
+     ctx->singlestep_enabled = 0;
--        address |= TLB_MMIO;
+     if ((hflags >> HFLAGS_SE) & 1) {
-+        address |= TLB_BSWAP;
+         ctx->singlestep_enabled |= CPU_SINGLE_STEP;
 +        ctx->base.max_insns = 1;
      }
-     if (!memory_region_is_ram(section->mr) &&
+     if ((hflags >> HFLAGS_BE) & 1) {
-         !memory_region_is_romd(section->mr)) {
+         ctx->singlestep_enabled |= CPU_BRANCH_STEP;
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+     }
-     bool locked = false;
+-    if (unlikely(ctx->base.singlestep_enabled)) {
-     MemTxResult r;
+-        ctx->singlestep_enabled |= GDBSTUB_SINGLE_STEP;
 -    if (iotlbentry->attrs.byte_swap) {
 -        op ^= MO_BSWAP;
 -    }
 -
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+-    if (ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP)) {
-     mr = section->mr;
+-        ctx->base.max_insns = 1;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      bool locked = false;
      MemTxResult r;
 -    if (iotlbentry->attrs.byte_swap) {
 -        op ^= MO_BSWAP;
 -    }
--
+ }
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-     mr = section->mr;
+ static void ppc_tr_tb_start(DisasContextBase *db, CPUState *cs)
-     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-                              wp_access, retaddr);
+     DisasJumpType is_jmp = ctx->base.is_jmp;
      target_ulong nip = ctx->base.pc_next;
 -    int sse;
      if (is_jmp == DISAS_NORETURN) {
          /* We have already exited the TB. */
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
      }
--    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
+     /* Honor single stepping. */
--        /* I/O access */
+-    sse = ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP);
-+    /* Reject I/O access, or other required slow-path.  */
+-    if (unlikely(sse)) {
-+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
++    if (unlikely(ctx->singlestep_enabled & CPU_SINGLE_STEP)
-         return NULL;
++        && (nip <= 0x100 || nip > 0xf00)) {
          switch (is_jmp) {
          case DISAS_TOO_MANY:
          case DISAS_EXIT_UPDATE:
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
              g_assert_not_reached();
          }
 -        if (sse & GDBSTUB_SINGLE_STEP) {
 -            gen_debug_exception(ctx);
 -            return;
 -        }
 -        /* else CPU_SINGLE_STEP... */
 -        if (nip <= 0x100 || nip > 0xf00) {
 -            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
 -            return;
 -        }
 +        gen_debug_exception(ctx);
 +        return;
      }
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
+     switch (is_jmp) {
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
          CPUIOTLBEntry *iotlbentry;
 +        bool need_swap;
          /* For anything that is unaligned, recurse through full_load.  */
          if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
                                   iotlbentry->attrs, BP_MEM_READ, retaddr);
 -
 -            /* The backing page may or may not require I/O.  */
 -            tlb_addr &= ~TLB_WATCHPOINT;
 -            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
 -                goto do_aligned_access;
 -            }
          }
 +        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 +
          /* Handle I/O access.  */
 -        return io_readx(env, iotlbentry, mmu_idx, addr,
 -                        retaddr, access_type, op);
 +        if (likely(tlb_addr & TLB_MMIO)) {
 +            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
 +                            access_type, op ^ (need_swap * MO_BSWAP));
 +        }
 +
 +        haddr = (void *)((uintptr_t)addr + entry->addend);
 +
 +        /*
 +         * Keep these two load_memop separate to ensure that the compiler
 +         * is able to fold the entire function to a single instruction.
 +         * There is a build-time assert inside to remind you of this.  ;-)
 +         */
 +        if (unlikely(need_swap)) {
 +            return load_memop(haddr, op ^ MO_BSWAP);
 +        }
 +        return load_memop(haddr, op);
      }
      /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
          return res & MAKE_64BIT_MASK(0, size * 8);
      }
 - do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
      return load_memop(haddr, op);
  }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
          CPUIOTLBEntry *iotlbentry;
 +        bool need_swap;
          /* For anything that is unaligned, recurse through byte stores.  */
          if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
                                   iotlbentry->attrs, BP_MEM_WRITE, retaddr);
 -
 -            /* The backing page may or may not require I/O.  */
 -            tlb_addr &= ~TLB_WATCHPOINT;
 -            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
 -                goto do_aligned_access;
 -            }
          }
 +        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 +
          /* Handle I/O access.  */
 -        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
 +        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
 +            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
 +                      op ^ (need_swap * MO_BSWAP));
 +            return;
 +        }
 +
 +        haddr = (void *)((uintptr_t)addr + entry->addend);
 +
 +        /*
 +         * Keep these two store_memop separate to ensure that the compiler
 +         * is able to fold the entire function to a single instruction.
 +         * There is a build-time assert inside to remind you of this.  ;-)
 +         */
 +        if (unlikely(need_swap)) {
 +            store_memop(haddr, val, op ^ MO_BSWAP);
 +        } else {
 +            store_memop(haddr, val, op);
 +        }
          return;
      }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          return;
      }
 - do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
      store_memop(haddr, val, op);
  }
 --
-.17.1
+.25.1

-[PULL 04/16] cputlb: Use qemu_build_not_reached in load/store_helpers
+[PULL 17/24] target/riscv: Remove dead code after exception
-Increase the current runtime assert to a compile-time assert.
+We have already set DISAS_NORETURN in generate_exception,
 which makes the exit_tb unreachable.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 ++---
+ target/riscv/insn_trans/trans_privileged.c.inc | 6 +-----
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 5 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/accel/tcg/cputlb.c
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
+@@ -XXX,XX +XXX,XX @@ static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
-         res = ldq_le_p(haddr);
+ {
-         break;
+     /* always generates U-level ECALL, fixed in do_interrupt handler */
-     default:
+     generate_exception(ctx, RISCV_EXCP_U_ECALL);
--        g_assert_not_reached();
+-    exit_tb(ctx); /* no chaining */
-+        qemu_build_not_reached();
+-    ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
          post   = opcode_at(&ctx->base, post_addr);
      }
-     return res;
+-    if  (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++    if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
-         stq_le_p(haddr, val);
+         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
-         break;
+     } else {
-     default:
+         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
 -        g_assert_not_reached();
 -        break;
 +        qemu_build_not_reached();
      }
+-    exit_tb(ctx); /* no chaining */
+-    ctx->base.is_jmp = DISAS_NORETURN;
+     return true;
  }
 --
-.17.1
+.25.1

-[PULL 07/16] exec: Adjust notdirty tracing
+[PULL 18/24] target/riscv: Remove exit_tb and lookup_and_goto_ptr
-The memory_region_tb_read tracepoint is unreachable, since notdirty
+GDB single-stepping is now handled generically, which means
-is supposed to apply only to writes.  The memory_region_tb_write
+we don't need to do anything in the wrappers.
 tracepoint is mis-named, because notdirty is not only used for TB
 invalidation.  It is also used for e.g. VGA RAM updates and migration.
-Replace memory_region_tb_write with memory_notdirty_write_access,
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 and place it in memory_notdirty_write_prepare where it can catch
 all of the instances.  Add memory_notdirty_set_dirty to log when
 we no longer intercept writes to a page.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- exec.c       | 3 +++
+ target/riscv/translate.c                      | 27 +------------------
- memory.c     | 4 ----
+ .../riscv/insn_trans/trans_privileged.c.inc   |  4 +--
- trace-events | 4 ++--
+ target/riscv/insn_trans/trans_rvi.c.inc       |  8 +++---
-files changed, 5 insertions(+), 6 deletions(-)
+ target/riscv/insn_trans/trans_rvv.c.inc       |  2 +-
 files changed, 7 insertions(+), 34 deletions(-)
-diff --git a/exec.c b/exec.c
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/exec.c
+--- a/target/riscv/translate.c
-+++ b/exec.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
+@@ -XXX,XX +XXX,XX @@ static void generate_exception_mtval(DisasContext *ctx, int excp)
-     ndi->size = size;
+     ctx->base.is_jmp = DISAS_NORETURN;
-     ndi->pages = NULL;
+ }
-+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+-static void gen_exception_debug(void)
-+
+-{
-     assert(tcg_enabled());
+-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
-     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
+-}
-         ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
+-
-@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
+-/* Wrapper around tcg_gen_exit_tb that handles single stepping */
-     /* we remove the notdirty callback only if the code has been
+-static void exit_tb(DisasContext *ctx)
-        flushed */
+-{
-     if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
+-    if (ctx->base.singlestep_enabled) {
-+        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
+-        gen_exception_debug();
-         tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
+-    } else {
 -        tcg_gen_exit_tb(NULL, 0);
 -    }
 -}
 -
 -/* Wrapper around tcg_gen_lookup_and_goto_ptr that handles single stepping */
 -static void lookup_and_goto_ptr(DisasContext *ctx)
 -{
 -    if (ctx->base.singlestep_enabled) {
 -        gen_exception_debug();
 -    } else {
 -        tcg_gen_lookup_and_goto_ptr();
 -    }
 -}
 -
  static void gen_exception_illegal(DisasContext *ctx)
  {
      generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
          tcg_gen_exit_tb(ctx->base.tb, n);
      } else {
          tcg_gen_movi_tl(cpu_pc, dest);
 -        lookup_and_goto_ptr(ctx);
 +        tcg_gen_lookup_and_goto_ptr();
      }
  }
-diff --git a/memory.c b/memory.c
 diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/memory.c
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/memory.c
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
+@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
-         /* Accesses to code which has previously been translated into a TB show
-          * up in the MMIO path, as accesses to the io_mem_notdirty
+     if (has_ext(ctx, RVS)) {
-          * MemoryRegion. */
+         gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
--        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
+-        exit_tb(ctx); /* no chaining */
-     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
++        tcg_gen_exit_tb(NULL, 0); /* no chaining */
-         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
+         ctx->base.is_jmp = DISAS_NORETURN;
-         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
+     } else {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
+         return false;
-         /* Accesses to code which has previously been translated into a TB show
+@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
-          * up in the MMIO path, as accesses to the io_mem_notdirty
+ #ifndef CONFIG_USER_ONLY
-          * MemoryRegion. */
+     tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
--        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
+     gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
-     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
+-    exit_tb(ctx); /* no chaining */
-         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
++    tcg_gen_exit_tb(NULL, 0); /* no chaining */
-         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
+     ctx->base.is_jmp = DISAS_NORETURN;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
+     return true;
-         /* Accesses to code which has previously been translated into a TB show
+ #else
-          * up in the MMIO path, as accesses to the io_mem_notdirty
+diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
           * MemoryRegion. */
 -        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
          /* Accesses to code which has previously been translated into a TB show
           * up in the MMIO path, as accesses to the io_mem_notdirty
           * MemoryRegion. */
 -        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
 diff --git a/trace-events b/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/trace-events
+--- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/trace-events
++++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@ dma_map_wait(void *dbs) "dbs=%p"
+@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
- find_ram_offset(uint64_t size, uint64_t offset) "size: 0x%" PRIx64 " @ 0x%" PRIx64
+     if (a->rd != 0) {
- find_ram_offset_loop(uint64_t size, uint64_t candidate, uint64_t offset, uint64_t next, uint64_t mingap) "trying size: 0x%" PRIx64 " @ 0x%" PRIx64 ", offset: 0x%" PRIx64" next: 0x%" PRIx64 " mingap: 0x%" PRIx64
+         tcg_gen_movi_tl(cpu_gpr[a->rd], ctx->pc_succ_insn);
- ram_block_discard_range(const char *rbname, void *hva, size_t length, bool need_madvise, bool need_fallocate, int ret) "%s@%p + 0x%zx: madvise: %d fallocate: %d ret: %d"
+     }
-+memory_notdirty_write_access(uint64_t vaddr, uint64_t ram_addr, unsigned size) "0x%" PRIx64 " ram_addr 0x%" PRIx64 " size %u"
+-
-+memory_notdirty_set_dirty(uint64_t vaddr) "0x%" PRIx64
+-    /* No chaining with JALR. */
+-    lookup_and_goto_ptr(ctx);
- # memory.c
++    tcg_gen_lookup_and_goto_ptr();
- memory_region_ops_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
- memory_region_ops_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
+     if (misaligned) {
- memory_region_subpage_read(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
+         gen_set_label(misaligned);
- memory_region_subpage_write(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
+@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
--memory_region_tb_read(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
+      * however we need to end the translation block
--memory_region_tb_write(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
+      */
- memory_region_ram_device_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
+     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
- memory_region_ram_device_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
+-    exit_tb(ctx);
- flatview_new(void *view, void *root) "%p (root %p)"
++    tcg_gen_exit_tb(NULL, 0);
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
  {
      /* We may have changed important cpu state -- exit to main loop. */
      tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
 -    exit_tb(ctx);
 +    tcg_gen_exit_tb(NULL, 0);
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsetvl(DisasContext *ctx, arg_vsetvl *a)
      gen_set_gpr(ctx, a->rd, dst);
      tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
 -    lookup_and_goto_ptr(ctx);
 +    tcg_gen_lookup_and_goto_ptr();
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
 --
-.17.1
+.25.1

-[PULL 03/16] qemu/compiler.h: Add qemu_build_not_reached
+[PULL 19/24] target/rx: Drop checks for singlestep_enabled
-Use this as a compile-time assert that a particular
+GDB single-stepping is now handled generically.
 code path is not reachable.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu/compiler.h | 15 +++++++++++++++
+ target/rx/helper.h    |  1 -
-file changed, 15 insertions(+)
+ target/rx/op_helper.c |  8 --------
  target/rx/translate.c | 12 ++----------
 files changed, 2 insertions(+), 19 deletions(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
+diff --git a/target/rx/helper.h b/target/rx/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
+--- a/target/rx/helper.h
-+++ b/include/qemu/compiler.h
++++ b/target/rx/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
- #define QEMU_GENERIC9(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC8(x, __VA_ARGS__))
+ DEF_HELPER_1(raise_access_fault, noreturn, env)
- #define QEMU_GENERIC10(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC9(x, __VA_ARGS__))
+ DEF_HELPER_1(raise_privilege_violation, noreturn, env)
+ DEF_HELPER_1(wait, noreturn, env)
-+/**
+-DEF_HELPER_1(debug, noreturn, env)
-+ * qemu_build_not_reached()
+ DEF_HELPER_2(rxint, noreturn, env, i32)
-+ *
+ DEF_HELPER_1(rxbrk, noreturn, env)
-+ * The compiler, during optimization, is expected to prove that a call
+ DEF_HELPER_FLAGS_3(fadd, TCG_CALL_NO_WG, f32, env, f32, f32)
-+ * to this function cannot be reached and remove it.  If the compiler
+diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
-+ * supports QEMU_ERROR, this will be reported at compile time; otherwise
+index XXXXXXX..XXXXXXX 100644
-+ * this will be reported at link time due to the missing symbol.
+--- a/target/rx/op_helper.c
-+ */
++++ b/target/rx/op_helper.c
-+#ifdef __OPTIMIZE__
+@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_wait(CPURXState *env)
-+extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
+     raise_exception(env, EXCP_HLT, 0);
-+    qemu_build_not_reached(void);
+ }
-+#else
-+#define qemu_build_not_reached()  g_assert_not_reached()
+-void QEMU_NORETURN helper_debug(CPURXState *env)
-+#endif
+-{
-+
+-    CPUState *cs = env_cpu(env);
- #endif /* COMPILER_H */
+-
 -    cs->exception_index = EXCP_DEBUG;
 -    cpu_loop_exit(cs);
 -}
 -
  void QEMU_NORETURN helper_rxint(CPURXState *env, uint32_t vec)
  {
      raise_exception(env, 0x100 + vec, 0);
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/translate.c
 +++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
          tcg_gen_exit_tb(dc->base.tb, n);
      } else {
          tcg_gen_movi_i32(cpu_pc, dest);
 -        if (dc->base.singlestep_enabled) {
 -            gen_helper_debug(cpu_env);
 -        } else {
 -            tcg_gen_lookup_and_goto_ptr();
 -        }
 +        tcg_gen_lookup_and_goto_ptr();
      }
      dc->base.is_jmp = DISAS_NORETURN;
  }
@@ -XXX,XX +XXX,XX @@ static void rx_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
          gen_goto_tb(ctx, 0, dcbase->pc_next);
          break;
      case DISAS_JUMP:
 -        if (ctx->base.singlestep_enabled) {
 -            gen_helper_debug(cpu_env);
 -        } else {
 -            tcg_gen_lookup_and_goto_ptr();
 -        }
 +        tcg_gen_lookup_and_goto_ptr();
          break;
      case DISAS_UPDATE:
          tcg_gen_movi_i32(cpu_pc, ctx->base.pc_next);
 --
-.17.1
+.25.1

