Series comparison

-[PULL 00/16] tcg patch queue
+[PULL 00/20] tcg patch queue
-This is v4 of my notdirty + rom patch set with two suggested name
+The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:
 changes (qemu_build_not_reached, TLB_DISCARD_WRITE) from David and Alex.
+  Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)
 r~
 The following changes since commit 240ab11fb72049d6373cbbec8d788f8e411a00bc:
   Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20190924' into staging (2019-09-24 15:36:31 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20190925
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901
-for you to fetch changes up to ae57db63acf5a0399232f852acc5c1d83ef63400:
+for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:
-  cputlb: Pass retaddr to tb_check_watchpoint (2019-09-25 10:56:28 -0700)
+  target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)
 ----------------------------------------------------------------
-Fixes for TLB_BSWAP
+Respect PROT_EXEC in user-only mode.
-Coversion of NOTDIRTY and ROM handling to cputlb
+Fix s390x, i386 and riscv for translations crossing a page.
 Followup cleanups to cputlb
 ----------------------------------------------------------------
+Ilya Leoshkevich (4):
+      linux-user: Clear translations on mprotect()
+      accel/tcg: Introduce is_same_page()
+      target/s390x: Make translator stop before the end of a page
+      target/i386: Make translator stop before the end of a page
 Richard Henderson (16):
-      exec: Use TARGET_PAGE_BITS_MIN for TLB flags
+      linux-user/arm: Mark the commpage executable
-      cputlb: Disable __always_inline__ without optimization
+      linux-user/hppa: Allocate page zero as a commpage
-      qemu/compiler.h: Add qemu_build_not_reached
+      linux-user/x86_64: Allocate vsyscall page as a commpage
-      cputlb: Use qemu_build_not_reached in load/store_helpers
+      linux-user: Honor PT_GNU_STACK
-      cputlb: Split out load/store_memop
+      tests/tcg/i386: Move smc_code2 to an executable section
-      cputlb: Introduce TLB_BSWAP
+      accel/tcg: Properly implement get_page_addr_code for user-only
-      exec: Adjust notdirty tracing
+      accel/tcg: Unlock mmap_lock after longjmp
-      cputlb: Move ROM handling from I/O path to TLB path
+      accel/tcg: Make tb_htable_lookup static
-      cputlb: Move NOTDIRTY handling from I/O path to TLB path
+      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
-      cputlb: Partially inline memory_region_section_get_iotlb
+      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
-      cputlb: Merge and move memory_notdirty_write_{prepare,complete}
+      accel/tcg: Document the faulting lookup in tb_lookup_cmp
-      cputlb: Handle TLB_NOTDIRTY in probe_access
+      accel/tcg: Remove translator_ldsw
-      cputlb: Remove cpu->mem_io_vaddr
+      accel/tcg: Add pc and host_pc params to gen_intermediate_code
-      cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
+      accel/tcg: Add fast path for translator_ld*
-      cputlb: Pass retaddr to tb_invalidate_phys_page_fast
+      target/riscv: Add MAX_INSN_LEN and insn_len
-      cputlb: Pass retaddr to tb_check_watchpoint
+      target/riscv: Make translator stop before the end of a page
- accel/tcg/translate-all.h      |   8 +-
+ include/elf.h                     |   1 +
- include/exec/cpu-all.h         |  23 ++-
+ include/exec/cpu-common.h         |   1 +
- include/exec/cpu-common.h      |   3 -
+ include/exec/exec-all.h           |  89 ++++++++----------------
- include/exec/exec-all.h        |   6 +-
+ include/exec/translator.h         |  96 ++++++++++++++++---------
- include/exec/memory-internal.h |  65 --------
+ linux-user/arm/target_cpu.h       |   4 +-
- include/hw/core/cpu.h          |   2 -
+ linux-user/qemu.h                 |   1 +
- include/qemu/compiler.h        |  26 +++
+ accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
- accel/tcg/cputlb.c             | 348 +++++++++++++++++++++++++----------------
+ accel/tcg/cputlb.c                |  93 +++++++------------------
- accel/tcg/translate-all.c      |  51 +++---
+ accel/tcg/translate-all.c         |  29 ++++----
- exec.c                         | 158 +------------------
+ accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
- hw/core/cpu.c                  |   1 -
+ accel/tcg/user-exec.c             |  17 ++++-
- memory.c                       |  20 ---
+ linux-user/elfload.c              |  82 ++++++++++++++++++++--
- trace-events                   |   4 +-
+ linux-user/mmap.c                 |   6 +-
-files changed, 288 insertions(+), 427 deletions(-)
+ softmmu/physmem.c                 |  12 ++++
+ target/alpha/translate.c          |   5 +-
  target/arm/translate.c            |   5 +-
  target/avr/translate.c            |   5 +-
  target/cris/translate.c           |   5 +-
  target/hexagon/translate.c        |   6 +-
  target/hppa/translate.c           |   5 +-
  target/i386/tcg/translate.c       |  71 +++++++++++--------
  target/loongarch/translate.c      |   6 +-
  target/m68k/translate.c           |   5 +-
  target/microblaze/translate.c     |   5 +-
  target/mips/tcg/translate.c       |   5 +-
  target/nios2/translate.c          |   5 +-
  target/openrisc/translate.c       |   6 +-
  target/ppc/translate.c            |   5 +-
  target/riscv/translate.c          |  32 +++++++--
  target/rx/translate.c             |   5 +-
  target/s390x/tcg/translate.c      |  20 ++++--
  target/sh4/translate.c            |   5 +-
  target/sparc/translate.c          |   5 +-
  target/tricore/translate.c        |   6 +-
  target/xtensa/translate.c         |   6 +-
  tests/tcg/i386/test-i386.c        |   2 +-
  tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
  tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
  tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
  tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
  tests/tcg/riscv64/Makefile.target |   1 +
  tests/tcg/s390x/Makefile.target   |   1 +
  tests/tcg/x86_64/Makefile.target  |   3 +-
 files changed, 966 insertions(+), 367 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
  create mode 100644 tests/tcg/s390x/noexec.c
  create mode 100644 tests/tcg/x86_64/noexec.c
  create mode 100644 tests/tcg/multiarch/noexec.c.inc

-[PULL 15/16] cputlb: Pass retaddr to tb_invalidate_phys_page_fast
+[PULL 01/20] linux-user/arm: Mark the commpage executable
-Rather than rely on cpu->mem_io_pc, pass retaddr down directly.
+We're about to start validating PAGE_EXEC, which means
 that we've got to mark the commpage executable.  We had
 been placing the commpage outside of reserved_va, which
 was incorrect and lead to an abort.
-Within tb_invalidate_phys_page_range__locked, the is_cpu_write_access
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-parameter is non-zero exactly when retaddr would be non-zero, so that
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 is a simple replacement.
 Recognize that current_tb_not_found is true only when mem_io_pc
 (and now retaddr) are also non-zero, so remove a redundant test.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h |  3 ++-
+ linux-user/arm/target_cpu.h | 4 ++--
- accel/tcg/cputlb.c        |  6 +-----
+ linux-user/elfload.c        | 6 +++++-
- accel/tcg/translate-all.c | 39 +++++++++++++++++++--------------------
+files changed, 7 insertions(+), 3 deletions(-)
 files changed, 22 insertions(+), 26 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/linux-user/arm/target_cpu.h
-+++ b/accel/tcg/translate-all.h
++++ b/linux-user/arm/target_cpu.h
-@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
+@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
                                               tb_page_addr_t end);
  void page_collection_unlock(struct page_collection *set);
  void tb_invalidate_phys_page_fast(struct page_collection *pages,
 -                                  tb_page_addr_t start, int len);
 +                                  tb_page_addr_t start, int len,
 +                                  uintptr_t retaddr);
  void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
  void tb_check_watchpoint(CPUState *cpu);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
      if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
          struct page_collection *pages
              = page_collection_lock(ram_addr, ram_addr + size);
 -
 -        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 -        cpu->mem_io_pc = retaddr;
 -
 -        tb_invalidate_phys_page_fast(pages, ram_addr, size);
 +        tb_invalidate_phys_page_fast(pages, ram_addr, size, retaddr);
          page_collection_unlock(pages);
      }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void
  tb_invalidate_phys_page_range__locked(struct page_collection *pages,
                                        PageDesc *p, tb_page_addr_t start,
                                        tb_page_addr_t end,
 -                                      int is_cpu_write_access)
 +                                      uintptr_t retaddr)
  {
      TranslationBlock *tb;
      tb_page_addr_t tb_start, tb_end;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
  #ifdef TARGET_HAS_PRECISE_SMC
      CPUState *cpu = current_cpu;
      CPUArchState *env = NULL;
 -    int current_tb_not_found = is_cpu_write_access;
 +    bool current_tb_not_found = retaddr != 0;
 +    bool current_tb_modified = false;
      TranslationBlock *current_tb = NULL;
 -    int current_tb_modified = 0;
      target_ulong current_pc = 0;
      target_ulong current_cs_base = 0;
      uint32_t current_flags = 0;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
          if (!(tb_end <= start || tb_start >= end)) {
  #ifdef TARGET_HAS_PRECISE_SMC
              if (current_tb_not_found) {
 -                current_tb_not_found = 0;
 -                current_tb = NULL;
 -                if (cpu->mem_io_pc) {
 -                    /* now we have a real cpu fault */
 -                    current_tb = tcg_tb_lookup(cpu->mem_io_pc);
 -                }
 +                current_tb_not_found = false;
 +                /* now we have a real cpu fault */
 +                current_tb = tcg_tb_lookup(retaddr);
              }
              if (current_tb == tb &&
                  (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
 -                /* If we are modifying the current TB, we must stop
 -                its execution. We could be more precise by checking
 -                that the modification is after the current PC, but it
 -                would require a specialized function to partially
 -                restore the CPU state */
 -
 -                current_tb_modified = 1;
 -                cpu_restore_state_from_tb(cpu, current_tb,
 -                                          cpu->mem_io_pc, true);
 +                /*
 +                 * If we are modifying the current TB, we must stop
 +                 * its execution. We could be more precise by checking
 +                 * that the modification is after the current PC, but it
 +                 * would require a specialized function to partially
 +                 * restore the CPU state.
 +                 */
 +                current_tb_modified = true;
 +                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
                  cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                       &current_flags);
              }
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(target_ulong start, target_ulong end)
   * Call with all @pages in the range [@start, @start + len[ locked.
   */
  void tb_invalidate_phys_page_fast(struct page_collection *pages,
 -                                  tb_page_addr_t start, int len)
 +                                  tb_page_addr_t start, int len,
 +                                  uintptr_t retaddr)
  {
      PageDesc *p;
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
          }
      } else {
-     do_invalidate:
+         /*
--        tb_invalidate_phys_page_range__locked(pages, p, start, start + len, 1);
+          * We need to be able to map the commpage.
-+        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
+-         * See validate_guest_space in linux-user/elfload.c.
-+                                              retaddr);
++         * See init_guest_commpage in linux-user/elfload.c.
           */
 -        return 0xffff0000ul;
 +        return 0xfffffffful;
      }
  }
- #else
+ #define MAX_RESERVED_VA  arm_max_reserved_va
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
  static bool init_guest_commpage(void)
  {
 -    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
 +    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
 +    void *want = g2h_untagged(commpage);
      void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
                        MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
          perror("Protecting guest commpage");
          exit(EXIT_FAILURE);
      }
 +
 +    page_set_flags(commpage, commpage + qemu_host_page_size,
 +                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
      return true;
  }
 --
-.17.1
+.34.1

-[PULL 04/16] cputlb: Use qemu_build_not_reached in load/store_helpers
+[PULL 1/4] target/avr: Support probe argument to tlb_fill
-Increase the current runtime assert to a compile-time assert.
+While there are no target-specific nonfaulting probes,
 generic code may grow some uses at some point.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Note that the attrs argument was incorrect -- it should have
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 ++---
+ target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
-file changed, 2 insertions(+), 3 deletions(-)
+file changed, 29 insertions(+), 17 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/avr/helper.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-         res = ldq_le_p(haddr);
+                       MMUAccessType access_type, int mmu_idx,
-         break;
+                       bool probe, uintptr_t retaddr)
-     default:
+ {
--        g_assert_not_reached();
+-    int prot = 0;
-+        qemu_build_not_reached();
+-    MemTxAttrs attrs = {};
 +    int prot, page_size = TARGET_PAGE_SIZE;
      uint32_t paddr;
      address &= TARGET_PAGE_MASK;
      if (mmu_idx == MMU_CODE_IDX) {
 -        /* access to code in flash */
 +        /* Access to code in flash. */
          paddr = OFFSET_CODE + address;
          prot = PAGE_READ | PAGE_EXEC;
 -        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
 +        if (paddr >= OFFSET_DATA) {
 +            /*
 +             * This should not be possible via any architectural operations.
 +             * There is certainly not an exception that we can deliver.
 +             * Accept probing that might come from generic code.
 +             */
 +            if (probe) {
 +                return false;
 +            }
              error_report("execution left flash memory");
              abort();
          }
 -    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 -        /*
 -         * access to CPU registers, exit and rebuilt this TB to use full access
 -         * incase it touches specially handled registers like SREG or SP
 -         */
 -        AVRCPU *cpu = AVR_CPU(cs);
 -        CPUAVRState *env = &cpu->env;
 -        env->fullacc = 1;
 -        cpu_loop_exit_restore(cs, retaddr);
      } else {
 -        /* access to memory. nothing special */
 +        /* Access to memory. */
          paddr = OFFSET_DATA + address;
          prot = PAGE_READ | PAGE_WRITE;
 +        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 +            /*
 +             * Access to CPU registers, exit and rebuilt this TB to use
 +             * full access in case it touches specially handled registers
 +             * like SREG or SP.  For probing, set page_size = 1, in order
 +             * to force tlb_fill to be called for the next access.
 +             */
 +            if (probe) {
 +                page_size = 1;
 +            } else {
 +                AVRCPU *cpu = AVR_CPU(cs);
 +                CPUAVRState *env = &cpu->env;
 +                env->fullacc = 1;
 +                cpu_loop_exit_restore(cs, retaddr);
 +            }
 +        }
      }
-     return res;
+-    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+-                            mmu_idx, TARGET_PAGE_SIZE);
-         stq_le_p(haddr, val);
+-
-         break;
++    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
-     default:
+     return true;
 -        g_assert_not_reached();
 -        break;
 +        qemu_build_not_reached();
      }
  }
 --
-.17.1
+.34.1

-[PULL 01/16] exec: Use TARGET_PAGE_BITS_MIN for TLB flags
+[PULL 2/4] target/avr: Call avr_cpu_do_interrupt directly
-These bits do not need to vary with the actual page size
+There is no need to go through cc->tcg_ops when
-used by the guest.
+we know what value that must have.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h | 16 ++++++++++------
+ target/avr/helper.c | 5 ++---
-file changed, 10 insertions(+), 6 deletions(-)
+file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/target/avr/helper.c
-+++ b/include/exec/cpu-all.h
++++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
+@@ -XXX,XX +XXX,XX @@
+ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- #if !defined(CONFIG_USER_ONLY)
+ {
+     bool ret = false;
--/* Flags stored in the low bits of the TLB virtual address.  These are
+-    CPUClass *cc = CPU_GET_CLASS(cs);
-- * defined so that fast path ram access is all zeros.
+     AVRCPU *cpu = AVR_CPU(cs);
-+/*
+     CPUAVRState *env = &cpu->env;
-+ * Flags stored in the low bits of the TLB virtual address.
-+ * These are defined so that fast path ram access is all zeros.
+     if (interrupt_request & CPU_INTERRUPT_RESET) {
-  * The flags all must be between TARGET_PAGE_BITS and
+         if (cpu_interrupts_enabled(env)) {
-  * maximum address alignment bit.
+             cs->exception_index = EXCP_RESET;
-+ *
+-            cc->tcg_ops->do_interrupt(cs);
-+ * Use TARGET_PAGE_BITS_MIN so that these bits are constant
++            avr_cpu_do_interrupt(cs);
-+ * when TARGET_PAGE_BITS_VARY is in effect.
-  */
+             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
- /* Zero if TLB entry is valid.  */
--#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS - 1))
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
+         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
- /* Set if TLB entry references a clean RAM page.  The iotlb entry will
+             int index = ctz32(env->intsrc);
-    contain the page physical address.  */
+             cs->exception_index = EXCP_INT(index);
--#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
+-            cc->tcg_ops->do_interrupt(cs);
-+#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
++            avr_cpu_do_interrupt(cs);
- /* Set if TLB entry is an IO callback.  */
--#define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
+             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
-+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
+             if (!env->intsrc) {
  /* Set if TLB entry contains a watchpoint.  */
 -#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
 +#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
  /* Use this mask to check interception with an alignment mask
   * in a TCG backend.
 --
-.17.1
+.34.1

-[PULL 11/16] cputlb: Merge and move memory_notdirty_write_{prepare, complete}
+[PULL 02/20] linux-user/hppa: Allocate page zero as a commpage
-Since 9458a9a1df1a, all readers of the dirty bitmaps wait
+We're about to start validating PAGE_EXEC, which means that we've
-for the rcu lock, which means that they wait until the end
+got to mark page zero executable.  We had been special casing this
-of any executing TranslationBlock.
+entirely within translate.
-As a consequence, there is no need for the actual access
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-to happen in between the _prepare and _complete.  Therefore,
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 we can improve things by merging the two functions into
 notdirty_write and dropping the NotDirtyInfo structure.
 In addition, the only users of notdirty_write are in cputlb.c,
 so move the merged function there.  Pass in the CPUIOTLBEntry
 from which the ram_addr_t may be computed.
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/memory-internal.h | 65 -----------------------------
+ linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
- accel/tcg/cputlb.c             | 76 +++++++++++++++++++---------------
+file changed, 31 insertions(+), 3 deletions(-)
  exec.c                         | 44 --------------------
 files changed, 42 insertions(+), 143 deletions(-)
-diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memory-internal.h
+--- a/linux-user/elfload.c
-+++ b/include/exec/memory-internal.h
++++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ void address_space_dispatch_free(AddressSpaceDispatch *d);
+@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
+     regs->gr[31] = infop->entry;
  void mtree_print_dispatch(struct AddressSpaceDispatch *d,
                            MemoryRegion *root);
 -
 -struct page_collection;
 -
 -/* Opaque struct for passing info from memory_notdirty_write_prepare()
 - * to memory_notdirty_write_complete(). Callers should treat all fields
 - * as private, with the exception of @active.
 - *
 - * @active is a field which is not touched by either the prepare or
 - * complete functions, but which the caller can use if it wishes to
 - * track whether it has called prepare for this struct and so needs
 - * to later call the complete function.
 - */
 -typedef struct {
 -    CPUState *cpu;
 -    struct page_collection *pages;
 -    ram_addr_t ram_addr;
 -    vaddr mem_vaddr;
 -    unsigned size;
 -    bool active;
 -} NotDirtyInfo;
 -
 -/**
 - * memory_notdirty_write_prepare: call before writing to non-dirty memory
 - * @ndi: pointer to opaque NotDirtyInfo struct
 - * @cpu: CPU doing the write
 - * @mem_vaddr: virtual address of write
 - * @ram_addr: the ram address of the write
 - * @size: size of write in bytes
 - *
 - * Any code which writes to the host memory corresponding to
 - * guest RAM which has been marked as NOTDIRTY must wrap those
 - * writes in calls to memory_notdirty_write_prepare() and
 - * memory_notdirty_write_complete():
 - *
 - *  NotDirtyInfo ndi;
 - *  memory_notdirty_write_prepare(&ndi, ....);
 - *  ... perform write here ...
 - *  memory_notdirty_write_complete(&ndi);
 - *
 - * These calls will ensure that we flush any TCG translated code for
 - * the memory being written, update the dirty bits and (if possible)
 - * remove the slowpath callback for writing to the memory.
 - *
 - * This must only be called if we are using TCG; it will assert otherwise.
 - *
 - * We may take locks in the prepare call, so callers must ensure that
 - * they don't exit (via longjump or otherwise) without calling complete.
 - *
 - * This call must only be made inside an RCU critical section.
 - * (Note that while we're executing a TCG TB we're always in an
 - * RCU critical section, which is likely to be the case for callers
 - * of these functions.)
 - */
 -void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
 -                                   CPUState *cpu,
 -                                   vaddr mem_vaddr,
 -                                   ram_addr_t ram_addr,
 -                                   unsigned size);
 -/**
 - * memory_notdirty_write_complete: finish write to non-dirty memory
 - * @ndi: pointer to the opaque NotDirtyInfo struct which was initialized
 - * by memory_not_dirty_write_prepare().
 - */
 -void memory_notdirty_write_complete(NotDirtyInfo *ndi);
 -
  #endif
  #endif
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
  #include "qemu/atomic.h"
  #include "qemu/atomic128.h"
 +#include "translate-all.h"
  /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
  /* #define DEBUG_TLB */
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
      return qemu_ram_addr_from_host_nofail(p);
  }
-+static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
++#define LO_COMMPAGE  0
-+                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
++
 +static bool init_guest_commpage(void)
 +{
-+    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
++    void *want = g2h_untagged(LO_COMMPAGE);
 +    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
 +                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 +
-+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
++    if (addr == MAP_FAILED) {
-+
++        perror("Allocating guest commpage");
-+    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
++        exit(EXIT_FAILURE);
-+        struct page_collection *pages
++    }
-+            = page_collection_lock(ram_addr, ram_addr + size);
++    if (addr != want) {
-+
++        return false;
 +        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 +        cpu->mem_io_pc = retaddr;
 +
 +        tb_invalidate_phys_page_fast(pages, ram_addr, size);
 +        page_collection_unlock(pages);
 +    }
 +
 +    /*
-+     * Set both VGA and migration bits for simplicity and to remove
++     * On Linux, page zero is normally marked execute only + gateway.
-+     * the notdirty callback faster.
++     * Normal read or write is supposed to fail (thus PROT_NONE above),
 +     * but specific offsets have kernel code mapped to raise permissions
 +     * and implement syscalls.  Here, simply mark the page executable.
 +     * Special case the entry points during translation (see do_page_zero).
 +     */
-+    cpu_physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
++    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
-+
++                   PAGE_EXEC | PAGE_VALID);
-+    /* We remove the notdirty callback only if the code has been flushed. */
++    return true;
 +    if (!cpu_physical_memory_is_clean(ram_addr)) {
 +        trace_memory_notdirty_set_dirty(mem_vaddr);
 +        tlb_set_dirty(cpu, mem_vaddr);
 +    }
 +}
 +
- /*
+ #endif /* TARGET_HPPA */
-  * Probe for whether the specified guest access is permitted. If it is not
-  * permitted then an exception will be taken in the same way as if this
+ #ifdef TARGET_XTENSA
-@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
+@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
- /* Probe for a read-modify-write atomic operation.  Do not allow unaligned
+ }
-  * operations, or io operations to proceed.  Return the host address.  */
- static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+ #if defined(HI_COMMPAGE)
--                               TCGMemOpIdx oi, uintptr_t retaddr,
+-#define LO_COMMPAGE 0
--                               NotDirtyInfo *ndi)
++#define LO_COMMPAGE -1
-+                               TCGMemOpIdx oi, uintptr_t retaddr)
+ #elif defined(LO_COMMPAGE)
- {
+ #define HI_COMMPAGE 0
-     size_t mmu_idx = get_mmuidx(oi);
+ #else
-     uintptr_t index = tlb_index(env, mmu_idx, addr);
+ #define HI_COMMPAGE 0
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+-#define LO_COMMPAGE 0
++#define LO_COMMPAGE -1
-     hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
+ #define init_guest_commpage() true
+ #endif
--    ndi->active = false;
-     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
+@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
--        ndi->active = true;
+         } else {
--        memory_notdirty_write_prepare(ndi, env_cpu(env), addr,
+             offset = -(HI_COMMPAGE & -align);
--                                      qemu_ram_addr_from_host_nofail(hostaddr),
+         }
--                                      1 << s_bits);
+-    } else if (LO_COMMPAGE != 0) {
-+        notdirty_write(env_cpu(env), addr, 1 << s_bits,
++    } else if (LO_COMMPAGE != -1) {
-+                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
+         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
      }
-     return hostaddr;
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
-             return;
-         }
--        haddr = (void *)((uintptr_t)addr + entry->addend);
--
-         /* Handle clean RAM pages.  */
-         if (tlb_addr & TLB_NOTDIRTY) {
--            NotDirtyInfo ndi;
--
--            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
--            env_cpu(env)->mem_io_pc = retaddr;
--
--            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
--                                          addr + iotlbentry->addr, size);
--
--            if (unlikely(need_swap)) {
--                store_memop(haddr, val, op ^ MO_BSWAP);
--            } else {
--                store_memop(haddr, val, op);
--            }
--
--            memory_notdirty_write_complete(&ndi);
--            return;
-+            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
-         }
-+        haddr = (void *)((uintptr_t)addr + entry->addend);
-+
-         /*
-          * Keep these two store_memop separate to ensure that the compiler
-          * is able to fold the entire function to a single instruction.
-@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
- #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
- #define ATOMIC_NAME(X) \
-     HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
--#define ATOMIC_MMU_DECLS NotDirtyInfo ndi
--#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr, &ndi)
--#define ATOMIC_MMU_CLEANUP                              \
--    do {                                                \
--        if (unlikely(ndi.active)) {                     \
--            memory_notdirty_write_complete(&ndi);       \
--        }                                               \
--    } while (0)
-+#define ATOMIC_MMU_DECLS
-+#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
-+#define ATOMIC_MMU_CLEANUP
- #define DATA_SIZE 1
- #include "atomic_template.h"
-@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
- #undef ATOMIC_MMU_LOOKUP
- #define EXTRA_ARGS         , TCGMemOpIdx oi
- #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
--#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC(), &ndi)
-+#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
- #define DATA_SIZE 1
- #include "atomic_template.h"
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
-     return block->offset + offset;
- }
--/* Called within RCU critical section. */
--void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
--                          CPUState *cpu,
--                          vaddr mem_vaddr,
--                          ram_addr_t ram_addr,
--                          unsigned size)
--{
--    ndi->cpu = cpu;
--    ndi->ram_addr = ram_addr;
--    ndi->mem_vaddr = mem_vaddr;
--    ndi->size = size;
--    ndi->pages = NULL;
--
--    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
--
--    assert(tcg_enabled());
--    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
--        ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
--        tb_invalidate_phys_page_fast(ndi->pages, ram_addr, size);
--    }
--}
--
--/* Called within RCU critical section. */
--void memory_notdirty_write_complete(NotDirtyInfo *ndi)
--{
--    if (ndi->pages) {
--        assert(tcg_enabled());
--        page_collection_unlock(ndi->pages);
--        ndi->pages = NULL;
--    }
--
--    /* Set both VGA and migration bits for simplicity and to remove
--     * the notdirty callback faster.
--     */
--    cpu_physical_memory_set_dirty_range(ndi->ram_addr, ndi->size,
--                                        DIRTY_CLIENTS_NOCODE);
--    /* we remove the notdirty callback only if the code has been
--       flushed */
--    if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
--        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
--        tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
--    }
--}
--
- /* Generate a debug exception if a watchpoint has been hit.  */
- void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                           MemTxAttrs attrs, int flags, uintptr_t ra)
 --
-.17.1
+.34.1

-New patch
+[PULL 03/20] linux-user/x86_64: Allocate vsyscall page as a commpage
+We're about to start validating PAGE_EXEC, which means that we've
+got to mark the vsyscall page executable.  We had been special
+casing this entirely within translate.
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/elfload.c | 23 +++++++++++++++++++++++
+file changed, 23 insertions(+)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
+     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
+ }
++#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
++#define INIT_GUEST_COMMPAGE
++static bool init_guest_commpage(void)
++{
++    /*
++     * The vsyscall page is at a high negative address aka kernel space,
++     * which means that we cannot actually allocate it with target_mmap.
++     * We still should be able to use page_set_flags, unless the user
++     * has specified -R reserved_va, which would trigger an assert().
++     */
++    if (reserved_va != 0 &&
++        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
++        error_report("Cannot allocate vsyscall page");
++        exit(EXIT_FAILURE);
++    }
++    page_set_flags(TARGET_VSYSCALL_PAGE,
++                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
++                   PAGE_EXEC | PAGE_VALID);
++    return true;
++}
++#endif
+ #else
+ #define ELF_START_MMAP 0x80000000
+@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
+ #else
+ #define HI_COMMPAGE 0
+ #define LO_COMMPAGE -1
++#ifndef INIT_GUEST_COMMPAGE
+ #define init_guest_commpage() true
+ #endif
++#endif
+ static void pgb_fail_in_use(const char *image_name)
+ {
+--
+.34.1

-[PULL 03/16] qemu/compiler.h: Add qemu_build_not_reached
+[PULL 3/4] target/avr: Only execute one interrupt at a time
-Use this as a compile-time assert that a particular
+We cannot deliver two interrupts simultaneously;
-code path is not reachable.
+the first interrupt handler must execute first.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu/compiler.h | 15 +++++++++++++++
+ target/avr/helper.c | 9 +++------
-file changed, 15 insertions(+)
+file changed, 3 insertions(+), 6 deletions(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
+--- a/target/avr/helper.c
-+++ b/include/qemu/compiler.h
++++ b/target/avr/helper.c
 @@ -XXX,XX +XXX,XX @@
- #define QEMU_GENERIC9(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC8(x, __VA_ARGS__))
- #define QEMU_GENERIC10(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC9(x, __VA_ARGS__))
+ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+ {
-+/**
+-    bool ret = false;
-+ * qemu_build_not_reached()
+     AVRCPU *cpu = AVR_CPU(cs);
-+ *
+     CPUAVRState *env = &cpu->env;
-+ * The compiler, during optimization, is expected to prove that a call
-+ * to this function cannot be reached and remove it.  If the compiler
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-+ * supports QEMU_ERROR, this will be reported at compile time; otherwise
+             avr_cpu_do_interrupt(cs);
-+ * this will be reported at link time due to the missing symbol.
-+ */
+             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
-+#ifdef __OPTIMIZE__
+-
-+extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
+-            ret = true;
-+    qemu_build_not_reached(void);
++            return true;
-+#else
+         }
-+#define qemu_build_not_reached()  g_assert_not_reached()
+     }
-+#endif
+     if (interrupt_request & CPU_INTERRUPT_HARD) {
-+
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- #endif /* COMPILER_H */
+             if (!env->intsrc) {
                  cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
              }
 -
 -            ret = true;
 +            return true;
          }
      }
 -    return ret;
 +    return false;
  }
  void avr_cpu_do_interrupt(CPUState *cs)
 --
-.17.1
+.34.1

-[PULL 13/16] cputlb: Remove cpu->mem_io_vaddr
+[PULL 4/4] target/avr: Disable interrupts when env->skip set
-With the merge of notdirty handling into store_helper,
+This bit is not saved across interrupts, so we must
-the last user of cpu->mem_io_vaddr was removed.
+delay delivering the interrupt until the skip has
 been processed.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 2 --
+ target/avr/helper.c    |  9 +++++++++
- accel/tcg/cputlb.c    | 2 --
+ target/avr/translate.c | 26 ++++++++++++++++++++++----
- hw/core/cpu.c         | 1 -
+files changed, 31 insertions(+), 4 deletions(-)
 files changed, 5 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/avr/helper.c
-+++ b/include/hw/core/cpu.h
++++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-  * @next_cpu: Next CPU sharing TB cache.
+     AVRCPU *cpu = AVR_CPU(cs);
-  * @opaque: User data.
+     CPUAVRState *env = &cpu->env;
-  * @mem_io_pc: Host Program Counter at which the memory was accessed.
-- * @mem_io_vaddr: Target virtual address at which the memory was accessed.
++    /*
-  * @kvm_fd: vCPU file descriptor for KVM.
++     * We cannot separate a skip from the next instruction,
-  * @work_mutex: Lock to prevent multiple access to queued_work_*.
++     * as the skip would not be preserved across the interrupt.
-  * @queued_work_first: First asynchronous work pending.
++     * Separating the two insn normally only happens at page boundaries.
-@@ -XXX,XX +XXX,XX @@ struct CPUState {
++     */
-      * we store some rarely used information in the CPU context.
++    if (env->skip) {
-      */
++        return false;
-     uintptr_t mem_io_pc;
++    }
--    vaddr mem_io_vaddr;
++
-     /*
+     if (interrupt_request & CPU_INTERRUPT_RESET) {
-      * This is only needed for the legacy cpu_unassigned_access() hook;
+         if (cpu_interrupts_enabled(env)) {
-      * when all targets using it have been converted to use
+             cs->exception_index = EXCP_RESET;
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/avr/translate.c b/target/avr/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/avr/translate.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/avr/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-         cpu_io_recompile(cpu, retaddr);
+     if (skip_label) {
          canonicalize_skip(ctx);
          gen_set_label(skip_label);
 -        if (ctx->base.is_jmp == DISAS_NORETURN) {
 +
 +        switch (ctx->base.is_jmp) {
 +        case DISAS_NORETURN:
              ctx->base.is_jmp = DISAS_CHAIN;
 +            break;
 +        case DISAS_NEXT:
 +            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
 +                ctx->base.is_jmp = DISAS_TOO_MANY;
 +            }
 +            break;
 +        default:
 +            break;
          }
      }
--    cpu->mem_io_vaddr = addr;
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-     cpu->mem_io_access_type = access_type;
+ {
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
+     bool nonconst_skip = canonicalize_skip(ctx);
-@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
++    /*
-     if (!cpu->can_do_io) {
++     * Because we disable interrupts while env->skip is set,
-         cpu_io_recompile(cpu, retaddr);
++     * we must return to the main loop to re-evaluate afterward.
-     }
++     */
--    cpu->mem_io_vaddr = addr;
++    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
-     cpu->mem_io_pc = retaddr;
+     switch (ctx->base.is_jmp) {
-     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
+     case DISAS_NORETURN:
-diff --git a/hw/core/cpu.c b/hw/core/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-index XXXXXXX..XXXXXXX 100644
+     case DISAS_NEXT:
---- a/hw/core/cpu.c
+     case DISAS_TOO_MANY:
-+++ b/hw/core/cpu.c
+     case DISAS_CHAIN:
-@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(CPUState *cpu)
+-        if (!nonconst_skip) {
-     cpu->interrupt_request = 0;
++        if (!nonconst_skip && !force_exit) {
-     cpu->halted = 0;
+             /* Note gen_goto_tb checks singlestep.  */
-     cpu->mem_io_pc = 0;
+             gen_goto_tb(ctx, 1, ctx->npc);
--    cpu->mem_io_vaddr = 0;
+             break;
-     cpu->icount_extra = 0;
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-     atomic_set(&cpu->icount_decr_ptr->u32, 0);
+         tcg_gen_movi_tl(cpu_pc, ctx->npc);
-     cpu->can_do_io = 1;
+         /* fall through */
      case DISAS_LOOKUP:
 -        tcg_gen_lookup_and_goto_ptr();
 -        break;
 +        if (!force_exit) {
 +            tcg_gen_lookup_and_goto_ptr();
 +            break;
 +        }
 +        /* fall through */
      case DISAS_EXIT:
          tcg_gen_exit_tb(NULL, 0);
          break;
 --
-.17.1
+.34.1