-[PULL 14/16] cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
+[PULL 20/24] target/s390x: Drop check for singlestep_enabled
-All callers pass false to this argument.  Remove it and pass the
+GDB single-stepping is now handled generically.
 constant on to tb_invalidate_phys_page_range__locked.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h | 3 +--
+ target/s390x/tcg/translate.c | 8 ++------
- accel/tcg/translate-all.c | 6 ++----
+file changed, 2 insertions(+), 6 deletions(-)
  exec.c                    | 4 ++--
 files changed, 5 insertions(+), 8 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/target/s390x/tcg/translate.c
-+++ b/accel/tcg/translate-all.h
++++ b/target/s390x/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
+@@ -XXX,XX +XXX,XX @@ struct DisasContext {
- void page_collection_unlock(struct page_collection *set);
+     uint64_t pc_tmp;
- void tb_invalidate_phys_page_fast(struct page_collection *pages,
+     uint32_t ilen;
-                                   tb_page_addr_t start, int len);
+     enum cc_op cc_op;
--void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
+-    bool do_debug;
--                                   int is_cpu_write_access);
+ };
-+void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
- void tb_check_watchpoint(CPUState *cpu);
+ /* Information carried about a condition to be evaluated.  */
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
- #ifdef CONFIG_USER_ONLY
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
+     dc->cc_op = CC_OP_DYNAMIC;
-index XXXXXXX..XXXXXXX 100644
+     dc->ex_value = dc->base.tb->cs_base;
---- a/accel/tcg/translate-all.c
+-    dc->do_debug = dc->base.singlestep_enabled;
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
   *
   * Called with mmap_lock held for user-mode emulation
   */
 -void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
 -                                   int is_cpu_write_access)
 +void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end)
  {
      struct page_collection *pages;
      PageDesc *p;
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
          return;
      }
      pages = page_collection_lock(start, end);
 -    tb_invalidate_phys_page_range__locked(pages, p, start, end,
 -                                          is_cpu_write_access);
 +    tb_invalidate_phys_page_range__locked(pages, p, start, end, 0);
      page_collection_unlock(pages);
  }
-diff --git a/exec.c b/exec.c
+ static void s390x_tr_tb_start(DisasContextBase *db, CPUState *cs)
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
---- a/exec.c
+         /* FALLTHRU */
-+++ b/exec.c
+     case DISAS_PC_CC_UPDATED:
-@@ -XXX,XX +XXX,XX @@ const char *parse_cpu_option(const char *cpu_option)
+         /* Exit the TB, either by raising a debug exception or by return.  */
- void tb_invalidate_phys_addr(target_ulong addr)
+-        if (dc->do_debug) {
- {
+-            gen_exception(EXCP_DEBUG);
-     mmap_lock();
+-        } else if ((dc->base.tb->flags & FLAG_MASK_PER) ||
--    tb_invalidate_phys_page_range(addr, addr + 1, 0);
+-                   dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
-+    tb_invalidate_phys_page_range(addr, addr + 1);
++        if ((dc->base.tb->flags & FLAG_MASK_PER) ||
-     mmap_unlock();
++             dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
- }
+             tcg_gen_exit_tb(NULL, 0);
+         } else {
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
+             tcg_gen_lookup_and_goto_ptr();
          return;
      }
      ram_addr = memory_region_get_ram_addr(mr) + addr;
 -    tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
 +    tb_invalidate_phys_page_range(ram_addr, ram_addr + 1);
      rcu_read_unlock();
  }
 --
-.17.1
+.25.1

-[PULL 02/16] cputlb: Disable __always_inline__ without optimization
+[PULL 21/24] target/sh4: Drop check for singlestep_enabled
-This forced inlining can result in missing symbols,
+GDB single-stepping is now handled generically.
 which makes a debugging build harder to follow.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu/compiler.h | 11 +++++++++++
+ target/sh4/helper.h    |  1 -
- accel/tcg/cputlb.c      |  4 ++--
+ target/sh4/op_helper.c |  5 -----
-files changed, 13 insertions(+), 2 deletions(-)
+ target/sh4/translate.c | 14 +++-----------
 files changed, 3 insertions(+), 17 deletions(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
+diff --git a/target/sh4/helper.h b/target/sh4/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
+--- a/target/sh4/helper.h
-+++ b/include/qemu/compiler.h
++++ b/target/sh4/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
- # define QEMU_NONSTRING
+ DEF_HELPER_1(raise_slot_illegal_instruction, noreturn, env)
- #endif
+ DEF_HELPER_1(raise_fpu_disable, noreturn, env)
+ DEF_HELPER_1(raise_slot_fpu_disable, noreturn, env)
-+/*
+-DEF_HELPER_1(debug, noreturn, env)
-+ * Forced inlining may be desired to encourage constant propagation
+ DEF_HELPER_1(sleep, noreturn, env)
-+ * of function parameters.  However, it can also make debugging harder,
+ DEF_HELPER_2(trapa, noreturn, env, i32)
-+ * so disable it for a non-optimizing build.
+ DEF_HELPER_1(exclusive, noreturn, env)
-+ */
+diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
 +#if defined(__OPTIMIZE__)
 +#define QEMU_ALWAYS_INLINE  __attribute__((always_inline))
 +#else
 +#define QEMU_ALWAYS_INLINE
 +#endif
 +
  /* Implement C11 _Generic via GCC builtins.  Example:
   *
   *    QEMU_GENERIC(x, (float, sinf), (long double, sinl), sin) (x)
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/sh4/op_helper.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/sh4/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ void helper_raise_slot_fpu_disable(CPUSH4State *env)
- typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
+     raise_exception(env, 0x820, 0);
-                                 TCGMemOpIdx oi, uintptr_t retaddr);
+ }
--static inline uint64_t __attribute__((always_inline))
+-void helper_debug(CPUSH4State *env)
-+static inline uint64_t QEMU_ALWAYS_INLINE
+-{
- load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
+-    raise_exception(env, EXCP_DEBUG, 0);
-             uintptr_t retaddr, MemOp op, bool code_read,
+-}
-             FullLoadHelper *full_load)
+-
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
+ void helper_sleep(CPUSH4State *env)
   * Store Helpers
   */
 -static inline void __attribute__((always_inline))
 +static inline void QEMU_ALWAYS_INLINE
  store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
               TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
  {
+     CPUState *cs = env_cpu(env);
+diff --git a/target/sh4/translate.c b/target/sh4/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/translate.c
++++ b/target/sh4/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+         tcg_gen_exit_tb(ctx->base.tb, n);
+     } else {
+         tcg_gen_movi_i32(cpu_pc, dest);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_helper_debug(cpu_env);
+-        } else if (use_exit_tb(ctx)) {
++        if (use_exit_tb(ctx)) {
+             tcg_gen_exit_tb(NULL, 0);
+         } else {
+             tcg_gen_lookup_and_goto_ptr();
+@@ -XXX,XX +XXX,XX @@ static void gen_jump(DisasContext * ctx)
+        delayed jump as immediate jump are conditinal jumps */
+     tcg_gen_mov_i32(cpu_pc, cpu_delayed_pc);
+         tcg_gen_discard_i32(cpu_delayed_pc);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_helper_debug(cpu_env);
+-        } else if (use_exit_tb(ctx)) {
++        if (use_exit_tb(ctx)) {
+             tcg_gen_exit_tb(NULL, 0);
+         } else {
+             tcg_gen_lookup_and_goto_ptr();
+@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
+     switch (ctx->base.is_jmp) {
+     case DISAS_STOP:
+         gen_save_cpu_state(ctx, true);
+-        if (ctx->base.singlestep_enabled) {
+-            gen_helper_debug(cpu_env);
+-        } else {
+-            tcg_gen_exit_tb(NULL, 0);
+-        }
++        tcg_gen_exit_tb(NULL, 0);
+         break;
+     case DISAS_NEXT:
+     case DISAS_TOO_MANY:
 --
-.17.1
+.25.1

-[PULL 08/16] cputlb: Move ROM handling from I/O path to TLB path
+[PULL 22/24] target/tricore: Drop check for singlestep_enabled
-It does not require going through the whole I/O path
+GDB single-stepping is now handled generically.
 in order to discard a write.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h    |  5 ++++-
+ target/tricore/helper.h    |  1 -
- include/exec/cpu-common.h |  1 -
+ target/tricore/op_helper.c |  7 -------
- accel/tcg/cputlb.c        | 36 ++++++++++++++++++++--------------
+ target/tricore/translate.c | 14 +-------------
- exec.c                    | 41 +--------------------------------------
+files changed, 1 insertion(+), 21 deletions(-)
 files changed, 26 insertions(+), 57 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/target/tricore/helper.h b/target/tricore/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/target/tricore/helper.h
-+++ b/include/exec/cpu-all.h
++++ b/target/tricore/helper.h
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(psw_write, void, env, i32)
- #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+ DEF_HELPER_1(psw_read, i32, env)
- /* Set if TLB entry requires byte swap.  */
+ /* Exceptions */
- #define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
+ DEF_HELPER_3(raise_exception_sync, noreturn, env, i32, i32)
-+/* Set if TLB entry writes ignored.  */
+-DEF_HELPER_2(qemu_excp, noreturn, env, i32)
-+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
+diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
  /* Use this mask to check interception with an alignment mask
   * in a TCG backend.
   */
  #define TLB_FLAGS_MASK \
 -    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
 +    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
 +    | TLB_WATCHPOINT | TLB_BSWAP | TLB_DISCARD_WRITE)
  /**
   * tlb_hit_page: return true if page aligned @addr is a hit against the
 diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-common.h
+--- a/target/tricore/op_helper.c
-+++ b/include/exec/cpu-common.h
++++ b/target/tricore/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
+@@ -XXX,XX +XXX,XX @@ static void raise_exception_sync_helper(CPUTriCoreState *env, uint32_t class,
+     raise_exception_sync_internal(env, class, tin, pc, 0);
  void cpu_flush_icache_range(hwaddr start, hwaddr len);
 -extern struct MemoryRegion io_mem_rom;
  extern struct MemoryRegion io_mem_notdirty;
  typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
  {
      uintptr_t addr = tlb_entry->addr_write;
 -    if ((addr & (TLB_INVALID_MASK | TLB_MMIO | TLB_NOTDIRTY)) == 0) {
 +    if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
 +                 TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
          addr &= TARGET_PAGE_MASK;
          addr += tlb_entry->addend;
          if ((addr - start) < length) {
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
          address |= TLB_MMIO;
          addend = 0;
      } else {
 -        /* TLB_MMIO for rom/romd handled below */
          addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
      }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      tn.addr_write = -1;
      if (prot & PAGE_WRITE) {
 -        if ((memory_region_is_ram(section->mr) && section->readonly)
 -            || memory_region_is_romd(section->mr)) {
 -            /* Write access calls the I/O callback.  */
 -            tn.addr_write = address | TLB_MMIO;
 -        } else if (memory_region_is_ram(section->mr)
 -                   && cpu_physical_memory_is_clean(
 -                       memory_region_get_ram_addr(section->mr) + xlat)) {
 -            tn.addr_write = address | TLB_NOTDIRTY;
 -        } else {
 -            tn.addr_write = address;
 +        tn.addr_write = address;
 +        if (memory_region_is_romd(section->mr)) {
 +            /* Use the MMIO path so that the device can switch states. */
 +            tn.addr_write |= TLB_MMIO;
 +        } else if (memory_region_is_ram(section->mr)) {
 +            if (section->readonly) {
 +                tn.addr_write |= TLB_DISCARD_WRITE;
 +            } else if (cpu_physical_memory_is_clean(
 +                        memory_region_get_ram_addr(section->mr) + xlat)) {
 +                tn.addr_write |= TLB_NOTDIRTY;
 +            }
          }
          if (prot & PAGE_WRITE_INV) {
              tn.addr_write |= TLB_INVALID_MASK;
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
      cpu->mem_io_pc = retaddr;
 -    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 -    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
      cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      }
      /* Reject I/O access, or other required slow-path.  */
 -    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
 +    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
          return NULL;
      }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              return;
          }
 +        /* Ignore writes to ROM.  */
 +        if (unlikely(tlb_addr & TLB_DISCARD_WRITE)) {
 +            return;
 +        }
 +
          haddr = (void *)((uintptr_t)addr + entry->addend);
          /*
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
  AddressSpace address_space_io;
  AddressSpace address_space_memory;
 -MemoryRegion io_mem_rom, io_mem_notdirty;
 +MemoryRegion io_mem_notdirty;
  static MemoryRegion io_mem_unassigned;
  #endif
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
  #define PHYS_SECTION_UNASSIGNED 0
  #define PHYS_SECTION_NOTDIRTY 1
 -#define PHYS_SECTION_ROM 2
  static void io_mem_init(void);
  static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
          iotlb = memory_region_get_ram_addr(section->mr) + xlat;
          if (!section->readonly) {
              iotlb |= PHYS_SECTION_NOTDIRTY;
 -        } else {
 -            iotlb |= PHYS_SECTION_ROM;
          }
      } else {
          AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ static uint16_t dummy_section(PhysPageMap *map, FlatView *fv, MemoryRegion *mr)
      return phys_section_add(map, &section);
  }
--static void readonly_mem_write(void *opaque, hwaddr addr,
+-void helper_qemu_excp(CPUTriCoreState *env, uint32_t excp)
 -                               uint64_t val, unsigned size)
 -{
--    /* Ignore any write to ROM. */
+-    CPUState *cs = env_cpu(env);
 -    cs->exception_index = excp;
 -    cpu_loop_exit(cs);
 -}
 -
--static bool readonly_mem_accepts(void *opaque, hwaddr addr,
+ /* Addressing mode helper */
--                                 unsigned size, bool is_write,
--                                 MemTxAttrs attrs)
+ static uint16_t reverse16(uint16_t val)
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_pc(target_ulong pc)
      tcg_gen_movi_tl(cpu_PC, pc);
  }
 -static void generate_qemu_excp(DisasContext *ctx, int excp)
 -{
--    return is_write;
+-    TCGv_i32 tmp = tcg_const_i32(excp);
 -    gen_helper_qemu_excp(cpu_env, tmp);
 -    ctx->base.is_jmp = DISAS_NORETURN;
 -    tcg_temp_free(tmp);
 -}
 -
--/* This will only be used for writes, because reads are special cased
+ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 - * to directly access the underlying host ram.
 - */
 -static const MemoryRegionOps readonly_mem_ops = {
 -    .write = readonly_mem_write,
 -    .valid.accepts = readonly_mem_accepts,
 -    .endianness = DEVICE_NATIVE_ENDIAN,
 -    .valid = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -    .impl = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -};
 -
  MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                        hwaddr index, MemTxAttrs attrs)
  {
-@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+     if (translator_use_goto_tb(&ctx->base, dest)) {
+@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
- static void io_mem_init(void)
+         tcg_gen_exit_tb(ctx->base.tb, n);
- {
+     } else {
--    memory_region_init_io(&io_mem_rom, NULL, &readonly_mem_ops,
+         gen_save_pc(dest);
--                          NULL, NULL, UINT64_MAX);
+-        if (ctx->base.singlestep_enabled) {
-     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
+-            generate_qemu_excp(ctx, EXCP_DEBUG);
-                           NULL, UINT64_MAX);
+-        } else {
+-            tcg_gen_lookup_and_goto_ptr();
-@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
+-        }
-     assert(n == PHYS_SECTION_UNASSIGNED);
++        tcg_gen_lookup_and_goto_ptr();
-     n = dummy_section(&d->map, fv, &io_mem_notdirty);
+     }
-     assert(n == PHYS_SECTION_NOTDIRTY);
+ }
 -    n = dummy_section(&d->map, fv, &io_mem_rom);
 -    assert(n == PHYS_SECTION_ROM);
      d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 --
-.17.1
+.25.1

-[PULL 01/16] exec: Use TARGET_PAGE_BITS_MIN for TLB flags
+[PULL 23/24] target/xtensa: Drop check for singlestep_enabled
-These bits do not need to vary with the actual page size
+GDB single-stepping is now handled generically.
 used by the guest.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h | 16 ++++++++++------
+ target/xtensa/translate.c | 25 ++++++++-----------------
-file changed, 10 insertions(+), 6 deletions(-)
+file changed, 8 insertions(+), 17 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/target/xtensa/translate.c
-+++ b/include/exec/cpu-all.h
++++ b/target/xtensa/translate.c
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
+@@ -XXX,XX +XXX,XX @@ static void gen_jump_slot(DisasContext *dc, TCGv dest, int slot)
+     if (dc->icount) {
- #if !defined(CONFIG_USER_ONLY)
+         tcg_gen_mov_i32(cpu_SR[ICOUNT], dc->next_icount);
+     }
--/* Flags stored in the low bits of the TLB virtual address.  These are
+-    if (dc->base.singlestep_enabled) {
-- * defined so that fast path ram access is all zeros.
+-        gen_exception(dc, EXCP_DEBUG);
-+/*
++    if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
-+ * Flags stored in the low bits of the TLB virtual address.
++        slot = gen_postprocess(dc, slot);
-+ * These are defined so that fast path ram access is all zeros.
++    }
-  * The flags all must be between TARGET_PAGE_BITS and
++    if (slot >= 0) {
-  * maximum address alignment bit.
++        tcg_gen_goto_tb(slot);
-+ *
++        tcg_gen_exit_tb(dc->base.tb, slot);
-+ * Use TARGET_PAGE_BITS_MIN so that these bits are constant
+     } else {
-+ * when TARGET_PAGE_BITS_VARY is in effect.
+-        if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
-  */
+-            slot = gen_postprocess(dc, slot);
- /* Zero if TLB entry is valid.  */
+-        }
--#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS - 1))
+-        if (slot >= 0) {
-+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
+-            tcg_gen_goto_tb(slot);
- /* Set if TLB entry references a clean RAM page.  The iotlb entry will
+-            tcg_gen_exit_tb(dc->base.tb, slot);
-    contain the page physical address.  */
+-        } else {
--#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
+-            tcg_gen_exit_tb(NULL, 0);
-+#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
+-        }
- /* Set if TLB entry is an IO callback.  */
++        tcg_gen_exit_tb(NULL, 0);
--#define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
+     }
-+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
+     dc->base.is_jmp = DISAS_NORETURN;
- /* Set if TLB entry contains a watchpoint.  */
+ }
--#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
+@@ -XXX,XX +XXX,XX @@ static void xtensa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-+#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+     case DISAS_NORETURN:
+         break;
- /* Use this mask to check interception with an alignment mask
+     case DISAS_TOO_MANY:
-  * in a TCG backend.
+-        if (dc->base.singlestep_enabled) {
 -            tcg_gen_movi_i32(cpu_pc, dc->pc);
 -            gen_exception(dc, EXCP_DEBUG);
 -        } else {
 -            gen_jumpi(dc, dc->pc, 0);
 -        }
 +        gen_jumpi(dc, dc->pc, 0);
          break;
      default:
          g_assert_not_reached();
 --
-.17.1
+.25.1

-[PULL 13/16] cputlb: Remove cpu->mem_io_vaddr
+[PULL 24/24] Revert "cpu: Move cpu_common_props to hw/core/cpu.c"
-With the merge of notdirty handling into store_helper,
+This reverts commit 1b36e4f5a5de585210ea95f2257839c2312be28f.
 the last user of cpu->mem_io_vaddr was removed.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Despite a comment saying why cpu_common_props cannot be placed in
-Reviewed-by: David Hildenbrand <david@redhat.com>
+a file that is compiled once, it was moved anyway.  Revert that.
 Since then, Property is not defined in hw/core/cpu.h, so it is now
 easier to declare a function to install the properties rather than
 the Property array itself.
 Cc: Eduardo Habkost <ehabkost@redhat.com>
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 2 --
+ include/hw/core/cpu.h |  1 +
- accel/tcg/cputlb.c    | 2 --
+ cpu.c                 | 21 +++++++++++++++++++++
- hw/core/cpu.c         | 1 -
+ hw/core/cpu-common.c  | 17 +----------------
-files changed, 5 deletions(-)
+files changed, 23 insertions(+), 16 deletions(-)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
+@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
-  * @next_cpu: Next CPU sharing TB cache.
+     GCC_FMT_ATTR(2, 3);
-  * @opaque: User data.
-  * @mem_io_pc: Host Program Counter at which the memory was accessed.
+ /* $(top_srcdir)/cpu.c */
-- * @mem_io_vaddr: Target virtual address at which the memory was accessed.
++void cpu_class_init_props(DeviceClass *dc);
-  * @kvm_fd: vCPU file descriptor for KVM.
+ void cpu_exec_initfn(CPUState *cpu);
-  * @work_mutex: Lock to prevent multiple access to queued_work_*.
+ void cpu_exec_realizefn(CPUState *cpu, Error **errp);
-  * @queued_work_first: First asynchronous work pending.
+ void cpu_exec_unrealizefn(CPUState *cpu);
-@@ -XXX,XX +XXX,XX @@ struct CPUState {
+diff --git a/cpu.c b/cpu.c
-      * we store some rarely used information in the CPU context.
+index XXXXXXX..XXXXXXX 100644
-      */
+--- a/cpu.c
-     uintptr_t mem_io_pc;
++++ b/cpu.c
--    vaddr mem_io_vaddr;
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
      cpu_list_remove(cpu);
  }
 +static Property cpu_common_props[] = {
 +#ifndef CONFIG_USER_ONLY
 +    /*
 +     * Create a memory property for softmmu CPU object,
 +     * so users can wire up its memory. (This can't go in hw/core/cpu.c
 +     * because that file is compiled only once for both user-mode
 +     * and system builds.) The default if no link is set up is to use
 +     * the system address space.
 +     */
 +    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +#endif
 +    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +void cpu_class_init_props(DeviceClass *dc)
 +{
 +    device_class_set_props(dc, cpu_common_props);
 +}
 +
  void cpu_exec_initfn(CPUState *cpu)
  {
      cpu->as = NULL;
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
      return cpu->cpu_index;
  }
 -static Property cpu_common_props[] = {
 -#ifndef CONFIG_USER_ONLY
 -    /* Create a memory property for softmmu CPU object,
 -     * so users can wire up its memory. (This can't go in hw/core/cpu.c
 -     * because that file is compiled only once for both user-mode
 -     * and system builds.) The default if no link is set up is to use
 -     * the system address space.
 -     */
 -    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
 -                     MemoryRegion *),
 -#endif
 -    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void cpu_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
      dc->realize = cpu_common_realizefn;
      dc->unrealize = cpu_common_unrealizefn;
      dc->reset = cpu_common_reset;
 -    device_class_set_props(dc, cpu_common_props);
 +    cpu_class_init_props(dc);
      /*
-      * This is only needed for the legacy cpu_unassigned_access() hook;
+      * Reason: CPUs still need special care by board code: wiring up
-      * when all targets using it have been converted to use
+      * IRQs, adding reset handlers, halting non-first CPUs, ...
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
          cpu_io_recompile(cpu, retaddr);
      }
 -    cpu->mem_io_vaddr = addr;
      cpu->mem_io_access_type = access_type;
      if (mr->global_locking && !qemu_mutex_iothread_locked()) {
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
 -    cpu->mem_io_vaddr = addr;
      cpu->mem_io_pc = retaddr;
      if (mr->global_locking && !qemu_mutex_iothread_locked()) {
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(CPUState *cpu)
      cpu->interrupt_request = 0;
      cpu->halted = 0;
      cpu->mem_io_pc = 0;
 -    cpu->mem_io_vaddr = 0;
      cpu->icount_extra = 0;
      atomic_set(&cpu->icount_decr_ptr->u32, 0);
      cpu->can_do_io = 1;
 --
-.17.1
+.25.1

This is v4 of my notdirty + rom patch set with two suggested name
changes (qemu_build_not_reached, TLB_DISCARD_WRITE) from David and Alex.

The following changes since commit 240ab11fb72049d6373cbbec8d788f8e411a00bc:

Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20190924' into staging (2019-09-24 15:36:31 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20190925

for you to fetch changes up to ae57db63acf5a0399232f852acc5c1d83ef63400:

cputlb: Pass retaddr to tb_check_watchpoint (2019-09-25 10:56:28 -0700)

----------------------------------------------------------------
Fixes for TLB_BSWAP
Coversion of NOTDIRTY and ROM handling to cputlb
Followup cleanups to cputlb

----------------------------------------------------------------
Richard Henderson (16):
      exec: Use TARGET_PAGE_BITS_MIN for TLB flags
      cputlb: Disable __always_inline__ without optimization
      qemu/compiler.h: Add qemu_build_not_reached
      cputlb: Use qemu_build_not_reached in load/store_helpers
      cputlb: Split out load/store_memop
      cputlb: Introduce TLB_BSWAP
      exec: Adjust notdirty tracing
      cputlb: Move ROM handling from I/O path to TLB path
      cputlb: Move NOTDIRTY handling from I/O path to TLB path
      cputlb: Partially inline memory_region_section_get_iotlb
      cputlb: Merge and move memory_notdirty_write_{prepare,complete}
      cputlb: Handle TLB_NOTDIRTY in probe_access
      cputlb: Remove cpu->mem_io_vaddr
      cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
      cputlb: Pass retaddr to tb_invalidate_phys_page_fast
      cputlb: Pass retaddr to tb_check_watchpoint

These bits do not need to vary with the actual page size
used by the guest.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 #if !defined(CONFIG_USER_ONLY)
 
-/* Flags stored in the low bits of the TLB virtual address.  These are
- * defined so that fast path ram access is all zeros.
+/*
+ * Flags stored in the low bits of the TLB virtual address.
+ * These are defined so that fast path ram access is all zeros.
  * The flags all must be between TARGET_PAGE_BITS and
  * maximum address alignment bit.
+ *
+ * Use TARGET_PAGE_BITS_MIN so that these bits are constant
+ * when TARGET_PAGE_BITS_VARY is in effect.
  */
 /* Zero if TLB entry is valid.  */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS - 1))
+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
 /* Set if TLB entry references a clean RAM page.  The iotlb entry will
    contain the page physical address.  */
-#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
+#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
 /* Set if TLB entry is an IO callback.  */
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
 /* Set if TLB entry contains a watchpoint.  */
-#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
+#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
-- 
2.17.1

This forced inlining can result in missing symbols,
which makes a debugging build harder to follow.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/compiler.h | 11 +++++++++++
 accel/tcg/cputlb.c      |  4 ++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 # define QEMU_NONSTRING
 #endif
 
+/*
+ * Forced inlining may be desired to encourage constant propagation
+ * of function parameters.  However, it can also make debugging harder,
+ * so disable it for a non-optimizing build.
+ */
+#if defined(__OPTIMIZE__)
+#define QEMU_ALWAYS_INLINE  __attribute__((always_inline))
+#else
+#define QEMU_ALWAYS_INLINE
+#endif
+
 /* Implement C11 _Generic via GCC builtins.  Example:
  *
  *    QEMU_GENERIC(x, (float, sinf), (long double, sinl), sin) (x)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
                                 TCGMemOpIdx oi, uintptr_t retaddr);
 
-static inline uint64_t __attribute__((always_inline))
+static inline uint64_t QEMU_ALWAYS_INLINE
 load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             uintptr_t retaddr, MemOp op, bool code_read,
             FullLoadHelper *full_load)
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
  * Store Helpers
  */
 
-static inline void __attribute__((always_inline))
+static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
 {
-- 
2.17.1

Use this as a compile-time assert that a particular
code path is not reachable.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/compiler.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_GENERIC9(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC8(x, __VA_ARGS__))
 #define QEMU_GENERIC10(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC9(x, __VA_ARGS__))
 
+/**
+ * qemu_build_not_reached()
+ *
+ * The compiler, during optimization, is expected to prove that a call
+ * to this function cannot be reached and remove it.  If the compiler
+ * supports QEMU_ERROR, this will be reported at compile time; otherwise
+ * this will be reported at link time due to the missing symbol.
+ */
+#ifdef __OPTIMIZE__
+extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
+    qemu_build_not_reached(void);
+#else
+#define qemu_build_not_reached()  g_assert_not_reached()
+#endif
+
 #endif /* COMPILER_H */
-- 
2.17.1

We will shortly be using these more than once.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 107 +++++++++++++++++++++++----------------------
 1 file changed, 55 insertions(+), 52 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
                                 TCGMemOpIdx oi, uintptr_t retaddr);
 