-[PULL 12/16] cputlb: Handle TLB_NOTDIRTY in probe_access
+[PULL 04/20] linux-user: Honor PT_GNU_STACK
-We can use notdirty_write for the write and return a valid host
+Map the stack executable if required by default or on demand.
 pointer for this case.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 26 +++++++++++++++++---------
+ include/elf.h        |  1 +
-file changed, 17 insertions(+), 9 deletions(-)
+ linux-user/qemu.h    |  1 +
  linux-user/elfload.c | 19 ++++++++++++++++++-
 files changed, 20 insertions(+), 1 deletion(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/elf.h b/include/elf.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/elf.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/elf.h
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
-         return NULL;
+ #define PT_LOPROC  0x70000000
  #define PT_HIPROC  0x7fffffff
 +#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
  #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
  #define PT_MIPS_REGINFO   0x70000000
 diff --git a/linux-user/qemu.h b/linux-user/qemu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/qemu.h
 +++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
          uint32_t        elf_flags;
          int             personality;
          abi_ulong       alignment;
 +        bool            exec_stack;
          /* Generic semihosting knows about these pointers. */
          abi_ulong       arg_strings;   /* strings for argv */
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
  #define ELF_ARCH        EM_386
  #define ELF_PLATFORM get_elf_platform()
 +#define EXSTACK_DEFAULT true
  static const char *get_elf_platform(void)
  {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
  #define ELF_ARCH        EM_ARM
  #define ELF_CLASS       ELFCLASS32
 +#define EXSTACK_DEFAULT true
  static inline void init_thread(struct target_pt_regs *regs,
                                 struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
  #else
  #define ELF_CLASS       ELFCLASS32
 +#define EXSTACK_DEFAULT true
  #endif
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
  #define ELF_CLASS   ELFCLASS64
  #define ELF_ARCH    EM_LOONGARCH
 +#define EXSTACK_DEFAULT true
  #define elf_check_arch(x) ((x) == EM_LOONGARCH)
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
  #define ELF_CLASS   ELFCLASS32
  #endif
  #define ELF_ARCH    EM_MIPS
 +#define EXSTACK_DEFAULT true
  #ifdef TARGET_ABI_MIPSN32
  #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
  #define bswaptls(ptr) bswap32s(ptr)
  #endif
 +#ifndef EXSTACK_DEFAULT
 +#define EXSTACK_DEFAULT false
 +#endif
 +
  #include "elf.h"
  /* We must delay the following stanzas until after "elf.h". */
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
                                   struct image_info *info)
  {
      abi_ulong size, error, guard;
 +    int prot;
      size = guest_stack_size;
      if (size < STACK_LOWER_LIMIT) {
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
          guard = qemu_real_host_page_size();
      }
--    /* Handle watchpoints.  */
+-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
--    if (tlb_addr & TLB_WATCHPOINT) {
++    prot = PROT_READ | PROT_WRITE;
--        cpu_check_watchpoint(env_cpu(env), addr, size,
++    if (info->exec_stack) {
--                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
++        prot |= PROT_EXEC;
--                             wp_access, retaddr);
++    }
--    }
++    error = target_mmap(0, size + guard, prot,
-+    if (unlikely(tlb_addr & TLB_FLAGS_MASK)) {
+                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-+        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+     if (error == -1) {
+         perror("mmap stack");
--    /* Reject I/O access, or other required slow-path.  */
+@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
--    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
+      */
--        return NULL;
+     loaddr = -1, hiaddr = 0;
-+        /* Reject I/O access, or other required slow-path.  */
+     info->alignment = 0;
-+        if (tlb_addr & (TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
++    info->exec_stack = EXSTACK_DEFAULT;
-+            return NULL;
+     for (i = 0; i < ehdr->e_phnum; ++i) {
-+        }
+         struct elf_phdr *eppnt = phdr + i;
-+
+         if (eppnt->p_type == PT_LOAD) {
-+        /* Handle watchpoints.  */
+@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
-+        if (tlb_addr & TLB_WATCHPOINT) {
+             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
-+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                 goto exit_errmsg;
-+                                 iotlbentry->attrs, wp_access, retaddr);
+             }
-+        }
++        } else if (eppnt->p_type == PT_GNU_STACK) {
-+
++            info->exec_stack = eppnt->p_flags & PF_X;
-+        /* Handle clean RAM pages.  */
+         }
 +        if (tlb_addr & TLB_NOTDIRTY) {
 +            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
 +        }
      }
-     return (void *)((uintptr_t)addr + entry->addend);
 --
-.17.1
+.34.1

-New patch
+[PULL 05/20] linux-user: Clear translations on mprotect()
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+Currently it's possible to execute pages that do not have PAGE_EXEC
+if there is an existing translation block. Fix by invalidating TBs
+that touch the affected pages.
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/mmap.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/linux-user/mmap.c b/linux-user/mmap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/mmap.c
++++ b/linux-user/mmap.c
+@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
+             goto error;
+         }
+     }
++
+     page_set_flags(start, start + len, page_flags);
+-    mmap_unlock();
+-    return 0;
++    tb_invalidate_phys_range(start, start + len);
++    ret = 0;
++
+ error:
+     mmap_unlock();
+     return ret;
+--
+.34.1

-New patch
+[PULL 06/20] tests/tcg/i386: Move smc_code2 to an executable section
+We're about to start validating PAGE_EXEC, which means
+that we've got to put this code into a section that is
+both writable and executable.
+Note that this test did not run on hardware beforehand either.
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tests/tcg/i386/test-i386.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/tests/tcg/i386/test-i386.c b/tests/tcg/i386/test-i386.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/tcg/i386/test-i386.c
++++ b/tests/tcg/i386/test-i386.c
+@@ -XXX,XX +XXX,XX @@ uint8_t code[] = {
+xc3, /* ret */
+ };
+-asm(".section \".data\"\n"
++asm(".section \".data_x\",\"awx\"\n"
+     "smc_code2:\n"
+     "movl 4(%esp), %eax\n"
+     "movl %eax, smc_patch_addr2 + 1\n"
+--
+.34.1

-[PULL 02/16] cputlb: Disable __always_inline__ without optimization
+[PULL 07/20] accel/tcg: Introduce is_same_page()
-This forced inlining can result in missing symbols,
+From: Ilya Leoshkevich <iii@linux.ibm.com>
 which makes a debugging build harder to follow.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Introduce a function that checks whether a given address is on the same
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+page as where disassembly started. Having it improves readability of
-Reviewed-by: David Hildenbrand <david@redhat.com>
+the following patches.
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [rth: Make the DisasContextBase parameter const.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu/compiler.h | 11 +++++++++++
+ include/exec/translator.h | 10 ++++++++++
- accel/tcg/cputlb.c      |  4 ++--
+file changed, 10 insertions(+)
 files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
+--- a/include/exec/translator.h
-+++ b/include/qemu/compiler.h
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
- # define QEMU_NONSTRING
- #endif
+ #undef GEN_TRANSLATOR_LD
 +/*
-+ * Forced inlining may be desired to encourage constant propagation
++ * Return whether addr is on the same page as where disassembly started.
-+ * of function parameters.  However, it can also make debugging harder,
++ * Translators can use this to enforce the rule that only single-insn
-+ * so disable it for a non-optimizing build.
++ * translation blocks are allowed to cross page boundaries.
 + */
-+#if defined(__OPTIMIZE__)
++static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
-+#define QEMU_ALWAYS_INLINE  __attribute__((always_inline))
++{
-+#else
++    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
-+#define QEMU_ALWAYS_INLINE
++}
 +#endif
 +
- /* Implement C11 _Generic via GCC builtins.  Example:
+ #endif /* EXEC__TRANSLATOR_H */
   *
   *    QEMU_GENERIC(x, (float, sinf), (long double, sinl), sin) (x)
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
  typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
                                  TCGMemOpIdx oi, uintptr_t retaddr);
 -static inline uint64_t __attribute__((always_inline))
 +static inline uint64_t QEMU_ALWAYS_INLINE
  load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              uintptr_t retaddr, MemOp op, bool code_read,
              FullLoadHelper *full_load)
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
   * Store Helpers
   */
 -static inline void __attribute__((always_inline))
 +static inline void QEMU_ALWAYS_INLINE
  store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
               TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
  {
 --
-.17.1
+.34.1

-[PULL 08/16] cputlb: Move ROM handling from I/O path to TLB path
+[PULL 08/20] accel/tcg: Properly implement get_page_addr_code for user-only
-It does not require going through the whole I/O path
+The current implementation is a no-op, simply returning addr.
-in order to discard a write.
+This is incorrect, because we ought to be checking the page
 permissions for execution.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Make get_page_addr_code inline for both implementations.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h    |  5 ++++-
+ include/exec/exec-all.h | 85 ++++++++++++++---------------------------
- include/exec/cpu-common.h |  1 -
+ accel/tcg/cputlb.c      |  5 ---
- accel/tcg/cputlb.c        | 36 ++++++++++++++++++++--------------
+ accel/tcg/user-exec.c   | 14 +++++++
- exec.c                    | 41 +--------------------------------------
+files changed, 42 insertions(+), 62 deletions(-)
 files changed, 26 insertions(+), 57 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/include/exec/exec-all.h
-+++ b/include/exec/cpu-all.h
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
+@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
- #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+                                              hwaddr index, MemTxAttrs attrs);
- /* Set if TLB entry requires byte swap.  */
+ #endif
- #define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
-+/* Set if TLB entry writes ignored.  */
+-#if defined(CONFIG_USER_ONLY)
-+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
+-void mmap_lock(void);
+-void mmap_unlock(void);
- /* Use this mask to check interception with an alignment mask
+-bool have_mmap_lock(void);
-  * in a TCG backend.
+-
  /**
 - * get_page_addr_code() - user-mode version
 + * get_page_addr_code_hostp()
   * @env: CPUArchState
   * @addr: guest virtual address of guest code
   *
 - * Returns @addr.
 + * See get_page_addr_code() (full-system version) for documentation on the
 + * return value.
 + *
 + * Sets *@hostp (when @hostp is non-NULL) as follows.
 + * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
 + * to the host address where @addr's content is kept.
 + *
 + * Note: this function can trigger an exception.
 + */
 +tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 +                                        void **hostp);
 +
 +/**
 + * get_page_addr_code()
 + * @env: CPUArchState
 + * @addr: guest virtual address of guest code
 + *
 + * If we cannot translate and execute from the entire RAM page, or if
 + * the region is not backed by RAM, returns -1. Otherwise, returns the
 + * ram_addr_t corresponding to the guest code at @addr.
 + *
 + * Note: this function can trigger an exception.
   */
- #define TLB_FLAGS_MASK \
+ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
--    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
+                                                 target_ulong addr)
-+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
+ {
-+    | TLB_WATCHPOINT | TLB_BSWAP | TLB_DISCARD_WRITE)
+-    return addr;
 +    return get_page_addr_code_hostp(env, addr, NULL);
  }
 -/**
 - * get_page_addr_code_hostp() - user-mode version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * Returns @addr.
 - *
 - * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
 - * is kept.
 - */
 -static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
 -                                                      target_ulong addr,
 -                                                      void **hostp)
 -{
 -    if (hostp) {
 -        *hostp = g2h_untagged(addr);
 -    }
 -    return addr;
 -}
 +#if defined(CONFIG_USER_ONLY)
 +void mmap_lock(void);
 +void mmap_unlock(void);
 +bool have_mmap_lock(void);
  /**
-  * tlb_hit_page: return true if page aligned @addr is a hit against the
+  * adjust_signal_pc:
-diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
-index XXXXXXX..XXXXXXX 100644
+ static inline void mmap_lock(void) {}
---- a/include/exec/cpu-common.h
+ static inline void mmap_unlock(void) {}
-+++ b/include/exec/cpu-common.h
-@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
+-/**
+- * get_page_addr_code() - full-system version
- void cpu_flush_icache_range(hwaddr start, hwaddr len);
+- * @env: CPUArchState
+- * @addr: guest virtual address of guest code
--extern struct MemoryRegion io_mem_rom;
+- *
- extern struct MemoryRegion io_mem_notdirty;
+- * If we cannot translate and execute from the entire RAM page, or if
+- * the region is not backed by RAM, returns -1. Otherwise, returns the
- typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
+- * ram_addr_t corresponding to the guest code at @addr.
 - *
 - * Note: this function can trigger an exception.
 - */
 -tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
 -
 -/**
 - * get_page_addr_code_hostp() - full-system version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * See get_page_addr_code() (full-system version) for documentation on the
 - * return value.
 - *
 - * Sets *@hostp (when @hostp is non-NULL) as follows.
 - * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
 - * to the host address where @addr's content is kept.
 - *
 - * Note: this function can trigger an exception.
 - */
 -tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 -                                        void **hostp);
 -
  void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
  void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
+@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
- {
+     return qemu_ram_addr_from_host_nofail(p);
      uintptr_t addr = tlb_entry->addr_write;
 -    if ((addr & (TLB_INVALID_MASK | TLB_MMIO | TLB_NOTDIRTY)) == 0) {
 +    if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
 +                 TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
          addr &= TARGET_PAGE_MASK;
          addr += tlb_entry->addend;
          if ((addr - start) < length) {
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
          address |= TLB_MMIO;
          addend = 0;
      } else {
 -        /* TLB_MMIO for rom/romd handled below */
          addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
      }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      tn.addr_write = -1;
      if (prot & PAGE_WRITE) {
 -        if ((memory_region_is_ram(section->mr) && section->readonly)
 -            || memory_region_is_romd(section->mr)) {
 -            /* Write access calls the I/O callback.  */
 -            tn.addr_write = address | TLB_MMIO;
 -        } else if (memory_region_is_ram(section->mr)
 -                   && cpu_physical_memory_is_clean(
 -                       memory_region_get_ram_addr(section->mr) + xlat)) {
 -            tn.addr_write = address | TLB_NOTDIRTY;
 -        } else {
 -            tn.addr_write = address;
 +        tn.addr_write = address;
 +        if (memory_region_is_romd(section->mr)) {
 +            /* Use the MMIO path so that the device can switch states. */
 +            tn.addr_write |= TLB_MMIO;
 +        } else if (memory_region_is_ram(section->mr)) {
 +            if (section->readonly) {
 +                tn.addr_write |= TLB_DISCARD_WRITE;
 +            } else if (cpu_physical_memory_is_clean(
 +                        memory_region_get_ram_addr(section->mr) + xlat)) {
 +                tn.addr_write |= TLB_NOTDIRTY;
 +            }
          }
          if (prot & PAGE_WRITE_INV) {
              tn.addr_write |= TLB_INVALID_MASK;
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
      cpu->mem_io_pc = retaddr;
 -    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 -    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
      cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      }
      /* Reject I/O access, or other required slow-path.  */
 -    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
 +    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
          return NULL;
      }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              return;
          }
 +        /* Ignore writes to ROM.  */
 +        if (unlikely(tlb_addr & TLB_DISCARD_WRITE)) {
 +            return;
 +        }
 +
          haddr = (void *)((uintptr_t)addr + entry->addend);
          /*
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
  AddressSpace address_space_io;
  AddressSpace address_space_memory;
 -MemoryRegion io_mem_rom, io_mem_notdirty;
 +MemoryRegion io_mem_notdirty;
  static MemoryRegion io_mem_unassigned;
  #endif
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
  #define PHYS_SECTION_UNASSIGNED 0
  #define PHYS_SECTION_NOTDIRTY 1
 -#define PHYS_SECTION_ROM 2
  static void io_mem_init(void);
  static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
          iotlb = memory_region_get_ram_addr(section->mr) + xlat;
          if (!section->readonly) {
              iotlb |= PHYS_SECTION_NOTDIRTY;
 -        } else {
 -            iotlb |= PHYS_SECTION_ROM;
          }
      } else {
          AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ static uint16_t dummy_section(PhysPageMap *map, FlatView *fv, MemoryRegion *mr)
      return phys_section_add(map, &section);
  }
--static void readonly_mem_write(void *opaque, hwaddr addr,
+-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
 -                               uint64_t val, unsigned size)
 -{
--    /* Ignore any write to ROM. */
+-    return get_page_addr_code_hostp(env, addr, NULL);
 -}
 -
--static bool readonly_mem_accepts(void *opaque, hwaddr addr,
+ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
--                                 unsigned size, bool is_write,
+                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 -                                 MemTxAttrs attrs)
 -{
 -    return is_write;
 -}
 -
 -/* This will only be used for writes, because reads are special cased
 - * to directly access the underlying host ram.
 - */
 -static const MemoryRegionOps readonly_mem_ops = {
 -    .write = readonly_mem_write,
 -    .valid.accepts = readonly_mem_accepts,
 -    .endianness = DEVICE_NATIVE_ENDIAN,
 -    .valid = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -    .impl = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -};
 -
  MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                        hwaddr index, MemTxAttrs attrs)
  {
-@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+index XXXXXXX..XXXXXXX 100644
- static void io_mem_init(void)
+--- a/accel/tcg/user-exec.c
- {
++++ b/accel/tcg/user-exec.c
--    memory_region_init_io(&io_mem_rom, NULL, &readonly_mem_ops,
+@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
--                          NULL, NULL, UINT64_MAX);
+     return size ? g2h(env_cpu(env), addr) : NULL;
-     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
+ }
-                           NULL, UINT64_MAX);
++tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
++                                        void **hostp)
-     assert(n == PHYS_SECTION_UNASSIGNED);
++{
-     n = dummy_section(&d->map, fv, &io_mem_notdirty);
++    int flags;
-     assert(n == PHYS_SECTION_NOTDIRTY);
++
--    n = dummy_section(&d->map, fv, &io_mem_rom);
++    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
--    assert(n == PHYS_SECTION_ROM);
++    g_assert(flags == 0);
++
-     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
++    if (hostp) {
++        *hostp = g2h_untagged(addr);
 +    }
 +    return addr;
 +}
 +
  /* The softmmu versions of these helpers are in cputlb.c.  */
  /*
 --
-.17.1
+.34.1