+static inline uint64_t QEMU_ALWAYS_INLINE
+load_memop(const void *haddr, MemOp op)
+{
+    switch (op) {
+    case MO_UB:
+        return ldub_p(haddr);
+    case MO_BEUW:
+        return lduw_be_p(haddr);
+    case MO_LEUW:
+        return lduw_le_p(haddr);
+    case MO_BEUL:
+        return (uint32_t)ldl_be_p(haddr);
+    case MO_LEUL:
+        return (uint32_t)ldl_le_p(haddr);
+    case MO_BEQ:
+        return ldq_be_p(haddr);
+    case MO_LEQ:
+        return ldq_le_p(haddr);
+    default:
+        qemu_build_not_reached();
+    }
+}
+
 static inline uint64_t QEMU_ALWAYS_INLINE
 load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             uintptr_t retaddr, MemOp op, bool code_read,
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (op) {
-    case MO_UB:
-        res = ldub_p(haddr);
-        break;
-    case MO_BEUW:
-        res = lduw_be_p(haddr);
-        break;
-    case MO_LEUW:
-        res = lduw_le_p(haddr);
-        break;
-    case MO_BEUL:
-        res = (uint32_t)ldl_be_p(haddr);
-        break;
-    case MO_LEUL:
-        res = (uint32_t)ldl_le_p(haddr);
-        break;
-    case MO_BEQ:
-        res = ldq_be_p(haddr);
-        break;
-    case MO_LEQ:
-        res = ldq_le_p(haddr);
-        break;
-    default:
-        qemu_build_not_reached();
-    }
-
-    return res;
+    return load_memop(haddr, op);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
  * Store Helpers
  */
 
+static inline void QEMU_ALWAYS_INLINE
+store_memop(void *haddr, uint64_t val, MemOp op)
+{
+    switch (op) {
+    case MO_UB:
+        stb_p(haddr, val);
+        break;
+    case MO_BEUW:
+        stw_be_p(haddr, val);
+        break;
+    case MO_LEUW:
+        stw_le_p(haddr, val);
+        break;
+    case MO_BEUL:
+        stl_be_p(haddr, val);
+        break;
+    case MO_LEUL:
+        stl_le_p(haddr, val);
+        break;
+    case MO_BEQ:
+        stq_be_p(haddr, val);
+        break;
+    case MO_LEQ:
+        stq_le_p(haddr, val);
+        break;
+    default:
+        qemu_build_not_reached();
+    }
+}
+
 static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (op) {
-    case MO_UB:
-        stb_p(haddr, val);
-        break;
-    case MO_BEUW:
-        stw_be_p(haddr, val);
-        break;
-    case MO_LEUW:
-        stw_le_p(haddr, val);
-        break;
-    case MO_BEUL:
-        stl_be_p(haddr, val);
-        break;
-    case MO_LEUL:
-        stl_le_p(haddr, val);
-        break;
-    case MO_BEQ:
-        stq_be_p(haddr, val);
-        break;
-    case MO_LEQ:
-        stq_le_p(haddr, val);
-        break;
-    default:
-        qemu_build_not_reached();
-    }
+    store_memop(haddr, val, op);
 }
 
 void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
-- 
2.17.1

Handle bswap on ram directly in load/store_helper.  This fixes a
bug with the previous implementation in that one cannot use the
I/O path for RAM.

Fixes: a26fc6f5152b47f1
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  4 ++-
 accel/tcg/cputlb.c     | 72 +++++++++++++++++++++++++-----------------
 2 files changed, 46 insertions(+), 30 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
 /* Set if TLB entry contains a watchpoint.  */
 #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+/* Set if TLB entry requires byte swap.  */
+#define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
         address |= TLB_INVALID_MASK;
     }
     if (attrs.byte_swap) {
-        /* Force the access through the I/O slow path.  */
-        address |= TLB_MMIO;
+        address |= TLB_BSWAP;
     }
     if (!memory_region_is_ram(section->mr) &&
         !memory_region_is_romd(section->mr)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    if (iotlbentry->attrs.byte_swap) {
-        op ^= MO_BSWAP;
-    }
-
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    if (iotlbentry->attrs.byte_swap) {
-        op ^= MO_BSWAP;
-    }
-
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
                              wp_access, retaddr);
     }
 
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
-        /* I/O access */
+    /* Reject I/O access, or other required slow-path.  */
+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
         CPUIOTLBEntry *iotlbentry;
+        bool need_swap;
 
         /* For anything that is unaligned, recurse through full_load.  */
         if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
                                  iotlbentry->attrs, BP_MEM_READ, retaddr);
-
-            /* The backing page may or may not require I/O.  */
-            tlb_addr &= ~TLB_WATCHPOINT;
-            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-                goto do_aligned_access;
-            }
         }
 
+        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+
         /* Handle I/O access.  */
-        return io_readx(env, iotlbentry, mmu_idx, addr,
-                        retaddr, access_type, op);
+        if (likely(tlb_addr & TLB_MMIO)) {
+            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
+                            access_type, op ^ (need_swap * MO_BSWAP));
+        }
+
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
+        /*
+         * Keep these two load_memop separate to ensure that the compiler
+         * is able to fold the entire function to a single instruction.
+         * There is a build-time assert inside to remind you of this.  ;-)
+         */
+        if (unlikely(need_swap)) {
+            return load_memop(haddr, op ^ MO_BSWAP);
+        }
+        return load_memop(haddr, op);
     }
 
     /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
         return res & MAKE_64BIT_MASK(0, size * 8);
     }
 
- do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     return load_memop(haddr, op);
 }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
         CPUIOTLBEntry *iotlbentry;
+        bool need_swap;
 
         /* For anything that is unaligned, recurse through byte stores.  */
         if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
                                  iotlbentry->attrs, BP_MEM_WRITE, retaddr);
-
-            /* The backing page may or may not require I/O.  */
-            tlb_addr &= ~TLB_WATCHPOINT;
-            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-                goto do_aligned_access;
-            }
         }
 
+        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+
         /* Handle I/O access.  */
-        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
+        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
+            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
+                      op ^ (need_swap * MO_BSWAP));
+            return;
+        }
+
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
+        /*
+         * Keep these two store_memop separate to ensure that the compiler
+         * is able to fold the entire function to a single instruction.
+         * There is a build-time assert inside to remind you of this.  ;-)
+         */
+        if (unlikely(need_swap)) {
+            store_memop(haddr, val, op ^ MO_BSWAP);
+        } else {
+            store_memop(haddr, val, op);
+        }
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         return;
     }
 
- do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     store_memop(haddr, val, op);
 }
-- 
2.17.1

The memory_region_tb_read tracepoint is unreachable, since notdirty
is supposed to apply only to writes.  The memory_region_tb_write
tracepoint is mis-named, because notdirty is not only used for TB
invalidation.  It is also used for e.g. VGA RAM updates and migration.

Replace memory_region_tb_write with memory_notdirty_write_access,
and place it in memory_notdirty_write_prepare where it can catch
all of the instances.  Add memory_notdirty_set_dirty to log when
we no longer intercept writes to a page.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 exec.c       | 3 +++
 memory.c     | 4 ----
 trace-events | 4 ++--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
     ndi->size = size;
     ndi->pages = NULL;
 
+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+
     assert(tcg_enabled());
     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
         ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
     /* we remove the notdirty callback only if the code has been
        flushed */
     if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
+        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
         tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
     }
 }
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
diff --git a/trace-events b/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/trace-events
+++ b/trace-events
@@ -XXX,XX +XXX,XX @@ dma_map_wait(void *dbs) "dbs=%p"
 find_ram_offset(uint64_t size, uint64_t offset) "size: 0x%" PRIx64 " @ 0x%" PRIx64
 find_ram_offset_loop(uint64_t size, uint64_t candidate, uint64_t offset, uint64_t next, uint64_t mingap) "trying size: 0x%" PRIx64 " @ 0x%" PRIx64 ", offset: 0x%" PRIx64" next: 0x%" PRIx64 " mingap: 0x%" PRIx64
 ram_block_discard_range(const char *rbname, void *hva, size_t length, bool need_madvise, bool need_fallocate, int ret) "%s@%p + 0x%zx: madvise: %d fallocate: %d ret: %d"
+memory_notdirty_write_access(uint64_t vaddr, uint64_t ram_addr, unsigned size) "0x%" PRIx64 " ram_addr 0x%" PRIx64 " size %u"
+memory_notdirty_set_dirty(uint64_t vaddr) "0x%" PRIx64
 
 # memory.c
 memory_region_ops_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ops_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_subpage_read(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_subpage_write(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
-memory_region_tb_read(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
-memory_region_tb_write(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ram_device_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ram_device_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 flatview_new(void *view, void *root) "%p (root %p)"
-- 
2.17.1

It does not require going through the whole I/O path
in order to discard a write.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h    |  5 ++++-
 include/exec/cpu-common.h |  1 -
 accel/tcg/cputlb.c        | 36 ++++++++++++++++++++--------------
 exec.c                    | 41 +--------------------------------------
 4 files changed, 26 insertions(+), 57 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
 /* Set if TLB entry requires byte swap.  */
 #define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
+/* Set if TLB entry writes ignored.  */
+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
+    | TLB_WATCHPOINT | TLB_BSWAP | TLB_DISCARD_WRITE)
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
 
 void cpu_flush_icache_range(hwaddr start, hwaddr len);
 
-extern struct MemoryRegion io_mem_rom;
 extern struct MemoryRegion io_mem_notdirty;
 
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
 {
     uintptr_t addr = tlb_entry->addr_write;
 
-    if ((addr & (TLB_INVALID_MASK | TLB_MMIO | TLB_NOTDIRTY)) == 0) {
+    if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
+                 TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
         addr &= TARGET_PAGE_MASK;
         addr += tlb_entry->addend;
         if ((addr - start) < length) {
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
         address |= TLB_MMIO;
         addend = 0;
     } else {
-        /* TLB_MMIO for rom/romd handled below */
         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 
     tn.addr_write = -1;
     if (prot & PAGE_WRITE) {
-        if ((memory_region_is_ram(section->mr) && section->readonly)
-            || memory_region_is_romd(section->mr)) {
-            /* Write access calls the I/O callback.  */
-            tn.addr_write = address | TLB_MMIO;
-        } else if (memory_region_is_ram(section->mr)
-                   && cpu_physical_memory_is_clean(
-                       memory_region_get_ram_addr(section->mr) + xlat)) {
-            tn.addr_write = address | TLB_NOTDIRTY;
-        } else {
-            tn.addr_write = address;
+        tn.addr_write = address;
+        if (memory_region_is_romd(section->mr)) {
+            /* Use the MMIO path so that the device can switch states. */
+            tn.addr_write |= TLB_MMIO;
+        } else if (memory_region_is_ram(section->mr)) {
+            if (section->readonly) {
+                tn.addr_write |= TLB_DISCARD_WRITE;
+            } else if (cpu_physical_memory_is_clean(
+                        memory_region_get_ram_addr(section->mr) + xlat)) {
+                tn.addr_write |= TLB_NOTDIRTY;
+            }
         }
         if (prot & PAGE_WRITE_INV) {
             tn.addr_write |= TLB_INVALID_MASK;
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
     cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     }
 
     /* Reject I/O access, or other required slow-path.  */
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             return;
         }
 
+        /* Ignore writes to ROM.  */
+        if (unlikely(tlb_addr & TLB_DISCARD_WRITE)) {
+            return;
+        }
+
         haddr = (void *)((uintptr_t)addr + entry->addend);
 
         /*
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
 AddressSpace address_space_io;
 AddressSpace address_space_memory;
 
-MemoryRegion io_mem_rom, io_mem_notdirty;
+MemoryRegion io_mem_notdirty;
 static MemoryRegion io_mem_unassigned;
 #endif
 
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
 
 #define PHYS_SECTION_UNASSIGNED 0
 #define PHYS_SECTION_NOTDIRTY 1
-#define PHYS_SECTION_ROM 2
 
 static void io_mem_init(void);
 static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
         if (!section->readonly) {
             iotlb |= PHYS_SECTION_NOTDIRTY;
-        } else {
-            iotlb |= PHYS_SECTION_ROM;
         }
     } else {
         AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ static uint16_t dummy_section(PhysPageMap *map, FlatView *fv, MemoryRegion *mr)
     return phys_section_add(map, &section);
 }
 
-static void readonly_mem_write(void *opaque, hwaddr addr,
-                               uint64_t val, unsigned size)
-{
-    /* Ignore any write to ROM. */
-}
-
-static bool readonly_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write,
-                                 MemTxAttrs attrs)
-{
-    return is_write;
-}
-
-/* This will only be used for writes, because reads are special cased
- * to directly access the underlying host ram.
- */
-static const MemoryRegionOps readonly_mem_ops = {
-    .write = readonly_mem_write,
-    .valid.accepts = readonly_mem_accepts,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-};
-
 MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                       hwaddr index, MemTxAttrs attrs)
 {
@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
 
 static void io_mem_init(void)
 {
-    memory_region_init_io(&io_mem_rom, NULL, &readonly_mem_ops,
-                          NULL, NULL, UINT64_MAX);
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           NULL, UINT64_MAX);
 
@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
     assert(n == PHYS_SECTION_UNASSIGNED);
     n = dummy_section(&d->map, fv, &io_mem_notdirty);
     assert(n == PHYS_SECTION_NOTDIRTY);
-    n = dummy_section(&d->map, fv, &io_mem_rom);
-    assert(n == PHYS_SECTION_ROM);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 
-- 
2.17.1

Pages that we want to track for NOTDIRTY are RAM.  We do not
really need to go through the I/O path to handle them.

Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  2 --
 accel/tcg/cputlb.c        | 26 +++++++++++++++++---
 exec.c                    | 50 ---------------------------------------
 memory.c                  | 16 -------------
 4 files changed, 23 insertions(+), 71 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
 
 void cpu_flush_icache_range(hwaddr start, hwaddr len);
 
-extern struct MemoryRegion io_mem_notdirty;
-
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
     cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
-        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
+        if (tlb_addr & TLB_MMIO) {
             io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
                       op ^ (need_swap * MO_BSWAP));
             return;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         haddr = (void *)((uintptr_t)addr + entry->addend);
 
+        /* Handle clean RAM pages.  */
+        if (tlb_addr & TLB_NOTDIRTY) {
+            NotDirtyInfo ndi;
+
+            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
+            env_cpu(env)->mem_io_pc = retaddr;
+
+            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
+                                          addr + iotlbentry->addr, size);
+
+            if (unlikely(need_swap)) {
+                store_memop(haddr, val, op ^ MO_BSWAP);
+            } else {
+                store_memop(haddr, val, op);
+            }
+
+            memory_notdirty_write_complete(&ndi);
+            return;
+        }
+
         /*
          * Keep these two store_memop separate to ensure that the compiler
          * is able to fold the entire function to a single instruction.
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
 AddressSpace address_space_io;
 AddressSpace address_space_memory;
 
-MemoryRegion io_mem_notdirty;
 static MemoryRegion io_mem_unassigned;
 #endif
 
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
 } subpage_t;
 
 #define PHYS_SECTION_UNASSIGNED 0
-#define PHYS_SECTION_NOTDIRTY 1
 
 static void io_mem_init(void);
 static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
     if (memory_region_is_ram(section->mr)) {
         /* Normal RAM.  */
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
-        if (!section->readonly) {
-            iotlb |= PHYS_SECTION_NOTDIRTY;
-        }
     } else {
         AddressSpaceDispatch *d;
 
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
     }
 }
 
-/* Called within RCU critical section.  */
-static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
-                               uint64_t val, unsigned size)
-{
-    NotDirtyInfo ndi;
-
-    memory_notdirty_write_prepare(&ndi, current_cpu, current_cpu->mem_io_vaddr,
-                         ram_addr, size);
-
-    stn_p(qemu_map_ram_ptr(NULL, ram_addr), size, val);
-    memory_notdirty_write_complete(&ndi);
-}
-
-static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write,
-                                 MemTxAttrs attrs)
-{
-    return is_write;
-}
-
-static const MemoryRegionOps notdirty_mem_ops = {
-    .write = notdirty_mem_write,
-    .valid.accepts = notdirty_mem_accepts,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-};
-
 /* Generate a debug exception if a watchpoint has been hit.  */
 void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                           MemTxAttrs attrs, int flags, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
 {
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           NULL, UINT64_MAX);
-
-    /* io_mem_notdirty calls tb_invalidate_phys_page_fast,
-     * which can be called without the iothread mutex.
-     */
-    memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
-                          NULL, UINT64_MAX);
-    memory_region_clear_global_locking(&io_mem_notdirty);
 }
 
 AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
 
     n = dummy_section(&d->map, fv, &io_mem_unassigned);
     assert(n == PHYS_SECTION_UNASSIGNED);
-    n = dummy_section(&d->map, fv, &io_mem_notdirty);
-    assert(n == PHYS_SECTION_NOTDIRTY);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
     tmp = mr->ops->read(mr->opaque, addr, size);
     if (mr->subpage) {
         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
     r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs);
     if (mr->subpage) {
         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
 
     if (mr->subpage) {
         trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
 
     if (mr->subpage) {
         trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
-- 
2.17.1

There is only one caller, tlb_set_page_with_attrs.  We cannot
inline the entire function because the AddressSpaceDispatch
structure is private to exec.c, and cannot easily be moved to
include/exec/memory-internal.h.

Compute is_ram and is_romd once within tlb_set_page_with_attrs.
Fold the number of tests against these predicates.  Compute
cpu_physical_memory_is_clean outside of the tlb lock region.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |  6 +---
 accel/tcg/cputlb.c      | 68 ++++++++++++++++++++++++++---------------
 exec.c                  | 22 ++-----------
 3 files changed, 47 insertions(+), 49 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
                                   hwaddr *xlat, hwaddr *plen,
                                   MemTxAttrs attrs, int *prot);
 hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section,
-                                       target_ulong vaddr,
-                                       hwaddr paddr, hwaddr xlat,
-                                       int prot,
-                                       target_ulong *address);
+                                       MemoryRegionSection *section);
 #endif
 
 /* vl.c */
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     MemoryRegionSection *section;
     unsigned int index;
     target_ulong address;
-    target_ulong code_address;
+    target_ulong write_address;
     uintptr_t addend;
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
     target_ulong vaddr_page;
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     int wp_flags;
+    bool is_ram, is_romd;
 
     assert_cpu_is_self(cpu);
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     if (attrs.byte_swap) {
         address |= TLB_BSWAP;
     }
-    if (!memory_region_is_ram(section->mr) &&
-        !memory_region_is_romd(section->mr)) {
-        /* IO memory case */
-        address |= TLB_MMIO;
-        addend = 0;
-    } else {
+
+    is_ram = memory_region_is_ram(section->mr);
+    is_romd = memory_region_is_romd(section->mr);
+
+    if (is_ram || is_romd) {
+        /* RAM and ROMD both have associated host memory. */
         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
+    } else {
+        /* I/O does not; force the host address to NULL. */
+        addend = 0;
+    }
+
+    write_address = address;
+    if (is_ram) {
+        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
+        /*
+         * Computing is_clean is expensive; avoid all that unless
+         * the page is actually writable.
+         */
+        if (prot & PAGE_WRITE) {
+            if (section->readonly) {
+                write_address |= TLB_DISCARD_WRITE;
+            } else if (cpu_physical_memory_is_clean(iotlb)) {
+                write_address |= TLB_NOTDIRTY;
+            }
+        }
+    } else {
+        /* I/O or ROMD */
+        iotlb = memory_region_section_get_iotlb(cpu, section) + xlat;
+        /*
+         * Writes to romd devices must go through MMIO to enable write.
+         * Reads to romd devices go through the ram_ptr found above,
+         * but of course reads to I/O must go through MMIO.
+         */
+        write_address |= TLB_MMIO;
+        if (!is_romd) {
+            address = write_address;
+        }
     }
 
-    code_address = address;
-    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
-                                            paddr_page, xlat, prot, &address);
     wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
                                               TARGET_PAGE_SIZE);
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     /*
      * At this point iotlb contains a physical section number in the lower
      * TARGET_PAGE_BITS, and either
-     *  + the ram_addr_t of the page base of the target RAM (if NOTDIRTY or ROM)
-     *  + the offset within section->mr of the page base (otherwise)
+     *  + the ram_addr_t of the page base of the target RAM (RAM)
+     *  + the offset within section->mr of the page base (I/O, ROMD)
      * We subtract the vaddr_page (which is page aligned and thus won't
      * disturb the low bits) to give an offset which can be added to the
      * (non-page-aligned) vaddr of the eventual memory access to get
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     }
 
     if (prot & PAGE_EXEC) {
-        tn.addr_code = code_address;
+        tn.addr_code = address;
     } else {
         tn.addr_code = -1;
     }
 
     tn.addr_write = -1;
     if (prot & PAGE_WRITE) {
-        tn.addr_write = address;
-        if (memory_region_is_romd(section->mr)) {
-            /* Use the MMIO path so that the device can switch states. */
-            tn.addr_write |= TLB_MMIO;
-        } else if (memory_region_is_ram(section->mr)) {
-            if (section->readonly) {
-                tn.addr_write |= TLB_DISCARD_WRITE;
-            } else if (cpu_physical_memory_is_clean(
-                        memory_region_get_ram_addr(section->mr) + xlat)) {
-                tn.addr_write |= TLB_NOTDIRTY;
-            }
-        }
+        tn.addr_write = write_address;
         if (prot & PAGE_WRITE_INV) {
             tn.addr_write |= TLB_INVALID_MASK;
         }
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
 
 /* Called from RCU critical section */
 hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section,
-                                       target_ulong vaddr,
-                                       hwaddr paddr, hwaddr xlat,
-                                       int prot,
-                                       target_ulong *address)
+                                       MemoryRegionSection *section)
 {
-    hwaddr iotlb;
-
-    if (memory_region_is_ram(section->mr)) {
-        /* Normal RAM.  */
-        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
-    } else {
-        AddressSpaceDispatch *d;
-
-        d = flatview_to_dispatch(section->fv);
-        iotlb = section - d->map.sections;
-        iotlb += xlat;
-    }
-
-    return iotlb;
+    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
+    return section - d->map.sections;
 }
 #endif /* defined(CONFIG_USER_ONLY) */
 
-- 
2.17.1

Since 9458a9a1df1a, all readers of the dirty bitmaps wait
for the rcu lock, which means that they wait until the end
of any executing TranslationBlock.

As a consequence, there is no need for the actual access
to happen in between the _prepare and _complete.  Therefore,
we can improve things by merging the two functions into
notdirty_write and dropping the NotDirtyInfo structure.

In addition, the only users of notdirty_write are in cputlb.c,
so move the merged function there.  Pass in the CPUIOTLBEntry
from which the ram_addr_t may be computed.

Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memory-internal.h | 65 -----------------------------
 accel/tcg/cputlb.c             | 76 +++++++++++++++++++---------------
 exec.c                         | 44 --------------------
 3 files changed, 42 insertions(+), 143 deletions(-)

diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -XXX,XX +XXX,XX @@ void address_space_dispatch_free(AddressSpaceDispatch *d);
 
 void mtree_print_dispatch(struct AddressSpaceDispatch *d,
                           MemoryRegion *root);
-
-struct page_collection;
-
-/* Opaque struct for passing info from memory_notdirty_write_prepare()
- * to memory_notdirty_write_complete(). Callers should treat all fields
- * as private, with the exception of @active.
- *
- * @active is a field which is not touched by either the prepare or
- * complete functions, but which the caller can use if it wishes to
- * track whether it has called prepare for this struct and so needs
- * to later call the complete function.
- */
-typedef struct {
-    CPUState *cpu;
-    struct page_collection *pages;
-    ram_addr_t ram_addr;
-    vaddr mem_vaddr;
-    unsigned size;
-    bool active;
-} NotDirtyInfo;
-
-/**
- * memory_notdirty_write_prepare: call before writing to non-dirty memory
- * @ndi: pointer to opaque NotDirtyInfo struct
- * @cpu: CPU doing the write
- * @mem_vaddr: virtual address of write
- * @ram_addr: the ram address of the write
- * @size: size of write in bytes
- *
- * Any code which writes to the host memory corresponding to
- * guest RAM which has been marked as NOTDIRTY must wrap those
- * writes in calls to memory_notdirty_write_prepare() and
- * memory_notdirty_write_complete():
- *
- *  NotDirtyInfo ndi;
- *  memory_notdirty_write_prepare(&ndi, ....);
- *  ... perform write here ...
- *  memory_notdirty_write_complete(&ndi);
- *
- * These calls will ensure that we flush any TCG translated code for
- * the memory being written, update the dirty bits and (if possible)
- * remove the slowpath callback for writing to the memory.
- *
- * This must only be called if we are using TCG; it will assert otherwise.
- *
- * We may take locks in the prepare call, so callers must ensure that
- * they don't exit (via longjump or otherwise) without calling complete.
- *
- * This call must only be made inside an RCU critical section.
- * (Note that while we're executing a TCG TB we're always in an
- * RCU critical section, which is likely to be the case for callers
- * of these functions.)
- */
-void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
-                                   CPUState *cpu,
-                                   vaddr mem_vaddr,
-                                   ram_addr_t ram_addr,
-                                   unsigned size);
-/**
- * memory_notdirty_write_complete: finish write to non-dirty memory
- * @ndi: pointer to the opaque NotDirtyInfo struct which was initialized
- * by memory_not_dirty_write_prepare().
- */
-void memory_notdirty_write_complete(NotDirtyInfo *ndi);
-
 #endif
 #endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "qemu/atomic.h"
 #include "qemu/atomic128.h"
+#include "translate-all.h"
 
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
     return qemu_ram_addr_from_host_nofail(p);
 }
 
+static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+{
+    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
+
+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+
+    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
+        struct page_collection *pages
+            = page_collection_lock(ram_addr, ram_addr + size);
+
+        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
+        cpu->mem_io_pc = retaddr;
+
+        tb_invalidate_phys_page_fast(pages, ram_addr, size);
+        page_collection_unlock(pages);
+    }
+
+    /*
+     * Set both VGA and migration bits for simplicity and to remove
+     * the notdirty callback faster.
+     */
+    cpu_physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
+
+    /* We remove the notdirty callback only if the code has been flushed. */
+    if (!cpu_physical_memory_is_clean(ram_addr)) {
+        trace_memory_notdirty_set_dirty(mem_vaddr);
+        tlb_set_dirty(cpu, mem_vaddr);
+    }
+}
+
 /*
  * Probe for whether the specified guest access is permitted. If it is not
  * permitted then an exception will be taken in the same way as if this
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
 /* Probe for a read-modify-write atomic operation.  Do not allow unaligned
  * operations, or io operations to proceed.  Return the host address.  */
 static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               TCGMemOpIdx oi, uintptr_t retaddr,
-                               NotDirtyInfo *ndi)
+                               TCGMemOpIdx oi, uintptr_t retaddr)
 {
     size_t mmu_idx = get_mmuidx(oi);
     uintptr_t index = tlb_index(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
     hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
 
-    ndi->active = false;
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
-        ndi->active = true;
-        memory_notdirty_write_prepare(ndi, env_cpu(env), addr,
-                                      qemu_ram_addr_from_host_nofail(hostaddr),
-                                      1 << s_bits);
+        notdirty_write(env_cpu(env), addr, 1 << s_bits,
+                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
     }
 
     return hostaddr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             return;
         }
 
-        haddr = (void *)((uintptr_t)addr + entry->addend);
-
         /* Handle clean RAM pages.  */
         if (tlb_addr & TLB_NOTDIRTY) {
-            NotDirtyInfo ndi;
-
-            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
-            env_cpu(env)->mem_io_pc = retaddr;
-
-            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
-                                          addr + iotlbentry->addr, size);
-
-            if (unlikely(need_swap)) {
-                store_memop(haddr, val, op ^ MO_BSWAP);
-            } else {
-                store_memop(haddr, val, op);
-            }
-
-            memory_notdirty_write_complete(&ndi);
-            return;
+            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
         }
 
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
         /*
          * Keep these two store_memop separate to ensure that the compiler
          * is able to fold the entire function to a single instruction.
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
 #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
 #define ATOMIC_NAME(X) \
     HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
-#define ATOMIC_MMU_DECLS NotDirtyInfo ndi
-#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr, &ndi)
-#define ATOMIC_MMU_CLEANUP                              \
-    do {                                                \
-        if (unlikely(ndi.active)) {                     \
-            memory_notdirty_write_complete(&ndi);       \
-        }                                               \
-    } while (0)
+#define ATOMIC_MMU_DECLS
+#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
+#define ATOMIC_MMU_CLEANUP
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
 #undef ATOMIC_MMU_LOOKUP
 #define EXTRA_ARGS         , TCGMemOpIdx oi
 #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC(), &ndi)
+#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
-/* Called within RCU critical section. */
-void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
-                          CPUState *cpu,
-                          vaddr mem_vaddr,
-                          ram_addr_t ram_addr,
-                          unsigned size)
-{
-    ndi->cpu = cpu;
-    ndi->ram_addr = ram_addr;
-    ndi->mem_vaddr = mem_vaddr;
-    ndi->size = size;
-    ndi->pages = NULL;
-
-    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
-
-    assert(tcg_enabled());
-    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
-        ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
-        tb_invalidate_phys_page_fast(ndi->pages, ram_addr, size);
-    }
-}
-
-/* Called within RCU critical section. */
-void memory_notdirty_write_complete(NotDirtyInfo *ndi)
-{
-    if (ndi->pages) {
-        assert(tcg_enabled());
-        page_collection_unlock(ndi->pages);
-        ndi->pages = NULL;
-    }
-
-    /* Set both VGA and migration bits for simplicity and to remove
-     * the notdirty callback faster.
-     */
-    cpu_physical_memory_set_dirty_range(ndi->ram_addr, ndi->size,
-                                        DIRTY_CLIENTS_NOCODE);
-    /* we remove the notdirty callback only if the code has been
-       flushed */
-    if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
-        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
-        tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
-    }
-}
-
 /* Generate a debug exception if a watchpoint has been hit.  */
 void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                           MemTxAttrs attrs, int flags, uintptr_t ra)
-- 
2.17.1

We can use notdirty_write for the write and return a valid host
pointer for this case.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
         return NULL;
     }
 
-    /* Handle watchpoints.  */
-    if (tlb_addr & TLB_WATCHPOINT) {
-        cpu_check_watchpoint(env_cpu(env), addr, size,
-                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
-                             wp_access, retaddr);
-    }
+    if (unlikely(tlb_addr & TLB_FLAGS_MASK)) {
+        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 
-    /* Reject I/O access, or other required slow-path.  */
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
-        return NULL;
+        /* Reject I/O access, or other required slow-path.  */
+        if (tlb_addr & (TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
+            return NULL;
+        }
+
+        /* Handle watchpoints.  */
+        if (tlb_addr & TLB_WATCHPOINT) {
+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                                 iotlbentry->attrs, wp_access, retaddr);
+        }
+
+        /* Handle clean RAM pages.  */
+        if (tlb_addr & TLB_NOTDIRTY) {
+            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
+        }
     }
 
     return (void *)((uintptr_t)addr + entry->addend);
-- 
2.17.1

With the merge of notdirty handling into store_helper,
the last user of cpu->mem_io_vaddr was removed.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 2 --
 accel/tcg/cputlb.c    | 2 --
 hw/core/cpu.c         | 1 -
 3 files changed, 5 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
  * @next_cpu: Next CPU sharing TB cache.
  * @opaque: User data.
  * @mem_io_pc: Host Program Counter at which the memory was accessed.
- * @mem_io_vaddr: Target virtual address at which the memory was accessed.
  * @kvm_fd: vCPU file descriptor for KVM.
  * @work_mutex: Lock to prevent multiple access to queued_work_*.
  * @queued_work_first: First asynchronous work pending.
@@ -XXX,XX +XXX,XX @@ struct CPUState {
      * we store some rarely used information in the CPU context.
      */
     uintptr_t mem_io_pc;
-    vaddr mem_io_vaddr;
     /*
      * This is only needed for the legacy cpu_unassigned_access() hook;
      * when all targets using it have been converted to use
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         cpu_io_recompile(cpu, retaddr);
     }
 
-    cpu->mem_io_vaddr = addr;
     cpu->mem_io_access_type = access_type;
 
     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
-    cpu->mem_io_vaddr = addr;
     cpu->mem_io_pc = retaddr;
 
     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(CPUState *cpu)
     cpu->interrupt_request = 0;
     cpu->halted = 0;
     cpu->mem_io_pc = 0;
-    cpu->mem_io_vaddr = 0;
     cpu->icount_extra = 0;
     atomic_set(&cpu->icount_decr_ptr->u32, 0);
     cpu->can_do_io = 1;
-- 
2.17.1

All callers pass false to this argument.  Remove it and pass the
constant on to tb_invalidate_phys_page_range__locked.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h | 3 +--
 accel/tcg/translate-all.c | 6 ++----
 exec.c                    | 4 ++--
 3 files changed, 5 insertions(+), 8 deletions(-)

Rather than rely on cpu->mem_io_pc, pass retaddr down directly.

Within tb_invalidate_phys_page_range__locked, the is_cpu_write_access
parameter is non-zero exactly when retaddr would be non-zero, so that
is a simple replacement.

Recognize that current_tb_not_found is true only when mem_io_pc
(and now retaddr) are also non-zero, so remove a redundant test.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h |  3 ++-
 accel/tcg/cputlb.c        |  6 +-----
 accel/tcg/translate-all.c | 39 +++++++++++++++++++--------------------
 3 files changed, 22 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
                                              tb_page_addr_t end);
 void page_collection_unlock(struct page_collection *set);
 void tb_invalidate_phys_page_fast(struct page_collection *pages,
-                                  tb_page_addr_t start, int len);
+                                  tb_page_addr_t start, int len,
+                                  uintptr_t retaddr);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
         struct page_collection *pages
             = page_collection_lock(ram_addr, ram_addr + size);
-
-        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
-        cpu->mem_io_pc = retaddr;
-
-        tb_invalidate_phys_page_fast(pages, ram_addr, size);
+        tb_invalidate_phys_page_fast(pages, ram_addr, size, retaddr);
         page_collection_unlock(pages);
     }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void
 tb_invalidate_phys_page_range__locked(struct page_collection *pages,
                                       PageDesc *p, tb_page_addr_t start,
                                       tb_page_addr_t end,
-                                      int is_cpu_write_access)
+                                      uintptr_t retaddr)
 {
     TranslationBlock *tb;
     tb_page_addr_t tb_start, tb_end;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
 #ifdef TARGET_HAS_PRECISE_SMC
     CPUState *cpu = current_cpu;
     CPUArchState *env = NULL;
-    int current_tb_not_found = is_cpu_write_access;
+    bool current_tb_not_found = retaddr != 0;
+    bool current_tb_modified = false;
     TranslationBlock *current_tb = NULL;
-    int current_tb_modified = 0;
     target_ulong current_pc = 0;
     target_ulong current_cs_base = 0;
     uint32_t current_flags = 0;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
         if (!(tb_end <= start || tb_start >= end)) {
 #ifdef TARGET_HAS_PRECISE_SMC
             if (current_tb_not_found) {
-                current_tb_not_found = 0;
-                current_tb = NULL;
-                if (cpu->mem_io_pc) {
-                    /* now we have a real cpu fault */
-                    current_tb = tcg_tb_lookup(cpu->mem_io_pc);
-                }
+                current_tb_not_found = false;
+                /* now we have a real cpu fault */
+                current_tb = tcg_tb_lookup(retaddr);
             }
             if (current_tb == tb &&
                 (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
-                /* If we are modifying the current TB, we must stop
-                its execution. We could be more precise by checking
-                that the modification is after the current PC, but it
-                would require a specialized function to partially
-                restore the CPU state */
-
-                current_tb_modified = 1;
-                cpu_restore_state_from_tb(cpu, current_tb,
-                                          cpu->mem_io_pc, true);
+                /*
+                 * If we are modifying the current TB, we must stop
+                 * its execution. We could be more precise by checking
+                 * that the modification is after the current PC, but it
+                 * would require a specialized function to partially
+                 * restore the CPU state.
+                 */
+                current_tb_modified = true;
+                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
                 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                      &current_flags);
             }
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(target_ulong start, target_ulong end)
  * Call with all @pages in the range [@start, @start + len[ locked.
  */
 void tb_invalidate_phys_page_fast(struct page_collection *pages,
-                                  tb_page_addr_t start, int len)
+                                  tb_page_addr_t start, int len,
+                                  uintptr_t retaddr)
 {
     PageDesc *p;
 
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
         }
     } else {
     do_invalidate:
-        tb_invalidate_phys_page_range__locked(pages, p, start, start + len, 1);
+        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
+                                              retaddr);
     }
 }
 #else
-- 
2.17.1

Fixes the previous TLB_WATCHPOINT patches because we are currently
failing to set cpu->mem_io_pc with the call to cpu_check_watchpoint.
Pass down the retaddr directly because it's readily available.

Fixes: 50b107c5d61
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h | 2 +-
 accel/tcg/translate-all.c | 6 +++---
 exec.c                    | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
                                   tb_page_addr_t start, int len,
                                   uintptr_t retaddr);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
-void tb_check_watchpoint(CPUState *cpu);
+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 
 #ifdef CONFIG_USER_ONLY
 int page_unprotect(target_ulong address, uintptr_t pc);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static bool tb_invalidate_phys_page(tb_page_addr_t addr, uintptr_t pc)
 #endif
 
 /* user-mode: call with mmap_lock held */
-void tb_check_watchpoint(CPUState *cpu)
+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
 {
     TranslationBlock *tb;
 
     assert_memory_lock();
 
-    tb = tcg_tb_lookup(cpu->mem_io_pc);
+    tb = tcg_tb_lookup(retaddr);
     if (tb) {
         /* We can use retranslation to find the PC.  */
-        cpu_restore_state_from_tb(cpu, tb, cpu->mem_io_pc, true);
+        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
         tb_phys_invalidate(tb, -1);
     } else {
         /* The exception probably happened in a helper.  The CPU state should
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                 cpu->watchpoint_hit = wp;
 
                 mmap_lock();
-                tb_check_watchpoint(cpu);
+                tb_check_watchpoint(cpu, ra);
                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                     cpu->exception_index = EXCP_DEBUG;
                     mmap_unlock();
-- 
2.17.1

The following changes since commit 6587b0c1331d427b0939c37e763842550ed581db:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2021-10-15' into staging (2021-10-15 14:16:28 -0700)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20211016

for you to fetch changes up to 995b87dedc78b0467f5f18bbc3546072ba97516a:

Revert "cpu: Move cpu_common_props to hw/core/cpu.c" (2021-10-15 16:39:15 -0700)

----------------------------------------------------------------
Move gdb singlestep to generic code
Fix cpu_common_props

----------------------------------------------------------------
Richard Henderson (24):
      accel/tcg: Handle gdb singlestep in cpu_tb_exec
      target/alpha: Drop checks for singlestep_enabled
      target/avr: Drop checks for singlestep_enabled
      target/cris: Drop checks for singlestep_enabled
      target/hexagon: Drop checks for singlestep_enabled
      target/arm: Drop checks for singlestep_enabled
      target/hppa: Drop checks for singlestep_enabled
      target/i386: Check CF_NO_GOTO_TB for dc->jmp_opt
      target/i386: Drop check for singlestep_enabled
      target/m68k: Drop checks for singlestep_enabled
      target/microblaze: Check CF_NO_GOTO_TB for DISAS_JUMP
      target/microblaze: Drop checks for singlestep_enabled
      target/mips: Fix single stepping
      target/mips: Drop exit checks for singlestep_enabled
      target/openrisc: Drop checks for singlestep_enabled
      target/ppc: Drop exit checks for singlestep_enabled
      target/riscv: Remove dead code after exception
      target/riscv: Remove exit_tb and lookup_and_goto_ptr
      target/rx: Drop checks for singlestep_enabled
      target/s390x: Drop check for singlestep_enabled
      target/sh4: Drop check for singlestep_enabled
      target/tricore: Drop check for singlestep_enabled
      target/xtensa: Drop check for singlestep_enabled
      Revert "cpu: Move cpu_common_props to hw/core/cpu.c"

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/translate.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static void alpha_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         tcg_gen_movi_i64(cpu_pc, ctx->base.pc_next);
         /* FALLTHRU */
     case DISAS_PC_UPDATED:
-        if (!ctx->base.singlestep_enabled) {
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        }
-        /* FALLTHRU */
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_PC_UPDATED_NOCHAIN:
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG, 0);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.

Tested-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/translate.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
     ctx->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        if (!ctx->base.singlestep_enabled) {
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        }
-        /* fall through */
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_EXIT:
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/translate.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_end_tb(DisasContext *ctx)
 {
     gen_exec_counters(ctx);
     tcg_gen_mov_tl(hex_gpr[HEX_REG_PC], hex_next_PC);
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_raw(EXCP_DEBUG);
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static void hexagon_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_TOO_MANY:
         gen_exec_counters(ctx);
         tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], ctx->base.pc_next);
-        if (ctx->base.singlestep_enabled) {
-            gen_exception_raw(EXCP_DEBUG);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     case DISAS_NORETURN:
         break;
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/translate-a64.c | 10 ++--------
 target/arm/translate.c     | 36 ++++++------------------------------
 2 files changed, 8 insertions(+), 38 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
         gen_a64_set_pc_im(dest);
         if (s->ss_active) {
             gen_step_complete_exception(s);
-        } else if (s->base.singlestep_enabled) {
-            gen_exception_internal(EXCP_DEBUG);
         } else {
             tcg_gen_lookup_and_goto_ptr();
             s->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    if (unlikely(dc->base.singlestep_enabled || dc->ss_active)) {
+    if (unlikely(dc->ss_active)) {
         /* Note that this means single stepping WFI doesn't halt the CPU.
          * For conditional branch insns this is harmless unreachable code as
          * gen_goto_tb() has already handled emitting the debug exception
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             /* fall through */
         case DISAS_EXIT:
         case DISAS_JUMP:
-            if (dc->base.singlestep_enabled) {
-                gen_exception_internal(EXCP_DEBUG);
-            } else {
-                gen_step_complete_exception(dc);
-            }
+            gen_step_complete_exception(dc);
             break;
         case DISAS_NORETURN:
             break;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
     tcg_temp_free_i32(tcg_excp);
 }
 
-static void gen_step_complete_exception(DisasContext *s)
+static void gen_singlestep_exception(DisasContext *s)
 {
     /* We just completed step of an insn. Move from Active-not-pending
      * to Active-pending, and then also take the swstep exception.
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_singlestep_exception(DisasContext *s)
-{
-    /* Generate the right kind of exception for singlestep, which is
-     * either the architectural singlestep or EXCP_DEBUG for QEMU's
-     * gdb singlestepping.
-     */
-    if (s->ss_active) {
-        gen_step_complete_exception(s);
-    } else {
-        gen_exception_internal(EXCP_DEBUG);
-    }
-}
-
-static inline bool is_singlestepping(DisasContext *s)
-{
-    /* Return true if we are singlestepping either because of
-     * architectural singlestep or QEMU gdbstub singlestep. This does
-     * not include the command line '-singlestep' mode which is rather
-     * misnamed as it only means "one instruction per TB" and doesn't
-     * affect the code we generate.
-     */
-    return s->base.singlestep_enabled || s->ss_active;
-}
-
 void clear_eci_state(DisasContext *s)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
     /* Is the new PC value in the magic range indicating exception return? */
     tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
     /* No: end the TB as we would for a DISAS_JMP */
-    if (is_singlestepping(s)) {
+    if (s->ss_active) {
         gen_singlestep_exception(s);
     } else {
         tcg_gen_exit_tb(NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
 /* Jump, specifying which TB number to use if we gen_goto_tb() */
 static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
 {
-    if (unlikely(is_singlestepping(s))) {
+    if (unlikely(s->ss_active)) {
         /* An indirect jump so that we still trigger the debug exception.  */
         gen_set_pc_im(s, dest);
         s->base.is_jmp = DISAS_JUMP;
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
 