-New patch
+[PULL 09/20] accel/tcg: Unlock mmap_lock after longjmp
+The mmap_lock is held around tb_gen_code.  While the comment
+is correct that the lock is dropped when tb_gen_code runs out
+of memory, the lock is *not* dropped when an exception is
+raised reading code for translation.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cpu-exec.c  | 12 ++++++------
+ accel/tcg/user-exec.c |  3 ---
+files changed, 6 insertions(+), 9 deletions(-)
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cpu-exec.c
++++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
+         cpu_tb_exec(cpu, tb, &tb_exit);
+         cpu_exec_exit(cpu);
+     } else {
+-        /*
+-         * The mmap_lock is dropped by tb_gen_code if it runs out of
+-         * memory.
+-         */
+ #ifndef CONFIG_SOFTMMU
+         clear_helper_retaddr();
+-        tcg_debug_assert(!have_mmap_lock());
++        if (have_mmap_lock()) {
++            mmap_unlock();
++        }
+ #endif
+         if (qemu_mutex_iothread_locked()) {
+             qemu_mutex_unlock_iothread();
+@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
+ #ifndef CONFIG_SOFTMMU
+         clear_helper_retaddr();
+-        tcg_debug_assert(!have_mmap_lock());
++        if (have_mmap_lock()) {
++            mmap_unlock();
++        }
+ #endif
+         if (qemu_mutex_iothread_locked()) {
+             qemu_mutex_unlock_iothread();
+diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/user-exec.c
++++ b/accel/tcg/user-exec.c
+@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
+          * (and if the translator doesn't handle page boundaries correctly
+          * there's little we can do about that here).  Therefore, do not
+          * trigger the unwinder.
+-         *
+-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
+          */
+-        mmap_unlock();
+         *pc = 0;
+         return MMU_INST_FETCH;
+     }
+--
+.34.1

-[PULL 10/16] cputlb: Partially inline memory_region_section_get_iotlb
+[PULL 10/20] accel/tcg: Make tb_htable_lookup static
-There is only one caller, tlb_set_page_with_attrs.  We cannot
+The function is not used outside of cpu-exec.c.  Move it and
-inline the entire function because the AddressSpaceDispatch
+its subroutines up in the file, before the first use.
 structure is private to exec.c, and cannot easily be moved to
 include/exec/memory-internal.h.
-Compute is_ram and is_romd once within tlb_set_page_with_attrs.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Fold the number of tests against these predicates.  Compute
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-cpu_physical_memory_is_clean outside of the tlb lock region.
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h |  6 +---
+ include/exec/exec-all.h |   3 -
- accel/tcg/cputlb.c      | 68 ++++++++++++++++++++++++++---------------
+ accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
- exec.c                  | 22 ++-----------
+files changed, 61 insertions(+), 64 deletions(-)
 files changed, 47 insertions(+), 49 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
                                    hwaddr *xlat, hwaddr *plen,
                                    MemTxAttrs attrs, int *prot);
  hwaddr memory_region_section_get_iotlb(CPUState *cpu,
 -                                       MemoryRegionSection *section,
 -                                       target_ulong vaddr,
 -                                       hwaddr paddr, hwaddr xlat,
 -                                       int prot,
 -                                       target_ulong *address);
 +                                       MemoryRegionSection *section);
  #endif
+ void tb_flush(CPUState *cpu);
- /* vl.c */
+ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 -                                   target_ulong cs_base, uint32_t flags,
 -                                   uint32_t cflags);
  void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
  /* GETPC is the true target of the return instruction that we'll execute.  */
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cputlb.c
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
-     MemoryRegionSection *section;
+     return cflags;
-     unsigned int index;
+ }
-     target_ulong address;
--    target_ulong code_address;
++struct tb_desc {
-+    target_ulong write_address;
++    target_ulong pc;
-     uintptr_t addend;
++    target_ulong cs_base;
-     CPUTLBEntry *te, tn;
++    CPUArchState *env;
-     hwaddr iotlb, xlat, sz, paddr_page;
++    tb_page_addr_t phys_page1;
-     target_ulong vaddr_page;
++    uint32_t flags;
-     int asidx = cpu_asidx_from_attrs(cpu, attrs);
++    uint32_t cflags;
-     int wp_flags;
++    uint32_t trace_vcpu_dstate;
-+    bool is_ram, is_romd;
++};
      assert_cpu_is_self(cpu);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      if (attrs.byte_swap) {
          address |= TLB_BSWAP;
      }
 -    if (!memory_region_is_ram(section->mr) &&
 -        !memory_region_is_romd(section->mr)) {
 -        /* IO memory case */
 -        address |= TLB_MMIO;
 -        addend = 0;
 -    } else {
 +
-+    is_ram = memory_region_is_ram(section->mr);
++static bool tb_lookup_cmp(const void *p, const void *d)
-+    is_romd = memory_region_is_romd(section->mr);
++{
 +    const TranslationBlock *tb = p;
 +    const struct tb_desc *desc = d;
 +
-+    if (is_ram || is_romd) {
++    if (tb->pc == desc->pc &&
-+        /* RAM and ROMD both have associated host memory. */
++        tb->page_addr[0] == desc->phys_page1 &&
-         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
++        tb->cs_base == desc->cs_base &&
-+    } else {
++        tb->flags == desc->flags &&
-+        /* I/O does not; force the host address to NULL. */
++        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-+        addend = 0;
++        tb_cflags(tb) == desc->cflags) {
-+    }
++        /* check next page if needed */
 +        if (tb->page_addr[1] == -1) {
 +            return true;
 +        } else {
 +            tb_page_addr_t phys_page2;
 +            target_ulong virt_page2;
 +
-+    write_address = address;
++            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-+    if (is_ram) {
++            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-+        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
++            if (tb->page_addr[1] == phys_page2) {
-+        /*
++                return true;
 +         * Computing is_clean is expensive; avoid all that unless
 +         * the page is actually writable.
 +         */
 +        if (prot & PAGE_WRITE) {
 +            if (section->readonly) {
 +                write_address |= TLB_DISCARD_WRITE;
 +            } else if (cpu_physical_memory_is_clean(iotlb)) {
 +                write_address |= TLB_NOTDIRTY;
 +            }
 +        }
-+    } else {
++    }
-+        /* I/O or ROMD */
++    return false;
-+        iotlb = memory_region_section_get_iotlb(cpu, section) + xlat;
++}
-+        /*
++
-+         * Writes to romd devices must go through MMIO to enable write.
++static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-+         * Reads to romd devices go through the ram_ptr found above,
++                                          target_ulong cs_base, uint32_t flags,
-+         * but of course reads to I/O must go through MMIO.
++                                          uint32_t cflags)
-+         */
++{
-+        write_address |= TLB_MMIO;
++    tb_page_addr_t phys_pc;
-+        if (!is_romd) {
++    struct tb_desc desc;
-+            address = write_address;
++    uint32_t h;
-+        }
++
-     }
++    desc.env = cpu->env_ptr;
++    desc.cs_base = cs_base;
--    code_address = address;
++    desc.flags = flags;
--    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
++    desc.cflags = cflags;
--                                            paddr_page, xlat, prot, &address);
++    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-     wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
++    desc.pc = pc;
-                                               TARGET_PAGE_SIZE);
++    phys_pc = get_page_addr_code(desc.env, pc);
++    if (phys_pc == -1) {
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
++        return NULL;
-     /*
++    }
-      * At this point iotlb contains a physical section number in the lower
++    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-      * TARGET_PAGE_BITS, and either
++    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
--     *  + the ram_addr_t of the page base of the target RAM (if NOTDIRTY or ROM)
++    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
--     *  + the offset within section->mr of the page base (otherwise)
++}
-+     *  + the ram_addr_t of the page base of the target RAM (RAM)
++
-+     *  + the offset within section->mr of the page base (I/O, ROMD)
+ /* Might cause an exception, so have a longjmp destination ready */
-      * We subtract the vaddr_page (which is page aligned and thus won't
+ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
-      * disturb the low bits) to give an offset which can be added to the
+                                           target_ulong cs_base,
-      * (non-page-aligned) vaddr of the eventual memory access to get
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+     end_exclusive();
-     }
+ }
-     if (prot & PAGE_EXEC) {
+-struct tb_desc {
--        tn.addr_code = code_address;
+-    target_ulong pc;
-+        tn.addr_code = address;
+-    target_ulong cs_base;
-     } else {
+-    CPUArchState *env;
-         tn.addr_code = -1;
+-    tb_page_addr_t phys_page1;
-     }
+-    uint32_t flags;
+-    uint32_t cflags;
-     tn.addr_write = -1;
+-    uint32_t trace_vcpu_dstate;
-     if (prot & PAGE_WRITE) {
+-};
--        tn.addr_write = address;
+-
--        if (memory_region_is_romd(section->mr)) {
+-static bool tb_lookup_cmp(const void *p, const void *d)
--            /* Use the MMIO path so that the device can switch states. */
+-{
--            tn.addr_write |= TLB_MMIO;
+-    const TranslationBlock *tb = p;
--        } else if (memory_region_is_ram(section->mr)) {
+-    const struct tb_desc *desc = d;
--            if (section->readonly) {
+-
--                tn.addr_write |= TLB_DISCARD_WRITE;
+-    if (tb->pc == desc->pc &&
--            } else if (cpu_physical_memory_is_clean(
+-        tb->page_addr[0] == desc->phys_page1 &&
--                        memory_region_get_ram_addr(section->mr) + xlat)) {
+-        tb->cs_base == desc->cs_base &&
--                tn.addr_write |= TLB_NOTDIRTY;
+-        tb->flags == desc->flags &&
 -        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 -        tb_cflags(tb) == desc->cflags) {
 -        /* check next page if needed */
 -        if (tb->page_addr[1] == -1) {
 -            return true;
 -        } else {
 -            tb_page_addr_t phys_page2;
 -            target_ulong virt_page2;
 -
 -            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 -            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 -            if (tb->page_addr[1] == phys_page2) {
 -                return true;
 -            }
 -        }
-+        tn.addr_write = write_address;
+-    }
-         if (prot & PAGE_WRITE_INV) {
+-    return false;
-             tn.addr_write |= TLB_INVALID_MASK;
+-}
-         }
+-
-diff --git a/exec.c b/exec.c
+-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-index XXXXXXX..XXXXXXX 100644
+-                                   target_ulong cs_base, uint32_t flags,
---- a/exec.c
+-                                   uint32_t cflags)
-+++ b/exec.c
+-{
-@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
+-    tb_page_addr_t phys_pc;
+-    struct tb_desc desc;
- /* Called from RCU critical section */
+-    uint32_t h;
- hwaddr memory_region_section_get_iotlb(CPUState *cpu,
+-
--                                       MemoryRegionSection *section,
+-    desc.env = cpu->env_ptr;
--                                       target_ulong vaddr,
+-    desc.cs_base = cs_base;
--                                       hwaddr paddr, hwaddr xlat,
+-    desc.flags = flags;
--                                       int prot,
+-    desc.cflags = cflags;
--                                       target_ulong *address)
+-    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-+                                       MemoryRegionSection *section)
+-    desc.pc = pc;
 -    phys_pc = get_page_addr_code(desc.env, pc);
 -    if (phys_pc == -1) {
 -        return NULL;
 -    }
 -    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 -    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 -    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 -}
 -
  void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
  {
--    hwaddr iotlb;
+     if (TCG_TARGET_HAS_direct_jump) {
 -
 -    if (memory_region_is_ram(section->mr)) {
 -        /* Normal RAM.  */
 -        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
 -    } else {
 -        AddressSpaceDispatch *d;
 -
 -        d = flatview_to_dispatch(section->fv);
 -        iotlb = section - d->map.sections;
 -        iotlb += xlat;
 -    }
 -
 -    return iotlb;
 +    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
 +    return section - d->map.sections;
  }
  #endif /* defined(CONFIG_USER_ONLY) */
 --
-.17.1
+.34.1