     /* If architectural single step active, limit to 1.  */
-    if (is_singlestepping(dc)) {
+    if (dc->ss_active) {
         dc->base.max_insns = 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          * insn codepath itself.
          */
         gen_bx_excret_final_code(dc);
-    } else if (unlikely(is_singlestepping(dc))) {
+    } else if (unlikely(dc->ss_active)) {
         /* Unconditional and "condition passed" instruction codepath. */
         switch (dc->base.is_jmp) {
         case DISAS_SWI:
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         /* "Condition failed" instruction codepath for the branch/trap insn */
         gen_set_label(dc->condlabel);
         gen_set_condexec(dc);
-        if (unlikely(is_singlestepping(dc))) {
+        if (unlikely(dc->ss_active)) {
             gen_set_pc_im(dc, dc->base.pc_next);
             gen_singlestep_exception(dc);
         } else {
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/translate.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int which,
     } else {
         copy_iaoq_entry(cpu_iaoq_f, f, cpu_iaoq_b);
         copy_iaoq_entry(cpu_iaoq_b, b, ctx->iaoq_n_var);
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_rfi(DisasContext *ctx, bool rfi_r)
         gen_helper_rfi(cpu_env);
     }
     /* Exit the TB to recognize new interrupts.  */
-    if (ctx->base.singlestep_enabled) {
-        gen_excp_1(EXCP_DEBUG);
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
 
     return nullify_end(ctx);
@@ -XXX,XX +XXX,XX @@ static void hppa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         nullify_save(ctx);
         /* FALLTHRU */
     case DISAS_IAQ_N_UPDATED:
-        if (ctx->base.singlestep_enabled) {
-            gen_excp_1(EXCP_DEBUG);
-        } else if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
+        if (is_jmp != DISAS_IAQ_N_STALE_EXIT) {
             tcg_gen_lookup_and_goto_ptr();
+            break;
         }
         /* FALLTHRU */
     case DISAS_EXIT:
-- 
2.25.1

We were using singlestep_enabled as a proxy for whether
translator_use_goto_tb would always return false.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUX86State *env = cpu->env_ptr;
     uint32_t flags = dc->base.tb->flags;
+    uint32_t cflags = tb_cflags(dc->base.tb);
     int cpl = (flags >> HF_CPL_SHIFT) & 3;
     int iopl = (flags >> IOPL_SHIFT) & 3;
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     dc->cpuid_ext3_features = env->features[FEAT_8000_0001_ECX];
     dc->cpuid_7_0_ebx_features = env->features[FEAT_7_0_EBX];
     dc->cpuid_xsave_features = env->features[FEAT_XSAVE];
-    dc->jmp_opt = !(dc->base.singlestep_enabled ||
+    dc->jmp_opt = !((cflags & CF_NO_GOTO_TB) ||
                     (flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)));
     /*
      * If jmp_opt, we want to handle each string instruction individually.
      * For icount also disable repz optimization so that each iteration
      * is accounted separately.
      */
-    dc->repz_opt = !dc->jmp_opt && !(tb_cflags(dc->base.tb) & CF_USE_ICOUNT);
+    dc->repz_opt = !dc->jmp_opt && !(cflags & CF_USE_ICOUNT);
 
     dc->T0 = tcg_temp_new();
     dc->T1 = tcg_temp_new();
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/helper.h          | 1 -
 target/i386/tcg/misc_helper.c | 8 --------
 target/i386/tcg/translate.c   | 4 +---
 3 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/target/i386/helper.h b/target/i386/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/helper.h
+++ b/target/i386/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(syscall, void, env, int)
 DEF_HELPER_2(sysret, void, env, int)
 #endif
 DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
-DEF_HELPER_FLAGS_1(debug, TCG_CALL_NO_WG, noreturn, env)
 DEF_HELPER_1(reset_rf, void, env)
 DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
 DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/misc_helper.c
+++ b/target/i386/tcg/misc_helper.c
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_pause(CPUX86State *env, int next_eip_addend)
     do_pause(env);
 }
 
-void QEMU_NORETURN helper_debug(CPUX86State *env)
-{
-    CPUState *cs = env_cpu(env);
-
-    cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(cs);
-}
-
 uint64_t helper_rdpkru(CPUX86State *env, uint32_t ecx)
 {
     if ((env->cr[4] & CR4_PKE_MASK) == 0) {
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ do_gen_eob_worker(DisasContext *s, bool inhibit, bool recheck_tf, bool jr)
     if (s->base.tb->flags & HF_RF_MASK) {
         gen_helper_reset_rf(cpu_env);
     }
-    if (s->base.singlestep_enabled) {
-        gen_helper_debug(cpu_env);
-    } else if (recheck_tf) {
+    if (recheck_tf) {
         gen_helper_rechecking_single_step(cpu_env);
         tcg_gen_exit_tb(NULL, 0);
     } else if (s->flags & HF_TF_MASK) {
-- 
2.25.1

GDB single-stepping is now handled generically.

Acked-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/translate.c | 44 +++++++++--------------------------------
 1 file changed, 9 insertions(+), 35 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static void do_writebacks(DisasContext *s)
     }
 }
 
-static bool is_singlestepping(DisasContext *s)
-{
-    /*
-     * Return true if we are singlestepping either because of
-     * architectural singlestep or QEMU gdbstub singlestep. This does
-     * not include the command line '-singlestep' mode which is rather
-     * misnamed as it only means "one instruction per TB" and doesn't
-     * affect the code we generate.
-     */
-    return s->base.singlestep_enabled || s->ss_active;
-}
-
 /* is_jmp field values */
 #define DISAS_JUMP      DISAS_TARGET_0 /* only pc was modified dynamically */
 #define DISAS_EXIT      DISAS_TARGET_1 /* cpu state was modified dynamically */
@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *s, uint32_t dest, int nr)
     s->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_singlestep_exception(DisasContext *s)
-{
-    /*
-     * Generate the right kind of exception for singlestep, which is
-     * either the architectural singlestep or EXCP_DEBUG for QEMU's
-     * gdb singlestepping.
-     */
-    if (s->ss_active) {
-        gen_raise_exception(EXCP_TRACE);
-    } else {
-        gen_raise_exception(EXCP_DEBUG);
-    }
-}
-
 static inline void gen_addr_fault(DisasContext *s)
 {
     gen_exception(s, s->base.pc_next, EXCP_ADDRESS);
@@ -XXX,XX +XXX,XX @@ static void gen_exit_tb(DisasContext *s)
 /* Generate a jump to an immediate address.  */
 static void gen_jmp_tb(DisasContext *s, int n, uint32_t dest)
 {
-    if (unlikely(is_singlestepping(s))) {
+    if (unlikely(s->ss_active)) {
         update_cc_op(s);
         tcg_gen_movi_i32(QREG_PC, dest);
-        gen_singlestep_exception(s);
+        gen_raise_exception(EXCP_TRACE);
     } else if (translator_use_goto_tb(&s->base, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_i32(QREG_PC, dest);
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
 
     dc->ss_active = (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS);
     /* If architectural single step active, limit to 1 */
-    if (is_singlestepping(dc)) {
+    if (dc->ss_active) {
         dc->base.max_insns = 1;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         break;
     case DISAS_TOO_MANY:
         update_cc_op(dc);
-        if (is_singlestepping(dc)) {
+        if (dc->ss_active) {
             tcg_gen_movi_i32(QREG_PC, dc->pc);
-            gen_singlestep_exception(dc);
+            gen_raise_exception(EXCP_TRACE);
         } else {
             gen_jmp_tb(dc, 0, dc->pc);
         }
         break;
     case DISAS_JUMP:
         /* We updated CC_OP and PC in gen_jmp/gen_jmp_im.  */
-        if (is_singlestepping(dc)) {
-            gen_singlestep_exception(dc);
+        if (dc->ss_active) {
+            gen_raise_exception(EXCP_TRACE);
         } else {
             tcg_gen_lookup_and_goto_ptr();
         }
@@ -XXX,XX +XXX,XX @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
          * We updated CC_OP and PC in gen_exit_tb, but also modified
          * other state that may require returning to the main loop.
          */
-        if (is_singlestepping(dc)) {
-            gen_singlestep_exception(dc);
+        if (dc->ss_active) {
+            gen_raise_exception(EXCP_TRACE);
         } else {
             tcg_gen_exit_tb(NULL, 0);
         }
-- 
2.25.1

We were using singlestep_enabled as a proxy for whether
translator_use_goto_tb would always return false.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
         break;
 
     case DISAS_JUMP:
-        if (dc->jmp_dest != -1 && !cs->singlestep_enabled) {
+        if (dc->jmp_dest != -1 && !(tb_cflags(dc->base.tb) & CF_NO_GOTO_TB)) {
             /* Direct jump. */
             tcg_gen_discard_i32(cpu_btarget);
 
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
             return;
         }
 
-        /* Indirect jump (or direct jump w/ singlestep) */
+        /* Indirect jump (or direct jump w/ goto_tb disabled) */
         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
         tcg_gen_discard_i32(cpu_btarget);
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
 
 static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
 {
-    if (dc->base.singlestep_enabled) {
-        TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
-        tcg_gen_movi_i32(cpu_pc, dest);
-        gen_helper_raise_exception(cpu_env, tmp);
-        tcg_temp_free_i32(tmp);
-    } else if (translator_use_goto_tb(&dc->base, dest)) {
+    if (translator_use_goto_tb(&dc->base, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_exit_tb(dc->base.tb, n);
@@ -XXX,XX +XXX,XX @@ static void mb_tr_tb_stop(DisasContextBase *dcb, CPUState *cs)
         /* Indirect jump (or direct jump w/ goto_tb disabled) */
         tcg_gen_mov_i32(cpu_pc, cpu_btarget);
         tcg_gen_discard_i32(cpu_btarget);
-
-        if (unlikely(cs->singlestep_enabled)) {
-            gen_raise_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         return;
 
     default:
-- 
2.25.1

As per an ancient comment in mips_tr_translate_insn about the
expectations of gdb, when restarting the insn in a delay slot
we also re-execute the branch.  Which means that we are
expected to execute two insns in this case.

This has been broken since 8b86d6d2580, where we forced max_insns
to 1 while single-stepping.  This resulted in an exit from the
translator loop after the branch but before the delay slot is
translated.

Increase the max_insns to 2 for this case.  In addition, bypass
the end-of-page check, for when the branch itself ends the page.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/tcg/translate.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->default_tcg_memop_mask = (ctx->insn_flags & (ISA_MIPS_R6 |
                                   INSN_LOONGSON3A)) ? MO_UNALN : MO_ALIGN;
 
+    /*
+     * Execute a branch and its delay slot as a single instruction.
+     * This is what GDB expects and is consistent with what the
+     * hardware does (e.g. if a delay slot instruction faults, the
+     * reported PC is the PC of the branch).
+     */
+    if (ctx->base.singlestep_enabled && (ctx->hflags & MIPS_HFLAG_BMASK)) {
+        ctx->base.max_insns = 2;
+    }
+
     LOG_DISAS("\ntb %p idx %d hflags %04x\n", ctx->base.tb, ctx->mem_idx,
               ctx->hflags);
 }
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (ctx->base.is_jmp != DISAS_NEXT) {
         return;
     }
+
     /*
-     * Execute a branch and its delay slot as a single instruction.
-     * This is what GDB expects and is consistent with what the
-     * hardware does (e.g. if a delay slot instruction faults, the
-     * reported PC is the PC of the branch).
+     * End the TB on (most) page crossings.
+     * See mips_tr_init_disas_context about single-stepping a branch
+     * together with its delay slot.
      */
-    if (ctx->base.singlestep_enabled &&
-        (ctx->hflags & MIPS_HFLAG_BMASK) == 0) {
-        ctx->base.is_jmp = DISAS_TOO_MANY;
-    }
-    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE) {
+    if (ctx->base.pc_next - ctx->page_start >= TARGET_PAGE_SIZE
+        && !ctx->base.singlestep_enabled) {
         ctx->base.is_jmp = DISAS_TOO_MANY;
     }
 }
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/tcg/translate.c | 50 +++++++++++++------------------------
 1 file changed, 18 insertions(+), 32 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         gen_save_pc(dest);
-        if (ctx->base.singlestep_enabled) {
-            save_cpu_state(ctx, 0);
-            gen_helper_raise_exception_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_branch(DisasContext *ctx, int insn_bytes)
             } else {
                 tcg_gen_mov_tl(cpu_PC, btarget);
             }
-            if (ctx->base.singlestep_enabled) {
-                save_cpu_state(ctx, 0);
-                gen_helper_raise_exception_debug(cpu_env);
-            }
             tcg_gen_lookup_and_goto_ptr();
             break;
         default:
@@ -XXX,XX +XXX,XX @@ static void mips_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
-    if (ctx->base.singlestep_enabled && ctx->base.is_jmp != DISAS_NORETURN) {
-        save_cpu_state(ctx, ctx->base.is_jmp != DISAS_EXIT);
-        gen_helper_raise_exception_debug(cpu_env);
-    } else {
-        switch (ctx->base.is_jmp) {
-        case DISAS_STOP:
-            gen_save_pc(ctx->base.pc_next);
-            tcg_gen_lookup_and_goto_ptr();
-            break;
-        case DISAS_NEXT:
-        case DISAS_TOO_MANY:
-            save_cpu_state(ctx, 0);
-            gen_goto_tb(ctx, 0, ctx->base.pc_next);
-            break;
-        case DISAS_EXIT:
-            tcg_gen_exit_tb(NULL, 0);
-            break;
-        case DISAS_NORETURN:
-            break;
-        default:
-            g_assert_not_reached();
-        }
+    switch (ctx->base.is_jmp) {
+    case DISAS_STOP:
+        gen_save_pc(ctx->base.pc_next);
+        tcg_gen_lookup_and_goto_ptr();
+        break;
+    case DISAS_NEXT:
+    case DISAS_TOO_MANY:
+        save_cpu_state(ctx, 0);
+        gen_goto_tb(ctx, 0, ctx->base.pc_next);
+        break;
+    case DISAS_EXIT:
+        tcg_gen_exit_tb(NULL, 0);
+        break;
+    case DISAS_NORETURN:
+        break;
+    default:
+        g_assert_not_reached();
     }
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/translate.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             /* The jump destination is indirect/computed; use jmp_pc.  */
             tcg_gen_mov_tl(cpu_pc, jmp_pc);
             tcg_gen_discard_tl(jmp_pc);
-            if (unlikely(dc->base.singlestep_enabled)) {
-                gen_exception(dc, EXCP_DEBUG);
-            } else {
-                tcg_gen_lookup_and_goto_ptr();
-            }
+            tcg_gen_lookup_and_goto_ptr();
             break;
         }
         /* The jump destination is direct; use jmp_pc_imm.
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             break;
         }
         tcg_gen_movi_tl(cpu_pc, jmp_dest);
-        if (unlikely(dc->base.singlestep_enabled)) {
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         break;
 
     case DISAS_EXIT:
-        if (unlikely(dc->base.singlestep_enabled)) {
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

GDB single-stepping is now handled generically.
Reuse gen_debug_exception to handle architectural debug exceptions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/translate.c | 38 ++++++++------------------------------
 1 file changed, 8 insertions(+), 30 deletions(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@
 
 #define CPU_SINGLE_STEP 0x1
 #define CPU_BRANCH_STEP 0x2
-#define GDBSTUB_SINGLE_STEP 0x4
 