-[PULL 09/16] cputlb: Move NOTDIRTY handling from I/O path to TLB path
+[PULL 11/20] accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
-Pages that we want to track for NOTDIRTY are RAM.  We do not
+The base qemu_ram_addr_from_host function is already in
-really need to go through the I/O path to handle them.
+softmmu/physmem.c; move the nofail version to be adjacent.
-Acked-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-common.h |  2 --
+ include/exec/cpu-common.h |  1 +
- accel/tcg/cputlb.c        | 26 +++++++++++++++++---
+ accel/tcg/cputlb.c        | 12 ------------
- exec.c                    | 50 ---------------------------------------
+ softmmu/physmem.c         | 12 ++++++++++++
- memory.c                  | 16 -------------
+files changed, 13 insertions(+), 12 deletions(-)
 files changed, 23 insertions(+), 71 deletions(-)
 diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/cpu-common.h
 +++ b/include/exec/cpu-common.h
-@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
+@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
+ void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
- void cpu_flush_icache_range(hwaddr start, hwaddr len);
+ /* This should not be used by devices.  */
+ ram_addr_t qemu_ram_addr_from_host(void *ptr);
--extern struct MemoryRegion io_mem_notdirty;
++ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
--
+ RAMBlock *qemu_ram_block_by_name(const char *name);
- typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
+ RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
+                                    ram_addr_t *offset);
  int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
-     mr = section->mr;
+                             prot, mmu_idx, size);
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
      cpu->mem_io_pc = retaddr;
 -    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
      mr = section->mr;
      mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 -    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
 +    if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
      }
      cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
          /* Handle I/O access.  */
 -        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
 +        if (tlb_addr & TLB_MMIO) {
              io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
                        op ^ (need_swap * MO_BSWAP));
              return;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          haddr = (void *)((uintptr_t)addr + entry->addend);
 +        /* Handle clean RAM pages.  */
 +        if (tlb_addr & TLB_NOTDIRTY) {
 +            NotDirtyInfo ndi;
 +
 +            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
 +            env_cpu(env)->mem_io_pc = retaddr;
 +
 +            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
 +                                          addr + iotlbentry->addr, size);
 +
 +            if (unlikely(need_swap)) {
 +                store_memop(haddr, val, op ^ MO_BSWAP);
 +            } else {
 +                store_memop(haddr, val, op);
 +            }
 +
 +            memory_notdirty_write_complete(&ndi);
 +            return;
 +        }
 +
          /*
           * Keep these two store_memop separate to ensure that the compiler
           * is able to fold the entire function to a single instruction.
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
  AddressSpace address_space_io;
  AddressSpace address_space_memory;
 -MemoryRegion io_mem_notdirty;
  static MemoryRegion io_mem_unassigned;
  #endif
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
  } subpage_t;
  #define PHYS_SECTION_UNASSIGNED 0
 -#define PHYS_SECTION_NOTDIRTY 1
  static void io_mem_init(void);
  static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
      if (memory_region_is_ram(section->mr)) {
          /* Normal RAM.  */
          iotlb = memory_region_get_ram_addr(section->mr) + xlat;
 -        if (!section->readonly) {
 -            iotlb |= PHYS_SECTION_NOTDIRTY;
 -        }
      } else {
          AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
      }
  }
--/* Called within RCU critical section.  */
+-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
 -static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
 -                               uint64_t val, unsigned size)
 -{
--    NotDirtyInfo ndi;
+-    ram_addr_t ram_addr;
 -
--    memory_notdirty_write_prepare(&ndi, current_cpu, current_cpu->mem_io_vaddr,
+-    ram_addr = qemu_ram_addr_from_host(ptr);
--                         ram_addr, size);
+-    if (ram_addr == RAM_ADDR_INVALID) {
--
+-        error_report("Bad ram pointer %p", ptr);
--    stn_p(qemu_map_ram_ptr(NULL, ram_addr), size, val);
+-        abort();
--    memory_notdirty_write_complete(&ndi);
+-    }
 -    return ram_addr;
 -}
 -
--static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
+ /*
--                                 unsigned size, bool is_write,
+  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
--                                 MemTxAttrs attrs)
+  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
--{
+diff --git a/softmmu/physmem.c b/softmmu/physmem.c
--    return is_write;
+index XXXXXXX..XXXXXXX 100644
--}
+--- a/softmmu/physmem.c
--
++++ b/softmmu/physmem.c
--static const MemoryRegionOps notdirty_mem_ops = {
+@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
--    .write = notdirty_mem_write,
+     return block->offset + offset;
 -    .valid.accepts = notdirty_mem_accepts,
 -    .endianness = DEVICE_NATIVE_ENDIAN,
 -    .valid = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -    .impl = {
 -        .min_access_size = 1,
 -        .max_access_size = 8,
 -        .unaligned = false,
 -    },
 -};
 -
  /* Generate a debug exception if a watchpoint has been hit.  */
  void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                            MemTxAttrs attrs, int flags, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
  {
      memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                            NULL, UINT64_MAX);
 -
 -    /* io_mem_notdirty calls tb_invalidate_phys_page_fast,
 -     * which can be called without the iothread mutex.
 -     */
 -    memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
 -                          NULL, UINT64_MAX);
 -    memory_region_clear_global_locking(&io_mem_notdirty);
  }
- AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
++ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
++{
++    ram_addr_t ram_addr;
-     n = dummy_section(&d->map, fv, &io_mem_unassigned);
++
-     assert(n == PHYS_SECTION_UNASSIGNED);
++    ram_addr = qemu_ram_addr_from_host(ptr);
--    n = dummy_section(&d->map, fv, &io_mem_notdirty);
++    if (ram_addr == RAM_ADDR_INVALID) {
--    assert(n == PHYS_SECTION_NOTDIRTY);
++        error_report("Bad ram pointer %p", ptr);
++        abort();
-     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
++    }
++    return ram_addr;
-diff --git a/memory.c b/memory.c
++}
-index XXXXXXX..XXXXXXX 100644
++
---- a/memory.c
+ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
-+++ b/memory.c
+                                  MemTxAttrs attrs, void *buf, hwaddr len);
-@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
+ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
      tmp = mr->ops->read(mr->opaque, addr, size);
      if (mr->subpage) {
          trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
      r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs);
      if (mr->subpage) {
          trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
      if (mr->subpage) {
          trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
      if (mr->subpage) {
          trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
 -    } else if (mr == &io_mem_notdirty) {
 -        /* Accesses to code which has previously been translated into a TB show
 -         * up in the MMIO path, as accesses to the io_mem_notdirty
 -         * MemoryRegion. */
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
 --
-.17.1
+.34.1

-[PULL 06/16] cputlb: Introduce TLB_BSWAP
+[PULL 12/20] accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
-Handle bswap on ram directly in load/store_helper.  This fixes a
+Simplify the implementation of get_page_addr_code_hostp
-bug with the previous implementation in that one cannot use the
+by reusing the existing probe_access infrastructure.
 I/O path for RAM.
-Fixes: a26fc6f5152b47f1
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h |  4 ++-
+ accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
- accel/tcg/cputlb.c     | 72 +++++++++++++++++++++++++-----------------
+file changed, 26 insertions(+), 50 deletions(-)
 files changed, 46 insertions(+), 30 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
-+++ b/include/exec/cpu-all.h
-@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
- #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
- /* Set if TLB entry contains a watchpoint.  */
- #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
-+/* Set if TLB entry requires byte swap.  */
-+#define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
- /* Use this mask to check interception with an alignment mask
-  * in a TCG backend.
-  */
- #define TLB_FLAGS_MASK \
--    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
-+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
- /**
-  * tlb_hit_page: return true if page aligned @addr is a hit against the
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
-         address |= TLB_INVALID_MASK;
+   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
-     }
+                  (ADDR) & TARGET_PAGE_MASK)
-     if (attrs.byte_swap) {
--        /* Force the access through the I/O slow path.  */
+-/*
--        address |= TLB_MMIO;
+- * Return a ram_addr_t for the virtual address for execution.
-+        address |= TLB_BSWAP;
+- *
-     }
+- * Return -1 if we can't translate and execute from an entire page
-     if (!memory_region_is_ram(section->mr) &&
+- * of RAM.  This will force us to execute by loading and translating
-         !memory_region_is_romd(section->mr)) {
+- * one insn at a time, without caching.
-@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+- *
-     bool locked = false;
+- * NOTE: This function will trigger an exception if the page is
-     MemTxResult r;
+- * not executable.
+- */
--    if (iotlbentry->attrs.byte_swap) {
+-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
--        op ^= MO_BSWAP;
+-                                        void **hostp)
 -{
 -    uintptr_t mmu_idx = cpu_mmu_index(env, true);
 -    uintptr_t index = tlb_index(env, mmu_idx, addr);
 -    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
 -    void *p;
 -
 -    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
 -        if (!VICTIM_TLB_HIT(addr_code, addr)) {
 -            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
 -            index = tlb_index(env, mmu_idx, addr);
 -            entry = tlb_entry(env, mmu_idx, addr);
 -
 -            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
 -                /*
 -                 * The MMU protection covers a smaller range than a target
 -                 * page, so we must redo the MMU check for every insn.
 -                 */
 -                return -1;
 -            }
 -        }
 -        assert(tlb_hit(entry->addr_code, addr));
 -    }
 -
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+-    if (unlikely(entry->addr_code & TLB_MMIO)) {
-     mr = section->mr;
+-        /* The region is not backed by RAM.  */
-     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+-        if (hostp) {
-@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+-            *hostp = NULL;
-     bool locked = false;
+-        }
-     MemTxResult r;
+-        return -1;
 -    if (iotlbentry->attrs.byte_swap) {
 -        op ^= MO_BSWAP;
 -    }
 -
-     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+-    p = (void *)((uintptr_t)addr + entry->addend);
-     mr = section->mr;
+-    if (hostp) {
-     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+-        *hostp = p;
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
+-    }
-                              wp_access, retaddr);
+-    return qemu_ram_addr_from_host_nofail(p);
-     }
+-}
 -    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
 -        /* I/O access */
 +    /* Reject I/O access, or other required slow-path.  */
 +    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
          return NULL;
      }
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
          CPUIOTLBEntry *iotlbentry;
 +        bool need_swap;
          /* For anything that is unaligned, recurse through full_load.  */
          if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
                                   iotlbentry->attrs, BP_MEM_READ, retaddr);
 -
--            /* The backing page may or may not require I/O.  */
+ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
--            tlb_addr &= ~TLB_WATCHPOINT;
+                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
--            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
+ {
--                goto do_aligned_access;
+@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
--            }
+     return flags ? NULL : host;
-         }
+ }
-+        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
++/*
 + * Return a ram_addr_t for the virtual address for execution.
 + *
 + * Return -1 if we can't translate and execute from an entire page
 + * of RAM.  This will force us to execute by loading and translating
 + * one insn at a time, without caching.
 + *
 + * NOTE: This function will trigger an exception if the page is
 + * not executable.
 + */
 +tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 +                                        void **hostp)
 +{
 +    void *p;
 +
-         /* Handle I/O access.  */
++    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
--        return io_readx(env, iotlbentry, mmu_idx, addr,
++                                cpu_mmu_index(env, true), false, &p, 0);
--                        retaddr, access_type, op);
++    if (p == NULL) {
-+        if (likely(tlb_addr & TLB_MMIO)) {
++        return -1;
-+            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
++    }
-+                            access_type, op ^ (need_swap * MO_BSWAP));
++    if (hostp) {
-+        }
++        *hostp = p;
 +    }
 +    return qemu_ram_addr_from_host_nofail(p);
 +}
 +
-+        haddr = (void *)((uintptr_t)addr + entry->addend);
+ #ifdef CONFIG_PLUGIN
-+
+ /*
-+        /*
+  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
 +         * Keep these two load_memop separate to ensure that the compiler
 +         * is able to fold the entire function to a single instruction.
 +         * There is a build-time assert inside to remind you of this.  ;-)
 +         */
 +        if (unlikely(need_swap)) {
 +            return load_memop(haddr, op ^ MO_BSWAP);
 +        }
 +        return load_memop(haddr, op);
      }
      /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
          return res & MAKE_64BIT_MASK(0, size * 8);
      }
 - do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
      return load_memop(haddr, op);
  }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
          CPUIOTLBEntry *iotlbentry;
 +        bool need_swap;
          /* For anything that is unaligned, recurse through byte stores.  */
          if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
                                   iotlbentry->attrs, BP_MEM_WRITE, retaddr);
 -
 -            /* The backing page may or may not require I/O.  */
 -            tlb_addr &= ~TLB_WATCHPOINT;
 -            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
 -                goto do_aligned_access;
 -            }
          }
 +        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 +
          /* Handle I/O access.  */
 -        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
 +        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
 +            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
 +                      op ^ (need_swap * MO_BSWAP));
 +            return;
 +        }
 +
 +        haddr = (void *)((uintptr_t)addr + entry->addend);
 +
 +        /*
 +         * Keep these two store_memop separate to ensure that the compiler
 +         * is able to fold the entire function to a single instruction.
 +         * There is a build-time assert inside to remind you of this.  ;-)
 +         */
 +        if (unlikely(need_swap)) {
 +            store_memop(haddr, val, op ^ MO_BSWAP);
 +        } else {
 +            store_memop(haddr, val, op);
 +        }
          return;
      }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          return;
      }
 - do_aligned_access:
      haddr = (void *)((uintptr_t)addr + entry->addend);
      store_memop(haddr, val, op);
  }
 --
-.17.1
+.34.1

-New patch
+[PULL 13/20] accel/tcg: Document the faulting lookup in tb_lookup_cmp
+It was non-obvious to me why we can raise an exception in
+the middle of a comparison function, but it works.
+While nearby, use TARGET_PAGE_ALIGN instead of open-coding.
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cpu-exec.c | 11 ++++++++++-
+file changed, 10 insertions(+), 1 deletion(-)
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cpu-exec.c
++++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
+             tb_page_addr_t phys_page2;
+             target_ulong virt_page2;
+-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
++            /*
++             * We know that the first page matched, and an otherwise valid TB
++             * encountered an incomplete instruction at the end of that page,
++             * therefore we know that generating a new TB from the current PC
++             * must also require reading from the next page -- even if the
++             * second pages do not match, and therefore the resulting insn
++             * is different for the new TB.  Therefore any exception raised
++             * here by the faulting lookup is not premature.
++             */
++            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
+             phys_page2 = get_page_addr_code(desc->env, virt_page2);
+             if (tb->page_addr[1] == phys_page2) {
+                 return true;
+--
+.34.1

-New patch
+[PULL 14/20] accel/tcg: Remove translator_ldsw
+The only user can easily use translator_lduw and
+adjust the type to signed during the return.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/translator.h   | 1 -
+ target/i386/tcg/translate.c | 2 +-
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/include/exec/translator.h b/include/exec/translator.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/translator.h
++++ b/include/exec/translator.h
+@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
+ #define FOR_EACH_TRANSLATOR_LD(F)                                       \
+     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
+-    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
+     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
+     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
+     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
+ static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
++    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
+ }
+ static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
+--
+.34.1

-[PULL 16/16] cputlb: Pass retaddr to tb_check_watchpoint
+[PULL 15/20] accel/tcg: Add pc and host_pc params to gen_intermediate_code
-Fixes the previous TLB_WATCHPOINT patches because we are currently
+Pass these along to translator_loop -- pc may be used instead
-failing to set cpu->mem_io_pc with the call to cpu_check_watchpoint.
+of tb->pc, and host_pc is currently unused.  Adjust all targets
-Pass down the retaddr directly because it's readily available.
+at one time.
-Fixes: 50b107c5d61
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h | 2 +-
+ include/exec/exec-all.h       |  1 -
- accel/tcg/translate-all.c | 6 +++---
+ include/exec/translator.h     | 24 ++++++++++++++++++++----
- exec.c                    | 2 +-
+ accel/tcg/translate-all.c     |  6 ++++--
-files changed, 5 insertions(+), 5 deletions(-)
+ accel/tcg/translator.c        |  9 +++++----
  target/alpha/translate.c      |  5 +++--
  target/arm/translate.c        |  5 +++--
  target/avr/translate.c        |  5 +++--
  target/cris/translate.c       |  5 +++--
  target/hexagon/translate.c    |  6 ++++--
  target/hppa/translate.c       |  5 +++--
  target/i386/tcg/translate.c   |  5 +++--
  target/loongarch/translate.c  |  6 ++++--
  target/m68k/translate.c       |  5 +++--
  target/microblaze/translate.c |  5 +++--
  target/mips/tcg/translate.c   |  5 +++--
  target/nios2/translate.c      |  5 +++--
  target/openrisc/translate.c   |  6 ++++--
  target/ppc/translate.c        |  5 +++--
  target/riscv/translate.c      |  5 +++--
  target/rx/translate.c         |  5 +++--
  target/s390x/tcg/translate.c  |  5 +++--
  target/sh4/translate.c        |  5 +++--
  target/sparc/translate.c      |  5 +++--
  target/tricore/translate.c    |  6 ++++--
  target/xtensa/translate.c     |  6 ++++--
 files changed, 97 insertions(+), 53 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/include/exec/exec-all.h
-+++ b/accel/tcg/translate-all.h
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
+@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
-                                   tb_page_addr_t start, int len,
+ #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
-                                   uintptr_t retaddr);
+ #endif
- void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
--void tb_check_watchpoint(CPUState *cpu);
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
-+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
+ void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
+                           target_ulong *data);
- #ifdef CONFIG_USER_ONLY
- int page_unprotect(target_ulong address, uintptr_t pc);
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/translator.h
 +++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/translate-all.h"
  #include "tcg/tcg.h"
 +/**
 + * gen_intermediate_code
 + * @cpu: cpu context
 + * @tb: translation block
 + * @max_insns: max number of instructions to translate
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + *
 + * This function must be provided by the target, which should create
 + * the target-specific DisasContext, and then invoke translator_loop.
 + */
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc);
  /**
   * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  /**
   * translator_loop:
 - * @ops: Target-specific operations.
 - * @db: Disassembly context.
   * @cpu: Target vCPU.
   * @tb: Translation block.
   * @max_insns: Maximum number of insns to translate.
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + * @ops: Target-specific operations.
 + * @db: Disassembly context.
   *
   * Generic translator loop.
   *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
   * - When single-stepping is enabled (system-wide or on the current vCPU).
   * - When too many instructions have been translated.
   */
 -void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
 -                     CPUState *cpu, TranslationBlock *tb, int max_insns);
 +void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                     target_ulong pc, void *host_pc,
 +                     const TranslatorOps *ops, DisasContextBase *db);
  void translator_loop_temp_check(DisasContextBase *db);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static bool tb_invalidate_phys_page(tb_page_addr_t addr, uintptr_t pc)
+@@ -XXX,XX +XXX,XX @@
  #include "exec/cputlb.h"
  #include "exec/translate-all.h"
 +#include "exec/translator.h"
  #include "qemu/bitmap.h"
  #include "qemu/qemu-print.h"
  #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      TCGProfile *prof = &tcg_ctx->prof;
      int64_t ti;
  #endif
++    void *host_pc;
  /* user-mode: call with mmap_lock held */
 -void tb_check_watchpoint(CPUState *cpu)
 +void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
  {
      TranslationBlock *tb;
      assert_memory_lock();
+     qemu_thread_jit_write();
--    tb = tcg_tb_lookup(cpu->mem_io_pc);
-+    tb = tcg_tb_lookup(retaddr);
+-    phys_pc = get_page_addr_code(env, pc);
-     if (tb) {
++    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
-         /* We can use retranslation to find the PC.  */
--        cpu_restore_state_from_tb(cpu, tb, cpu->mem_io_pc, true);
+     if (phys_pc == -1) {
-+        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
+         /* Generate a one-shot TB with 1 insn in it */
-         tb_phys_invalidate(tb, -1);
+@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     } else {
+     tcg_func_start(tcg_ctx);
-         /* The exception probably happened in a helper.  The CPU state should
-diff --git a/exec.c b/exec.c
+     tcg_ctx->cpu = env_cpu(env);
-index XXXXXXX..XXXXXXX 100644
+-    gen_intermediate_code(cpu, tb, max_insns);
---- a/exec.c
++    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
-+++ b/exec.c
+     assert(tb->size != 0);
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+     tcg_ctx->cpu = NULL;
-                 cpu->watchpoint_hit = wp;
+     max_insns = tb->icount;
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
-                 mmap_lock();
+index XXXXXXX..XXXXXXX 100644
--                tb_check_watchpoint(cpu);
+--- a/accel/tcg/translator.c
-+                tb_check_watchpoint(cpu, ra);
++++ b/accel/tcg/translator.c
-                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
+@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
-                     cpu->exception_index = EXCP_DEBUG;
+ #endif
-                     mmap_unlock();
+ }
 -void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
 -                     CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                     target_ulong pc, void *host_pc,
 +                     const TranslatorOps *ops, DisasContextBase *db)
  {
      uint32_t cflags = tb_cflags(tb);
      bool plugin_enabled;
      /* Initialize DisasContext */
      db->tb = tb;
 -    db->pc_first = tb->pc;
 -    db->pc_next = db->pc_first;
 +    db->pc_first = pc;
 +    db->pc_next = pc;
      db->is_jmp = DISAS_NEXT;
      db->num_insns = 0;
      db->max_insns = max_insns;
 diff --git a/target/alpha/translate.c b/target/alpha/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/translate.c
 +++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
      .disas_log          = alpha_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
      const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
      }
  #endif
 -    translator_loop(ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
  }
  void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
 diff --git a/target/avr/translate.c b/target/avr/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/translate.c
 +++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
      .disas_log          = avr_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
 -    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
 diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/translate.c
 +++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
      .disas_log          = cris_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
  }
  void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/translate.c
 +++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
      .disas_log          = hexagon_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &hexagon_tr_ops, &ctx.base);
  }
  #define NAME_LEN               64
 diff --git a/target/hppa/translate.c b/target/hppa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/translate.c
 +++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
      .disas_log          = hppa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
 diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/translate.c
 +++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
      .disas_log          = loongarch_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &loongarch_tr_ops, &ctx.base);
  }
  void loongarch_translate_init(void)
 diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/translate.c
 +++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
      .disas_log          = m68k_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
  }
  static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
 diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/translate.c
 +++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
      .disas_log          = mb_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
  }
  void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/translate.c
 +++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
      .disas_log          = mips_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
  }
  void mips_tcg_init(void)
 diff --git a/target/nios2/translate.c b/target/nios2/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/translate.c
 +++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
      .disas_log          = nios2_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
  }
  void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/translate.c
 +++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
      .disas_log          = openrisc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &openrisc_tr_ops, &ctx.base);
  }
  void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate.c
 +++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
      .disas_log          = ppc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
      .disas_log          = riscv_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
  }
  void riscv_translate_init(void)
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/translate.c
 +++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
      .disas_log          = rx_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
 diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/translate.c
 +++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
      .disas_log          = s390x_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
      .disas_log          = sh4_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
      .disas_log          = sparc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
  }
  void sparc_tcg_init(void)
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &tricore_tr_ops, &ctx.base);
  }
  void
 diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/translate.c
 +++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
      .disas_log          = xtensa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc,
 +                    &xtensa_translator_ops, &dc.base);
  }
  void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 --
-.17.1
+.34.1

-[PULL 14/16] cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
+[PULL 16/20] accel/tcg: Add fast path for translator_ld*
-All callers pass false to this argument.  Remove it and pass the
+Cache the translation from guest to host address, so we may
-constant on to tb_invalidate_phys_page_range__locked.
+use direct loads when we hit on the primary translation page.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Look up the second translation page only once, during translation.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+This obviates another lookup of the second page within tb_gen_code
 after translation.
 Fixes a bug in that plugin_insn_append should be passed the bytes
 in the original memory order, not bswapped by pieces.
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/translate-all.h | 3 +--
+ include/exec/translator.h |  63 +++++++++++--------
- accel/tcg/translate-all.c | 6 ++----
+ accel/tcg/translate-all.c |  23 +++----
- exec.c                    | 4 ++--
+ accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
-files changed, 5 insertions(+), 8 deletions(-)
+files changed, 141 insertions(+), 71 deletions(-)
-diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.h
+--- a/include/exec/translator.h
-+++ b/accel/tcg/translate-all.h
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
+@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
- void page_collection_unlock(struct page_collection *set);
+  * Architecture-agnostic disassembly context.
- void tb_invalidate_phys_page_fast(struct page_collection *pages,
+  */
-                                   tb_page_addr_t start, int len);
+ typedef struct DisasContextBase {
--void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
+-    const TranslationBlock *tb;
--                                   int is_cpu_write_access);
++    TranslationBlock *tb;
-+void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
+     target_ulong pc_first;
- void tb_check_watchpoint(CPUState *cpu);
+     target_ulong pc_next;
+     DisasJumpType is_jmp;
- #ifdef CONFIG_USER_ONLY
+     int num_insns;
      int max_insns;
      bool singlestep_enabled;
 -#ifdef CONFIG_USER_ONLY
 -    /*
 -     * Guest address of the last byte of the last protected page.
 -     *
 -     * Pages containing the translated instructions are made non-writable in
 -     * order to achieve consistency in case another thread is modifying the
 -     * code while translate_insn() fetches the instruction bytes piecemeal.
 -     * Such writer threads are blocked on mmap_lock() in page_unprotect().
 -     */
 -    target_ulong page_protect_end;
 -#endif
 +    void *host_addr[2];
  } DisasContextBase;
  /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
   * the relevant information at translation time.
   */
 -#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 -                           abi_ptr pc, bool do_swap);                   \
 -    static inline type fullname(CPUArchState *env,                      \
 -                                DisasContextBase *dcbase, abi_ptr pc)   \
 -    {                                                                   \
 -        return fullname ## _swap(env, dcbase, pc, false);               \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
 +
 +static inline uint16_t
 +translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
 +                     abi_ptr pc, bool do_swap)
 +{
 +    uint16_t ret = translator_lduw(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap16(ret);
      }
 +    return ret;
 +}
 -#define FOR_EACH_TRANSLATOR_LD(F)                                       \
 -    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 -    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
 -    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
 -    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +static inline uint32_t
 +translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint32_t ret = translator_ldl(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap32(ret);
 +    }
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 -
 -#undef GEN_TRANSLATOR_LD
 +static inline uint64_t
 +translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint64_t ret = translator_ldq_swap(env, db, pc, false);
 +    if (do_swap) {
 +        ret = bswap64(ret);
 +    }
 +    return ret;
 +}
  /*
   * Return whether addr is on the same page as where disassembly started.
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
+@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
   *
   * Called with mmap_lock held for user-mode emulation
   */
 -void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
 -                                   int is_cpu_write_access)
 +void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end)
  {
-     struct page_collection *pages;
+     CPUArchState *env = cpu->env_ptr;
-     PageDesc *p;
+     TranslationBlock *tb, *existing_tb;
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
+-    tb_page_addr_t phys_pc, phys_page2;
-         return;
+-    target_ulong virt_page2;
-     }
++    tb_page_addr_t phys_pc;
-     pages = page_collection_lock(start, end);
+     tcg_insn_unit *gen_code_buf;
--    tb_invalidate_phys_page_range__locked(pages, p, start, end,
+     int gen_code_size, search_size, max_insns;
--                                          is_cpu_write_access);
+ #ifdef CONFIG_PROFILER
-+    tb_invalidate_phys_page_range__locked(pages, p, start, end, 0);
+@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
-     page_collection_unlock(pages);
+     tb->flags = flags;
      tb->cflags = cflags;
      tb->trace_vcpu_dstate = *cpu->trace_dstate;
 +    tb->page_addr[0] = phys_pc;
 +    tb->page_addr[1] = -1;
      tcg_ctx->tb_cflags = cflags;
   tb_overflow:
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      }
      /*
 -     * If the TB is not associated with a physical RAM page then
 -     * it must be a temporary one-insn TB, and we have nothing to do
 -     * except fill in the page_addr[] fields. Return early before
 -     * attempting to link to other TBs or add to the lookup table.
 +     * If the TB is not associated with a physical RAM page then it must be
 +     * a temporary one-insn TB, and we have nothing left to do. Return early
 +     * before attempting to link to other TBs or add to the lookup table.
       */
 -    if (phys_pc == -1) {
 -        tb->page_addr[0] = tb->page_addr[1] = -1;
 +    if (tb->page_addr[0] == -1) {
          return tb;
      }
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
       */
      tcg_tb_insert(tb);
 -    /* check next page if needed */
 -    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
 -    phys_page2 = -1;
 -    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
 -        phys_page2 = get_page_addr_code(env, virt_page2);
 -    }
      /*
       * No explicit memory barrier is required -- tb_link_page() makes the
       * TB visible in a consistent state.
       */
 -    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
 +    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
      /* if the TB already exists, discard what we just translated */
      if (unlikely(existing_tb != tb)) {
          uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
      return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
  }
-diff --git a/exec.c b/exec.c
+-static inline void translator_page_protect(DisasContextBase *dcbase,
-index XXXXXXX..XXXXXXX 100644
+-                                           target_ulong pc)
---- a/exec.c
+-{
-+++ b/exec.c
+-#ifdef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ const char *parse_cpu_option(const char *cpu_option)
+-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
- void tb_invalidate_phys_addr(target_ulong addr)
+-    page_protect(pc);
 -#endif
 -}
 -
  void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                       target_ulong pc, void *host_pc,
                       const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
      db->num_insns = 0;
      db->max_insns = max_insns;
      db->singlestep_enabled = cflags & CF_SINGLE_STEP;
 -    translator_page_protect(db, db->pc_next);
 +    db->host_addr[0] = host_pc;
 +    db->host_addr[1] = NULL;
 +
 +#ifdef CONFIG_USER_ONLY
 +    page_protect(pc);
 +#endif
      ops->init_disas_context(db, cpu);
      tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
  #endif
  }
 -static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
 -                                                 target_ulong pc, size_t len)
 +static void *translator_access(CPUArchState *env, DisasContextBase *db,
 +                               target_ulong pc, size_t len)
  {
-     mmap_lock();
+-#ifdef CONFIG_USER_ONLY
--    tb_invalidate_phys_page_range(addr, addr + 1, 0);
+-    target_ulong end = pc + len - 1;
-+    tb_invalidate_phys_page_range(addr, addr + 1);
++    void *host;
-     mmap_unlock();
++    target_ulong base, end;
 +    TranslationBlock *tb;
 -    if (end > dcbase->page_protect_end) {
 -        translator_page_protect(dcbase, end);
 +    tb = db->tb;
 +
 +    /* Use slow path if first page is MMIO. */
 +    if (unlikely(tb->page_addr[0] == -1)) {
 +        return NULL;
      }
 +
 +    end = pc + len - 1;
 +    if (likely(is_same_page(db, end))) {
 +        host = db->host_addr[0];
 +        base = db->pc_first;
 +    } else {
 +        host = db->host_addr[1];
 +        base = TARGET_PAGE_ALIGN(db->pc_first);
 +        if (host == NULL) {
 +            tb->page_addr[1] =
 +                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
 +#ifdef CONFIG_USER_ONLY
 +            page_protect(end);
  #endif
 +            /* We cannot handle MMIO as second page. */
 +            assert(tb->page_addr[1] != -1);
 +            host = db->host_addr[1];
 +        }
 +
 +        /* Use slow path when crossing pages. */
 +        if (is_same_page(db, pc)) {
 +            return NULL;
 +        }
 +    }
 +
 +    tcg_debug_assert(pc >= base);
 +    return host + (pc - base);
  }
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
+-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-         return;
+-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-     }
+-                           abi_ptr pc, bool do_swap)                    \
-     ram_addr = memory_region_get_ram_addr(mr) + addr;
+-    {                                                                   \
--    tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
+-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-+    tb_invalidate_phys_page_range(ram_addr, ram_addr + 1);
+-        type ret = load_fn(env, pc);                                    \
-     rcu_read_unlock();
+-        if (do_swap) {                                                  \
- }
+-            ret = swap_fn(ret);                                         \
+-        }                                                               \
 -        plugin_insn_append(pc, &ret, sizeof(ret));                      \
 -        return ret;                                                     \
 +uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint8_t ret;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldub_p(p);
      }
 +    ret = cpu_ldub_code(env, pc);
 +    plugin_insn_append(pc, &ret, sizeof(ret));
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 +uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint16_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 -#undef GEN_TRANSLATOR_LD
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return lduw_p(p);
 +    }
 +    ret = cpu_lduw_code(env, pc);
 +    plug = tswap16(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 +
 +uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint32_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldl_p(p);
 +    }
 +    ret = cpu_ldl_code(env, pc);
 +    plug = tswap32(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 +
 +uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
 +{
 +    uint64_t ret, plug;
 +    void *p = translator_access(env, db, pc, sizeof(ret));
 +
 +    if (p) {
 +        plugin_insn_append(pc, p, sizeof(ret));
 +        return ldq_p(p);
 +    }
 +    ret = cpu_ldq_code(env, pc);
 +    plug = tswap64(ret);
 +    plugin_insn_append(pc, &plug, sizeof(ret));
 +    return ret;
 +}
 --
-.17.1
+.34.1