 /* Include definitions for instructions classes and implementations flags */
 /* #define PPC_DEBUG_DISAS */
@@ -XXX,XX +XXX,XX @@ static uint32_t gen_prep_dbgex(DisasContext *ctx)
 
 static void gen_debug_exception(DisasContext *ctx)
 {
-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
+    gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *ctx, target_ulong dest)
 
 static void gen_lookup_and_goto_ptr(DisasContext *ctx)
 {
-    int sse = ctx->singlestep_enabled;
-    if (unlikely(sse)) {
-        if (sse & GDBSTUB_SINGLE_STEP) {
-            gen_debug_exception(ctx);
-        } else if (sse & (CPU_SINGLE_STEP | CPU_BRANCH_STEP)) {
-            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+    if (unlikely(ctx->singlestep_enabled)) {
+        gen_debug_exception(ctx);
     } else {
         tcg_gen_lookup_and_goto_ptr();
     }
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->singlestep_enabled = 0;
     if ((hflags >> HFLAGS_SE) & 1) {
         ctx->singlestep_enabled |= CPU_SINGLE_STEP;
+        ctx->base.max_insns = 1;
     }
     if ((hflags >> HFLAGS_BE) & 1) {
         ctx->singlestep_enabled |= CPU_BRANCH_STEP;
     }
-    if (unlikely(ctx->base.singlestep_enabled)) {
-        ctx->singlestep_enabled |= GDBSTUB_SINGLE_STEP;
-    }
-
-    if (ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP)) {
-        ctx->base.max_insns = 1;
-    }
 }
 
 static void ppc_tr_tb_start(DisasContextBase *db, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     DisasJumpType is_jmp = ctx->base.is_jmp;
     target_ulong nip = ctx->base.pc_next;
-    int sse;
 
     if (is_jmp == DISAS_NORETURN) {
         /* We have already exited the TB. */
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     }
 
     /* Honor single stepping. */
-    sse = ctx->singlestep_enabled & (CPU_SINGLE_STEP | GDBSTUB_SINGLE_STEP);
-    if (unlikely(sse)) {
+    if (unlikely(ctx->singlestep_enabled & CPU_SINGLE_STEP)
+        && (nip <= 0x100 || nip > 0xf00)) {
         switch (is_jmp) {
         case DISAS_TOO_MANY:
         case DISAS_EXIT_UPDATE:
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
             g_assert_not_reached();
         }
 
-        if (sse & GDBSTUB_SINGLE_STEP) {
-            gen_debug_exception(ctx);
-            return;
-        }
-        /* else CPU_SINGLE_STEP... */
-        if (nip <= 0x100 || nip > 0xf00) {
-            gen_helper_raise_exception(cpu_env, tcg_constant_i32(gen_prep_dbgex(ctx)));
-            return;
-        }
+        gen_debug_exception(ctx);
+        return;
     }
 
     switch (is_jmp) {
-- 
2.25.1

We have already set DISAS_NORETURN in generate_exception,
which makes the exit_tb unreachable.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ecall(DisasContext *ctx, arg_ecall *a)
 {
     /* always generates U-level ECALL, fixed in do_interrupt handler */
     generate_exception(ctx, RISCV_EXCP_U_ECALL);
-    exit_tb(ctx); /* no chaining */
-    ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
         post   = opcode_at(&ctx->base, post_addr);
     }
 
-    if  (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
+    if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
     } else {
         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
     }
-    exit_tb(ctx); /* no chaining */
-    ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically, which means
we don't need to do anything in the wrappers.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c                      | 27 +------------------
 .../riscv/insn_trans/trans_privileged.c.inc   |  4 +--
 target/riscv/insn_trans/trans_rvi.c.inc       |  8 +++---
 target/riscv/insn_trans/trans_rvv.c.inc       |  2 +-
 4 files changed, 7 insertions(+), 34 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void generate_exception_mtval(DisasContext *ctx, int excp)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_exception_debug(void)
-{
-    gen_helper_raise_exception(cpu_env, tcg_constant_i32(EXCP_DEBUG));
-}
-
-/* Wrapper around tcg_gen_exit_tb that handles single stepping */
-static void exit_tb(DisasContext *ctx)
-{
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_debug();
-    } else {
-        tcg_gen_exit_tb(NULL, 0);
-    }
-}
-
-/* Wrapper around tcg_gen_lookup_and_goto_ptr that handles single stepping */
-static void lookup_and_goto_ptr(DisasContext *ctx)
-{
-    if (ctx->base.singlestep_enabled) {
-        gen_exception_debug();
-    } else {
-        tcg_gen_lookup_and_goto_ptr();
-    }
-}
-
 static void gen_exception_illegal(DisasContext *ctx)
 {
     generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         tcg_gen_movi_tl(cpu_pc, dest);
-        lookup_and_goto_ptr(ctx);
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
 
     if (has_ext(ctx, RVS)) {
         gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
-        exit_tb(ctx); /* no chaining */
+        tcg_gen_exit_tb(NULL, 0); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
     } else {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 #ifndef CONFIG_USER_ONLY
     tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
     gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
-    exit_tb(ctx); /* no chaining */
+    tcg_gen_exit_tb(NULL, 0); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 #else
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     if (a->rd != 0) {
         tcg_gen_movi_tl(cpu_gpr[a->rd], ctx->pc_succ_insn);
     }
-
-    /* No chaining with JALR. */
-    lookup_and_goto_ptr(ctx);
+    tcg_gen_lookup_and_goto_ptr();
 
     if (misaligned) {
         gen_set_label(misaligned);
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
      * however we need to end the translation block
      */
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    exit_tb(ctx);
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
 {
     /* We may have changed important cpu state -- exit to main loop. */
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    exit_tb(ctx);
+    tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsetvl(DisasContext *ctx, arg_vsetvl *a)
     gen_set_gpr(ctx, a->rd, dst);
 
     tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-    lookup_and_goto_ptr(ctx);
+    tcg_gen_lookup_and_goto_ptr();
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/rx/helper.h    |  1 -
 target/rx/op_helper.c |  8 --------
 target/rx/translate.c | 12 ++----------
 3 files changed, 2 insertions(+), 19 deletions(-)

diff --git a/target/rx/helper.h b/target/rx/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/helper.h
+++ b/target/rx/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_access_fault, noreturn, env)
 DEF_HELPER_1(raise_privilege_violation, noreturn, env)
 DEF_HELPER_1(wait, noreturn, env)
-DEF_HELPER_1(debug, noreturn, env)
 DEF_HELPER_2(rxint, noreturn, env, i32)
 DEF_HELPER_1(rxbrk, noreturn, env)
 DEF_HELPER_FLAGS_3(fadd, TCG_CALL_NO_WG, f32, env, f32, f32)
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN helper_wait(CPURXState *env)
     raise_exception(env, EXCP_HLT, 0);
 }
 
-void QEMU_NORETURN helper_debug(CPURXState *env)
-{
-    CPUState *cs = env_cpu(env);
-
-    cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(cs);
-}
-
 void QEMU_NORETURN helper_rxint(CPURXState *env, uint32_t vec)
 {
     raise_exception(env, 0x100 + vec, 0);
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
         tcg_gen_exit_tb(dc->base.tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (dc->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
     dc->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void rx_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         gen_goto_tb(ctx, 0, dcbase->pc_next);
         break;
     case DISAS_JUMP:
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
         break;
     case DISAS_UPDATE:
         tcg_gen_movi_i32(cpu_pc, ctx->base.pc_next);
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ struct DisasContext {
     uint64_t pc_tmp;
     uint32_t ilen;
     enum cc_op cc_op;
-    bool do_debug;
 };
 
 /* Information carried about a condition to be evaluated.  */
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 
     dc->cc_op = CC_OP_DYNAMIC;
     dc->ex_value = dc->base.tb->cs_base;
-    dc->do_debug = dc->base.singlestep_enabled;
 }
 
 static void s390x_tr_tb_start(DisasContextBase *db, CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         /* FALLTHRU */
     case DISAS_PC_CC_UPDATED:
         /* Exit the TB, either by raising a debug exception or by return.  */
-        if (dc->do_debug) {
-            gen_exception(EXCP_DEBUG);
-        } else if ((dc->base.tb->flags & FLAG_MASK_PER) ||
-                   dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
+        if ((dc->base.tb->flags & FLAG_MASK_PER) ||
+             dc->base.is_jmp == DISAS_PC_STALE_NOCHAIN) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/helper.h    |  1 -
 target/sh4/op_helper.c |  5 -----
 target/sh4/translate.c | 14 +++-----------
 3 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/target/sh4/helper.h b/target/sh4/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/helper.h
+++ b/target/sh4/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(raise_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_slot_illegal_instruction, noreturn, env)
 DEF_HELPER_1(raise_fpu_disable, noreturn, env)
 DEF_HELPER_1(raise_slot_fpu_disable, noreturn, env)
-DEF_HELPER_1(debug, noreturn, env)
 DEF_HELPER_1(sleep, noreturn, env)
 DEF_HELPER_2(trapa, noreturn, env, i32)
 DEF_HELPER_1(exclusive, noreturn, env)
diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/op_helper.c
+++ b/target/sh4/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_raise_slot_fpu_disable(CPUSH4State *env)
     raise_exception(env, 0x820, 0);
 }
 
-void helper_debug(CPUSH4State *env)
-{
-    raise_exception(env, EXCP_DEBUG, 0);
-}
-
 void helper_sleep(CPUSH4State *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else if (use_exit_tb(ctx)) {
+        if (use_exit_tb(ctx)) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
@@ -XXX,XX +XXX,XX @@ static void gen_jump(DisasContext * ctx)
 	   delayed jump as immediate jump are conditinal jumps */
 	tcg_gen_mov_i32(cpu_pc, cpu_delayed_pc);
         tcg_gen_discard_i32(cpu_delayed_pc);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else if (use_exit_tb(ctx)) {
+        if (use_exit_tb(ctx)) {
             tcg_gen_exit_tb(NULL, 0);
         } else {
             tcg_gen_lookup_and_goto_ptr();
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     switch (ctx->base.is_jmp) {
     case DISAS_STOP:
         gen_save_cpu_state(ctx, true);
-        if (ctx->base.singlestep_enabled) {
-            gen_helper_debug(cpu_env);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
         break;
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
-- 
2.25.1

GDB single-stepping is now handled generically.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/helper.h    |  1 -
 target/tricore/op_helper.c |  7 -------
 target/tricore/translate.c | 14 +-------------
 3 files changed, 1 insertion(+), 21 deletions(-)

diff --git a/target/tricore/helper.h b/target/tricore/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/helper.h
+++ b/target/tricore/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(psw_write, void, env, i32)
 DEF_HELPER_1(psw_read, i32, env)
 /* Exceptions */
 DEF_HELPER_3(raise_exception_sync, noreturn, env, i32, i32)
-DEF_HELPER_2(qemu_excp, noreturn, env, i32)
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_exception_sync_helper(CPUTriCoreState *env, uint32_t class,
     raise_exception_sync_internal(env, class, tin, pc, 0);
 }
 
-void helper_qemu_excp(CPUTriCoreState *env, uint32_t excp)
-{
-    CPUState *cs = env_cpu(env);
-    cs->exception_index = excp;
-    cpu_loop_exit(cs);
-}
-
 /* Addressing mode helper */
 
 static uint16_t reverse16(uint16_t val)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_pc(target_ulong pc)
     tcg_gen_movi_tl(cpu_PC, pc);
 }
 
-static void generate_qemu_excp(DisasContext *ctx, int excp)
-{
-    TCGv_i32 tmp = tcg_const_i32(excp);
-    gen_helper_qemu_excp(cpu_env, tmp);
-    ctx->base.is_jmp = DISAS_NORETURN;
-    tcg_temp_free(tmp);
-}
-
 static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         gen_save_pc(dest);
-        if (ctx->base.singlestep_enabled) {
-            generate_qemu_excp(ctx, EXCP_DEBUG);
-        } else {
-            tcg_gen_lookup_and_goto_ptr();
-        }
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 
-- 
2.25.1

GDB single-stepping is now handled generically.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/xtensa/translate.c | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jump_slot(DisasContext *dc, TCGv dest, int slot)
     if (dc->icount) {
         tcg_gen_mov_i32(cpu_SR[ICOUNT], dc->next_icount);
     }
-    if (dc->base.singlestep_enabled) {
-        gen_exception(dc, EXCP_DEBUG);
+    if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
+        slot = gen_postprocess(dc, slot);
+    }
+    if (slot >= 0) {
+        tcg_gen_goto_tb(slot);
+        tcg_gen_exit_tb(dc->base.tb, slot);
     } else {
-        if (dc->op_flags & XTENSA_OP_POSTPROCESS) {
-            slot = gen_postprocess(dc, slot);
-        }
-        if (slot >= 0) {
-            tcg_gen_goto_tb(slot);
-            tcg_gen_exit_tb(dc->base.tb, slot);
-        } else {
-            tcg_gen_exit_tb(NULL, 0);
-        }
+        tcg_gen_exit_tb(NULL, 0);
     }
     dc->base.is_jmp = DISAS_NORETURN;
 }
@@ -XXX,XX +XXX,XX @@ static void xtensa_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_NORETURN:
         break;
     case DISAS_TOO_MANY:
-        if (dc->base.singlestep_enabled) {
-            tcg_gen_movi_i32(cpu_pc, dc->pc);
-            gen_exception(dc, EXCP_DEBUG);
-        } else {
-            gen_jumpi(dc, dc->pc, 0);
-        }
+        gen_jumpi(dc, dc->pc, 0);
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

This reverts commit 1b36e4f5a5de585210ea95f2257839c2312be28f.

Despite a comment saying why cpu_common_props cannot be placed in
a file that is compiled once, it was moved anyway.  Revert that.

Since then, Property is not defined in hw/core/cpu.h, so it is now
easier to declare a function to install the properties rather than
the Property array itself.

Cc: Eduardo Habkost <ehabkost@redhat.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  1 +
 cpu.c                 | 21 +++++++++++++++++++++
 hw/core/cpu-common.c  | 17 +----------------
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
 
 /* $(top_srcdir)/cpu.c */
+void cpu_class_init_props(DeviceClass *dc);
 void cpu_exec_initfn(CPUState *cpu);
 void cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
     cpu_list_remove(cpu);
 }
 
+static Property cpu_common_props[] = {
+#ifndef CONFIG_USER_ONLY
+    /*
+     * Create a memory property for softmmu CPU object,
+     * so users can wire up its memory. (This can't go in hw/core/cpu.c
+     * because that file is compiled only once for both user-mode
+     * and system builds.) The default if no link is set up is to use
+     * the system address space.
+     */
+    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+#endif
+    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+void cpu_class_init_props(DeviceClass *dc)
+{
+    device_class_set_props(dc, cpu_common_props);
+}
+
 void cpu_exec_initfn(CPUState *cpu)
 {
     cpu->as = NULL;
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static Property cpu_common_props[] = {
-#ifndef CONFIG_USER_ONLY
-    /* Create a memory property for softmmu CPU object,
-     * so users can wire up its memory. (This can't go in hw/core/cpu.c
-     * because that file is compiled only once for both user-mode
-     * and system builds.) The default if no link is set up is to use
-     * the system address space.
-     */
-    DEFINE_PROP_LINK("memory", CPUState, memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-#endif
-    DEFINE_PROP_BOOL("start-powered-off", CPUState, start_powered_off, false),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
     dc->reset = cpu_common_reset;
-    device_class_set_props(dc, cpu_common_props);
+    cpu_class_init_props(dc);
     /*
      * Reason: CPUs still need special care by board code: wiring up
      * IRQs, adding reset handlers, halting non-first CPUs, ...
-- 
2.25.1