-New patch
+[PULL 17/20] target/s390x: Make translator stop before the end of a page
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+Right now translator stops right *after* the end of a page, which
+breaks reporting of fault locations when the last instruction of a
+multi-insn translation block crosses a page boundary.
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/s390x/tcg/translate.c     |  15 +++-
+ tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
+ tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
+ tests/tcg/s390x/Makefile.target  |   1 +
+files changed, 257 insertions(+), 4 deletions(-)
+ create mode 100644 tests/tcg/s390x/noexec.c
+ create mode 100644 tests/tcg/multiarch/noexec.c.inc
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/tcg/translate.c
++++ b/target/s390x/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
+     dc->insn_start = tcg_last_op();
+ }
++static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
++                                uint64_t pc)
++{
++    uint64_t insn = ld_code2(env, s, pc);
++
++    return pc + get_ilen((insn >> 8) & 0xff);
++}
++
+ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+ {
+     CPUS390XState *env = cs->env_ptr;
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+     dc->base.is_jmp = translate_one(env, dc);
+     if (dc->base.is_jmp == DISAS_NEXT) {
+-        uint64_t page_start;
+-
+-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
+-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
++        if (!is_same_page(dcbase, dc->base.pc_next) ||
++            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
++            dc->ex_value) {
+             dc->base.is_jmp = DISAS_TOO_MANY;
+         }
+     }
+diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/tcg/s390x/noexec.c
+@@ -XXX,XX +XXX,XX @@
++#include "../multiarch/noexec.c.inc"
++
++static void *arch_mcontext_pc(const mcontext_t *ctx)
++{
++    return (void *)ctx->psw.addr;
++}
++
++static int arch_mcontext_arg(const mcontext_t *ctx)
++{
++    return ctx->gregs[2];
++}
++
++static void arch_flush(void *p, int len)
++{
++}
++
++extern char noexec_1[];
++extern char noexec_2[];
++extern char noexec_end[];
++
++asm("noexec_1:\n"
++    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
++    "noexec_2:\n"
++    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
++    "   br %r14\n"          /* return */
++    "noexec_end:");
++
++extern char exrl_1[];
++extern char exrl_2[];
++extern char exrl_end[];
++
++asm("exrl_1:\n"
++    "   exrl %r0, exrl_2\n"
++    "   br %r14\n"
++    "exrl_2:\n"
++    "   lgfi %r2,2\n"
++    "exrl_end:");
++
++int main(void)
++{
++    struct noexec_test noexec_tests[] = {
++        {
++            .name = "fallthrough",
++            .test_code = noexec_1,
++            .test_len = noexec_end - noexec_1,
++            .page_ofs = noexec_1 - noexec_2,
++            .entry_ofs = noexec_1 - noexec_2,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = 0,
++            .expected_arg = 1,
++        },
++        {
++            .name = "jump",
++            .test_code = noexec_1,
++            .test_len = noexec_end - noexec_1,
++            .page_ofs = noexec_1 - noexec_2,
++            .entry_ofs = 0,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = 0,
++            .expected_arg = 0,
++        },
++        {
++            .name = "exrl",
++            .test_code = exrl_1,
++            .test_len = exrl_end - exrl_1,
++            .page_ofs = exrl_1 - exrl_2,
++            .entry_ofs = exrl_1 - exrl_2,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = exrl_1 - exrl_2,
++            .expected_arg = 0,
++        },
++        {
++            .name = "fallthrough [cross]",
++            .test_code = noexec_1,
++            .test_len = noexec_end - noexec_1,
++            .page_ofs = noexec_1 - noexec_2 - 2,
++            .entry_ofs = noexec_1 - noexec_2 - 2,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = -2,
++            .expected_arg = 1,
++        },
++        {
++            .name = "jump [cross]",
++            .test_code = noexec_1,
++            .test_len = noexec_end - noexec_1,
++            .page_ofs = noexec_1 - noexec_2 - 2,
++            .entry_ofs = -2,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = -2,
++            .expected_arg = 0,
++        },
++        {
++            .name = "exrl [cross]",
++            .test_code = exrl_1,
++            .test_len = exrl_end - exrl_1,
++            .page_ofs = exrl_1 - exrl_2 - 2,
++            .entry_ofs = exrl_1 - exrl_2 - 2,
++            .expected_si_ofs = 0,
++            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
++            .expected_arg = 0,
++        },
++    };
++
++    return test_noexec(noexec_tests,
++                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
++}
+diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/tcg/multiarch/noexec.c.inc
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Common code for arch-specific MMU_INST_FETCH fault testing.
++ */
++
++#define _GNU_SOURCE
++
++#include <assert.h>
++#include <signal.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <errno.h>
++#include <unistd.h>
++#include <sys/mman.h>
++#include <sys/ucontext.h>
++
++/* Forward declarations. */
++
++static void *arch_mcontext_pc(const mcontext_t *ctx);
++static int arch_mcontext_arg(const mcontext_t *ctx);
++static void arch_flush(void *p, int len);
++
++/* Testing infrastructure. */
++
++struct noexec_test {
++    const char *name;
++    const char *test_code;
++    int test_len;
++    int page_ofs;
++    int entry_ofs;
++    int expected_si_ofs;
++    int expected_pc_ofs;
++    int expected_arg;
++};
++
++static void *page_base;
++static int page_size;
++static const struct noexec_test *current_noexec_test;
++
++static void handle_err(const char *syscall)
++{
++    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
++    exit(EXIT_FAILURE);
++}
++
++static void handle_segv(int sig, siginfo_t *info, void *ucontext)
++{
++    const struct noexec_test *test = current_noexec_test;
++    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
++    void *expected_si;
++    void *expected_pc;
++    void *pc;
++    int arg;
++
++    if (test == NULL) {
++        printf("[  FAILED  ] unexpected SEGV\n");
++        exit(EXIT_FAILURE);
++    }
++    current_noexec_test = NULL;
++
++    expected_si = page_base + test->expected_si_ofs;
++    if (info->si_addr != expected_si) {
++        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
++               info->si_addr, expected_si);
++        exit(EXIT_FAILURE);
++    }
++
++    pc = arch_mcontext_pc(mc);
++    expected_pc = page_base + test->expected_pc_ofs;
++    if (pc != expected_pc) {
++        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
++        exit(EXIT_FAILURE);
++    }
++
++    arg = arch_mcontext_arg(mc);
++    if (arg != test->expected_arg) {
++        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
++        exit(EXIT_FAILURE);
++    }
++
++    if (mprotect(page_base, page_size,
++                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
++        handle_err("mprotect");
++    }
++}
++
++static void test_noexec_1(const struct noexec_test *test)
++{
++    void *start = page_base + test->page_ofs;
++    void (*fn)(int arg) = page_base + test->entry_ofs;
++
++    memcpy(start, test->test_code, test->test_len);
++    arch_flush(start, test->test_len);
++
++    /* Trigger TB creation in order to test invalidation. */
++    fn(0);
++
++    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
++        handle_err("mprotect");
++    }
++
++    /* Trigger SEGV and check that handle_segv() ran. */
++    current_noexec_test = test;
++    fn(0);
++    assert(current_noexec_test == NULL);
++}
++
++static int test_noexec(struct noexec_test *tests, size_t n_tests)
++{
++    struct sigaction act;
++    size_t i;
++
++    memset(&act, 0, sizeof(act));
++    act.sa_sigaction = handle_segv;
++    act.sa_flags = SA_SIGINFO;
++    if (sigaction(SIGSEGV, &act, NULL) < 0) {
++        handle_err("sigaction");
++    }
++
++    page_size = getpagesize();
++    page_base = mmap(NULL, 2 * page_size,
++                     PROT_READ | PROT_WRITE | PROT_EXEC,
++                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
++    if (page_base == MAP_FAILED) {
++        handle_err("mmap");
++    }
++    page_base += page_size;
++
++    for (i = 0; i < n_tests; i++) {
++        struct noexec_test *test = &tests[i];
++
++        printf("[ RUN      ] %s\n", test->name);
++        test_noexec_1(test);
++        printf("[       OK ]\n");
++    }
++
++    printf("[  PASSED  ]\n");
++    return EXIT_SUCCESS;
++}
+diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/tcg/s390x/Makefile.target
++++ b/tests/tcg/s390x/Makefile.target
+@@ -XXX,XX +XXX,XX @@ TESTS+=shift
+ TESTS+=trap
+ TESTS+=signals-s390x
+ TESTS+=branch-relative-long
++TESTS+=noexec
+ Z14_TESTS=vfminmax
+ vfminmax: LDFLAGS+=-lm
+--
+.34.1

-[PULL 05/16] cputlb: Split out load/store_memop
+[PULL 18/20] target/i386: Make translator stop before the end of a page
-We will shortly be using these more than once.
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Right now translator stops right *after* the end of a page, which
-Reviewed-by: David Hildenbrand <david@redhat.com>
+breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
 An implementation, like the one arm and s390x have, would require an
 i386 length disassembler, which is burdensome to maintain. Another
 alternative would be to single-step at the end of a guest page, but
 this may come with a performance impact.
 Fix by snapshotting disassembly state and restoring it after we figure
 out we crossed a page boundary. This includes rolling back cc_op
 updates and emitted ops.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
 Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
 [rth: Simplify end-of-insn cross-page checks.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 107 +++++++++++++++++++++++----------------------
+ target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
-file changed, 55 insertions(+), 52 deletions(-)
+ tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
+ tests/tcg/x86_64/Makefile.target |  3 +-
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+files changed, 116 insertions(+), 26 deletions(-)
  create mode 100644 tests/tcg/x86_64/noexec.c
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/i386/tcg/translate.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
- typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
+     TCGv_i64 tmp1_i64;
-                                 TCGMemOpIdx oi, uintptr_t retaddr);
+     sigjmp_buf jmpbuf;
-+static inline uint64_t QEMU_ALWAYS_INLINE
++    TCGOp *prev_insn_end;
-+load_memop(const void *haddr, MemOp op)
+ } DisasContext;
-+{
-+    switch (op) {
+ /* The environment in which user-only runs is constrained. */
-+    case MO_UB:
+@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
-+        return ldub_p(haddr);
+ {
-+    case MO_BEUW:
+     uint64_t pc = s->pc;
-+        return lduw_be_p(haddr);
-+    case MO_LEUW:
++    /* This is a subsequent insn that crosses a page boundary.  */
-+        return lduw_le_p(haddr);
++    if (s->base.num_insns > 1 &&
-+    case MO_BEUL:
++        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
-+        return (uint32_t)ldl_be_p(haddr);
++        siglongjmp(s->jmpbuf, 2);
-+    case MO_LEUL:
++    }
-+        return (uint32_t)ldl_le_p(haddr);
++
-+    case MO_BEQ:
+     s->pc += num_bytes;
-+        return ldq_be_p(haddr);
+     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
-+    case MO_LEQ:
+         /* If the instruction's 16th byte is on a different page than the 1st, a
-+        return ldq_le_p(haddr);
+@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
      int modrm, reg, rm, mod, op, opreg, val;
      target_ulong next_eip, tval;
      target_ulong pc_start = s->base.pc_next;
 +    bool orig_cc_op_dirty = s->cc_op_dirty;
 +    CCOp orig_cc_op = s->cc_op;
      s->pc_start = s->pc = pc_start;
      s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
      s->rip_offset = 0; /* for relative ip address */
      s->vex_l = 0;
      s->vex_v = 0;
 -    if (sigsetjmp(s->jmpbuf, 0) != 0) {
 +    switch (sigsetjmp(s->jmpbuf, 0)) {
 +    case 0:
 +        break;
 +    case 1:
          gen_exception_gpf(s);
          return s->pc;
 +    case 2:
 +        /* Restore state that may affect the next instruction. */
 +        s->cc_op_dirty = orig_cc_op_dirty;
 +        s->cc_op = orig_cc_op;
 +        s->base.num_insns--;
 +        tcg_remove_ops_after(s->prev_insn_end);
 +        s->base.is_jmp = DISAS_TOO_MANY;
 +        return pc_start;
 +    default:
-+        qemu_build_not_reached();
++        g_assert_not_reached();
-+    }
+     }
-+}
-+
+     prefixes = 0;
- static inline uint64_t QEMU_ALWAYS_INLINE
+@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
- load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
+ {
-             uintptr_t retaddr, MemOp op, bool code_read,
+     DisasContext *dc = container_of(dcbase, DisasContext, base);
-@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
++    dc->prev_insn_end = tcg_last_op();
-  do_aligned_access:
+     tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
-     haddr = (void *)((uintptr_t)addr + entry->addend);
+ }
--    switch (op) {
--    case MO_UB:
+@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
--        res = ldub_p(haddr);
+ #endif
--        break;
--    case MO_BEUW:
+     pc_next = disas_insn(dc, cpu);
--        res = lduw_be_p(haddr);
+-
--        break;
+-    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
--    case MO_LEUW:
+-        /* if single step mode, we generate only one instruction and
--        res = lduw_le_p(haddr);
+-           generate an exception */
--        break;
+-        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
--    case MO_BEUL:
+-           the flag and abort the translation to give the irqs a
--        res = (uint32_t)ldl_be_p(haddr);
+-           chance to happen */
--        break;
+-        dc->base.is_jmp = DISAS_TOO_MANY;
--    case MO_LEUL:
+-    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
--        res = (uint32_t)ldl_le_p(haddr);
+-               && ((pc_next & TARGET_PAGE_MASK)
--        break;
+-                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
--    case MO_BEQ:
+-                       & TARGET_PAGE_MASK)
--        res = ldq_be_p(haddr);
+-                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
--        break;
+-        /* Do not cross the boundary of the pages in icount mode,
--    case MO_LEQ:
+-           it can cause an exception. Do it only when boundary is
--        res = ldq_le_p(haddr);
+-           crossed by the first instruction in the block.
--        break;
+-           If current instruction already crossed the bound - it's ok,
--    default:
+-           because an exception hasn't stopped this code.
--        qemu_build_not_reached();
+-         */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    }
 -
--    return res;
+     dc->base.pc_next = pc_next;
-+    return load_memop(haddr, op);
++
 +    if (dc->base.is_jmp == DISAS_NEXT) {
 +        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 +            /*
 +             * If single step mode, we generate only one instruction and
 +             * generate an exception.
 +             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 +             * the flag and abort the translation to give the irqs a
 +             * chance to happen.
 +             */
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        } else if (!is_same_page(&dc->base, pc_next)) {
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        }
 +    }
  }
- /*
+ static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
+diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
-  * Store Helpers
+new file mode 100644
-  */
+index XXXXXXX..XXXXXXX
+--- /dev/null
-+static inline void QEMU_ALWAYS_INLINE
++++ b/tests/tcg/x86_64/noexec.c
-+store_memop(void *haddr, uint64_t val, MemOp op)
+@@ -XXX,XX +XXX,XX @@
-+{
++#include "../multiarch/noexec.c.inc"
-+    switch (op) {
++
-+    case MO_UB:
++static void *arch_mcontext_pc(const mcontext_t *ctx)
-+        stb_p(haddr, val);
++{
-+        break;
++    return (void *)ctx->gregs[REG_RIP];
-+    case MO_BEUW:
++}
-+        stw_be_p(haddr, val);
++
-+        break;
++int arch_mcontext_arg(const mcontext_t *ctx)
-+    case MO_LEUW:
++{
-+        stw_le_p(haddr, val);
++    return ctx->gregs[REG_RDI];
-+        break;
++}
-+    case MO_BEUL:
++
-+        stl_be_p(haddr, val);
++static void arch_flush(void *p, int len)
-+        break;
++{
-+    case MO_LEUL:
++}
-+        stl_le_p(haddr, val);
++
-+        break;
++extern char noexec_1[];
-+    case MO_BEQ:
++extern char noexec_2[];
-+        stq_be_p(haddr, val);
++extern char noexec_end[];
-+        break;
++
-+    case MO_LEQ:
++asm("noexec_1:\n"
-+        stq_le_p(haddr, val);
++    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
-+        break;
++    "noexec_2:\n"
-+    default:
++    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
-+        qemu_build_not_reached();
++    "    ret\n"
-+    }
++    "noexec_end:");
-+}
++
-+
++int main(void)
- static inline void QEMU_ALWAYS_INLINE
++{
- store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++    struct noexec_test noexec_tests[] = {
-              TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
++        {
-@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
++            .name = "fallthrough",
++            .test_code = noexec_1,
-  do_aligned_access:
++            .test_len = noexec_end - noexec_1,
-     haddr = (void *)((uintptr_t)addr + entry->addend);
++            .page_ofs = noexec_1 - noexec_2,
--    switch (op) {
++            .entry_ofs = noexec_1 - noexec_2,
--    case MO_UB:
++            .expected_si_ofs = 0,
--        stb_p(haddr, val);
++            .expected_pc_ofs = 0,
--        break;
++            .expected_arg = 1,
--    case MO_BEUW:
++        },
--        stw_be_p(haddr, val);
++        {
--        break;
++            .name = "jump",
--    case MO_LEUW:
++            .test_code = noexec_1,
--        stw_le_p(haddr, val);
++            .test_len = noexec_end - noexec_1,
--        break;
++            .page_ofs = noexec_1 - noexec_2,
--    case MO_BEUL:
++            .entry_ofs = 0,
--        stl_be_p(haddr, val);
++            .expected_si_ofs = 0,
--        break;
++            .expected_pc_ofs = 0,
--    case MO_LEUL:
++            .expected_arg = 0,
--        stl_le_p(haddr, val);
++        },
--        break;
++        {
--    case MO_BEQ:
++            .name = "fallthrough [cross]",
--        stq_be_p(haddr, val);
++            .test_code = noexec_1,
--        break;
++            .test_len = noexec_end - noexec_1,
--    case MO_LEQ:
++            .page_ofs = noexec_1 - noexec_2 - 2,
--        stq_le_p(haddr, val);
++            .entry_ofs = noexec_1 - noexec_2 - 2,
--        break;
++            .expected_si_ofs = 0,
--    default:
++            .expected_pc_ofs = -2,
--        qemu_build_not_reached();
++            .expected_arg = 1,
--    }
++        },
-+    store_memop(haddr, val, op);
++        {
- }
++            .name = "jump [cross]",
++            .test_code = noexec_1,
- void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
++            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/x86_64/Makefile.target
 +++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
  ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
  X86_64_TESTS += vsyscall
 +X86_64_TESTS += noexec
  TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
  else
  TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
  test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 -vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
 +%: $(SRC_PATH)/tests/tcg/x86_64/%.c
      $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 --
-.17.1
+.34.1

-New patch
+[PULL 19/20] target/riscv: Add MAX_INSN_LEN and insn_len
+These will be useful in properly ending the TB.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/riscv/translate.c | 10 +++++++++-
+file changed, 9 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
+ /* Include decoders for factored-out extensions */
+ #include "decode-XVentanaCondOps.c.inc"
++/* The specification allows for longer insns, but not supported by qemu. */
++#define MAX_INSN_LEN  4
++
++static inline int insn_len(uint16_t first_word)
++{
++    return (first_word & 3) == 3 ? 4 : 2;
++}
++
+ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+ {
+     /*
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+     };
+     /* Check for compressed insn */
+-    if (extract16(opcode, 0, 2) != 3) {
++    if (insn_len(opcode) == 2) {
+         if (!has_ext(ctx, RVC)) {
+             gen_exception_illegal(ctx);
+         } else {
+--
+.34.1

-[PULL 07/16] exec: Adjust notdirty tracing
+[PULL 20/20] target/riscv: Make translator stop before the end of a page
-The memory_region_tb_read tracepoint is unreachable, since notdirty
+Right now the translator stops right *after* the end of a page, which
-is supposed to apply only to writes.  The memory_region_tb_write
+breaks reporting of fault locations when the last instruction of a
-tracepoint is mis-named, because notdirty is not only used for TB
+multi-insn translation block crosses a page boundary.
 invalidation.  It is also used for e.g. VGA RAM updates and migration.
-Replace memory_region_tb_write with memory_notdirty_write_access,
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
-and place it in memory_notdirty_write_prepare where it can catch
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-all of the instances.  Add memory_notdirty_set_dirty to log when
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-we no longer intercept writes to a page.
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- exec.c       | 3 +++
+ target/riscv/translate.c          | 17 +++++--
- memory.c     | 4 ----
+ tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
- trace-events | 4 ++--
+ tests/tcg/riscv64/Makefile.target |  1 +
-files changed, 5 insertions(+), 6 deletions(-)
+files changed, 93 insertions(+), 4 deletions(-)
  create mode 100644 tests/tcg/riscv64/noexec.c
-diff --git a/exec.c b/exec.c
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/exec.c
+--- a/target/riscv/translate.c
-+++ b/exec.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
+@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-     ndi->size = size;
+     }
-     ndi->pages = NULL;
+     ctx->nftemp = 0;
-+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
++    /* Only the first insn within a TB is allowed to cross a page boundary. */
      if (ctx->base.is_jmp == DISAS_NEXT) {
 -        target_ulong page_start;
 -
 -        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
 -        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
 +        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
              ctx->base.is_jmp = DISAS_TOO_MANY;
 +        } else {
 +            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
 +
-     assert(tcg_enabled());
++            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
-     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
++                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
-         ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
++                int len = insn_len(next_insn);
-@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
++
-     /* we remove the notdirty callback only if the code has been
++                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
-        flushed */
++                    ctx->base.is_jmp = DISAS_TOO_MANY;
-     if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
++                }
-+        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
++            }
-         tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
+         }
      }
  }
-diff --git a/memory.c b/memory.c
+diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/riscv64/noexec.c
@@ -XXX,XX +XXX,XX @@
 +#include "../multiarch/noexec.c.inc"
 +
 +static void *arch_mcontext_pc(const mcontext_t *ctx)
 +{
 +    return (void *)ctx->__gregs[REG_PC];
 +}
 +
 +static int arch_mcontext_arg(const mcontext_t *ctx)
 +{
 +    return ctx->__gregs[REG_A0];
 +}
 +
 +static void arch_flush(void *p, int len)
 +{
 +    __builtin___clear_cache(p, p + len);
 +}
 +
 +extern char noexec_1[];
 +extern char noexec_2[];
 +extern char noexec_end[];
 +
 +asm(".option push\n"
 +    ".option norvc\n"
 +    "noexec_1:\n"
 +    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
 +    "noexec_2:\n"
 +    "   li a0,2\n"      /* a0 is 0/1; set 2. */
 +    "   ret\n"
 +    "noexec_end:\n"
 +    ".option pop");
 +
 +int main(void)
 +{
 +    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/memory.c
+--- a/tests/tcg/riscv64/Makefile.target
-+++ b/memory.c
++++ b/tests/tcg/riscv64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
+@@ -XXX,XX +XXX,XX @@
-         /* Accesses to code which has previously been translated into a TB show
-          * up in the MMIO path, as accesses to the io_mem_notdirty
+ VPATH += $(SRC_PATH)/tests/tcg/riscv64
-          * MemoryRegion. */
+ TESTS += test-div
--        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
++TESTS += noexec
      } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
          /* Accesses to code which has previously been translated into a TB show
           * up in the MMIO path, as accesses to the io_mem_notdirty
           * MemoryRegion. */
 -        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
      } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
          /* Accesses to code which has previously been translated into a TB show
           * up in the MMIO path, as accesses to the io_mem_notdirty
           * MemoryRegion. */
 -        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
          /* Accesses to code which has previously been translated into a TB show
           * up in the MMIO path, as accesses to the io_mem_notdirty
           * MemoryRegion. */
 -        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
      } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
          hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
          trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
 diff --git a/trace-events b/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/trace-events
 +++ b/trace-events
@@ -XXX,XX +XXX,XX @@ dma_map_wait(void *dbs) "dbs=%p"
  find_ram_offset(uint64_t size, uint64_t offset) "size: 0x%" PRIx64 " @ 0x%" PRIx64
  find_ram_offset_loop(uint64_t size, uint64_t candidate, uint64_t offset, uint64_t next, uint64_t mingap) "trying size: 0x%" PRIx64 " @ 0x%" PRIx64 ", offset: 0x%" PRIx64" next: 0x%" PRIx64 " mingap: 0x%" PRIx64
  ram_block_discard_range(const char *rbname, void *hva, size_t length, bool need_madvise, bool need_fallocate, int ret) "%s@%p + 0x%zx: madvise: %d fallocate: %d ret: %d"
 +memory_notdirty_write_access(uint64_t vaddr, uint64_t ram_addr, unsigned size) "0x%" PRIx64 " ram_addr 0x%" PRIx64 " size %u"
 +memory_notdirty_set_dirty(uint64_t vaddr) "0x%" PRIx64
  # memory.c
  memory_region_ops_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
  memory_region_ops_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
  memory_region_subpage_read(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
  memory_region_subpage_write(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
 -memory_region_tb_read(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 -memory_region_tb_write(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
  memory_region_ram_device_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
  memory_region_ram_device_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
  flatview_new(void *view, void *root) "%p (root %p)"
 --
-.17.1
+.34.1

This is v4 of my notdirty + rom patch set with two suggested name
changes (qemu_build_not_reached, TLB_DISCARD_WRITE) from David and Alex.

The following changes since commit 240ab11fb72049d6373cbbec8d788f8e411a00bc:

Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20190924' into staging (2019-09-24 15:36:31 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20190925

for you to fetch changes up to ae57db63acf5a0399232f852acc5c1d83ef63400:

cputlb: Pass retaddr to tb_check_watchpoint (2019-09-25 10:56:28 -0700)

----------------------------------------------------------------
Fixes for TLB_BSWAP
Coversion of NOTDIRTY and ROM handling to cputlb
Followup cleanups to cputlb

----------------------------------------------------------------
Richard Henderson (16):
      exec: Use TARGET_PAGE_BITS_MIN for TLB flags
      cputlb: Disable __always_inline__ without optimization
      qemu/compiler.h: Add qemu_build_not_reached
      cputlb: Use qemu_build_not_reached in load/store_helpers
      cputlb: Split out load/store_memop
      cputlb: Introduce TLB_BSWAP
      exec: Adjust notdirty tracing
      cputlb: Move ROM handling from I/O path to TLB path
      cputlb: Move NOTDIRTY handling from I/O path to TLB path
      cputlb: Partially inline memory_region_section_get_iotlb
      cputlb: Merge and move memory_notdirty_write_{prepare,complete}
      cputlb: Handle TLB_NOTDIRTY in probe_access
      cputlb: Remove cpu->mem_io_vaddr
      cputlb: Remove tb_invalidate_phys_page_range is_cpu_write_access
      cputlb: Pass retaddr to tb_invalidate_phys_page_fast
      cputlb: Pass retaddr to tb_check_watchpoint

These bits do not need to vary with the actual page size
used by the guest.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 #if !defined(CONFIG_USER_ONLY)
 
-/* Flags stored in the low bits of the TLB virtual address.  These are
- * defined so that fast path ram access is all zeros.
+/*
+ * Flags stored in the low bits of the TLB virtual address.
+ * These are defined so that fast path ram access is all zeros.
  * The flags all must be between TARGET_PAGE_BITS and
  * maximum address alignment bit.
+ *
+ * Use TARGET_PAGE_BITS_MIN so that these bits are constant
+ * when TARGET_PAGE_BITS_VARY is in effect.
  */
 /* Zero if TLB entry is valid.  */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS - 1))
+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
 /* Set if TLB entry references a clean RAM page.  The iotlb entry will
    contain the page physical address.  */
-#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS - 2))
+#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
 /* Set if TLB entry is an IO callback.  */
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS - 3))
+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
 /* Set if TLB entry contains a watchpoint.  */
-#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS - 4))
+#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
-- 
2.17.1

This forced inlining can result in missing symbols,
which makes a debugging build harder to follow.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/compiler.h | 11 +++++++++++
 accel/tcg/cputlb.c      |  4 ++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 # define QEMU_NONSTRING
 #endif
 
+/*
+ * Forced inlining may be desired to encourage constant propagation
+ * of function parameters.  However, it can also make debugging harder,
+ * so disable it for a non-optimizing build.
+ */
+#if defined(__OPTIMIZE__)
+#define QEMU_ALWAYS_INLINE  __attribute__((always_inline))
+#else
+#define QEMU_ALWAYS_INLINE
+#endif
+
 /* Implement C11 _Generic via GCC builtins.  Example:
  *
  *    QEMU_GENERIC(x, (float, sinf), (long double, sinl), sin) (x)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
                                 TCGMemOpIdx oi, uintptr_t retaddr);
 
-static inline uint64_t __attribute__((always_inline))
+static inline uint64_t QEMU_ALWAYS_INLINE
 load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             uintptr_t retaddr, MemOp op, bool code_read,
             FullLoadHelper *full_load)
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
  * Store Helpers
  */
 
-static inline void __attribute__((always_inline))
+static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
 {
-- 
2.17.1

Use this as a compile-time assert that a particular
code path is not reachable.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/compiler.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_GENERIC9(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC8(x, __VA_ARGS__))
 #define QEMU_GENERIC10(x, a0, ...) QEMU_GENERIC_IF(x, a0, QEMU_GENERIC9(x, __VA_ARGS__))
 
+/**
+ * qemu_build_not_reached()
+ *
+ * The compiler, during optimization, is expected to prove that a call
+ * to this function cannot be reached and remove it.  If the compiler
+ * supports QEMU_ERROR, this will be reported at compile time; otherwise
+ * this will be reported at link time due to the missing symbol.
+ */
+#ifdef __OPTIMIZE__
+extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
+    qemu_build_not_reached(void);
+#else
+#define qemu_build_not_reached()  g_assert_not_reached()
+#endif
+
 #endif /* COMPILER_H */
-- 
2.17.1

We will shortly be using these more than once.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 107 +++++++++++++++++++++++----------------------
 1 file changed, 55 insertions(+), 52 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 typedef uint64_t FullLoadHelper(CPUArchState *env, target_ulong addr,
                                 TCGMemOpIdx oi, uintptr_t retaddr);
 
+static inline uint64_t QEMU_ALWAYS_INLINE
+load_memop(const void *haddr, MemOp op)
+{
+    switch (op) {
+    case MO_UB:
+        return ldub_p(haddr);
+    case MO_BEUW:
+        return lduw_be_p(haddr);
+    case MO_LEUW:
+        return lduw_le_p(haddr);
+    case MO_BEUL:
+        return (uint32_t)ldl_be_p(haddr);
+    case MO_LEUL:
+        return (uint32_t)ldl_le_p(haddr);
+    case MO_BEQ:
+        return ldq_be_p(haddr);
+    case MO_LEQ:
+        return ldq_le_p(haddr);
+    default:
+        qemu_build_not_reached();
+    }
+}
+
 static inline uint64_t QEMU_ALWAYS_INLINE
 load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             uintptr_t retaddr, MemOp op, bool code_read,
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (op) {
-    case MO_UB:
-        res = ldub_p(haddr);
-        break;
-    case MO_BEUW:
-        res = lduw_be_p(haddr);
-        break;
-    case MO_LEUW:
-        res = lduw_le_p(haddr);
-        break;
-    case MO_BEUL:
-        res = (uint32_t)ldl_be_p(haddr);
-        break;
-    case MO_LEUL:
-        res = (uint32_t)ldl_le_p(haddr);
-        break;
-    case MO_BEQ:
-        res = ldq_be_p(haddr);
-        break;
-    case MO_LEQ:
-        res = ldq_le_p(haddr);
-        break;
-    default:
-        qemu_build_not_reached();
-    }
-
-    return res;
+    return load_memop(haddr, op);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ tcg_target_ulong helper_be_ldsl_mmu(CPUArchState *env, target_ulong addr,
  * Store Helpers
  */
 
+static inline void QEMU_ALWAYS_INLINE
+store_memop(void *haddr, uint64_t val, MemOp op)
+{
+    switch (op) {
+    case MO_UB:
+        stb_p(haddr, val);
+        break;
+    case MO_BEUW:
+        stw_be_p(haddr, val);
+        break;
+    case MO_LEUW:
+        stw_le_p(haddr, val);
+        break;
+    case MO_BEUL:
+        stl_be_p(haddr, val);
+        break;
+    case MO_LEUL:
+        stl_le_p(haddr, val);
+        break;
+    case MO_BEQ:
+        stq_be_p(haddr, val);
+        break;
+    case MO_LEQ:
+        stq_le_p(haddr, val);
+        break;
+    default:
+        qemu_build_not_reached();
+    }
+}
+
 static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
  do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
-    switch (op) {
-    case MO_UB:
-        stb_p(haddr, val);
-        break;
-    case MO_BEUW:
-        stw_be_p(haddr, val);
-        break;
-    case MO_LEUW:
-        stw_le_p(haddr, val);
-        break;
-    case MO_BEUL:
-        stl_be_p(haddr, val);
-        break;
-    case MO_LEUL:
-        stl_le_p(haddr, val);
-        break;
-    case MO_BEQ:
-        stq_be_p(haddr, val);
-        break;
-    case MO_LEQ:
-        stq_le_p(haddr, val);
-        break;
-    default:
-        qemu_build_not_reached();
-    }
+    store_memop(haddr, val, op);
 }
 
 void helper_ret_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
-- 
2.17.1

Handle bswap on ram directly in load/store_helper.  This fixes a
bug with the previous implementation in that one cannot use the
I/O path for RAM.

Fixes: a26fc6f5152b47f1
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  4 ++-
 accel/tcg/cputlb.c     | 72 +++++++++++++++++++++++++-----------------
 2 files changed, 46 insertions(+), 30 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
 /* Set if TLB entry contains a watchpoint.  */
 #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
+/* Set if TLB entry requires byte swap.  */
+#define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT)
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
         address |= TLB_INVALID_MASK;
     }
     if (attrs.byte_swap) {
-        /* Force the access through the I/O slow path.  */
-        address |= TLB_MMIO;
+        address |= TLB_BSWAP;
     }
     if (!memory_region_is_ram(section->mr) &&
         !memory_region_is_romd(section->mr)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    if (iotlbentry->attrs.byte_swap) {
-        op ^= MO_BSWAP;
-    }
-
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    if (iotlbentry->attrs.byte_swap) {
-        op ^= MO_BSWAP;
-    }
-
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
                              wp_access, retaddr);
     }
 
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO)) {
-        /* I/O access */
+    /* Reject I/O access, or other required slow-path.  */
+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
         CPUIOTLBEntry *iotlbentry;
+        bool need_swap;
 
         /* For anything that is unaligned, recurse through full_load.  */
         if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
                                  iotlbentry->attrs, BP_MEM_READ, retaddr);
-
-            /* The backing page may or may not require I/O.  */
-            tlb_addr &= ~TLB_WATCHPOINT;
-            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-                goto do_aligned_access;
-            }
         }
 
+        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+
         /* Handle I/O access.  */
-        return io_readx(env, iotlbentry, mmu_idx, addr,
-                        retaddr, access_type, op);
+        if (likely(tlb_addr & TLB_MMIO)) {
+            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
+                            access_type, op ^ (need_swap * MO_BSWAP));
+        }
+
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
+        /*
+         * Keep these two load_memop separate to ensure that the compiler
+         * is able to fold the entire function to a single instruction.
+         * There is a build-time assert inside to remind you of this.  ;-)
+         */
+        if (unlikely(need_swap)) {
+            return load_memop(haddr, op ^ MO_BSWAP);
+        }
+        return load_memop(haddr, op);
     }
 
     /* Handle slow unaligned access (it spans two pages or IO).  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, TCGMemOpIdx oi,
         return res & MAKE_64BIT_MASK(0, size * 8);
     }
 
- do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     return load_memop(haddr, op);
 }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
         CPUIOTLBEntry *iotlbentry;
+        bool need_swap;
 
         /* For anything that is unaligned, recurse through byte stores.  */
         if ((addr & (size - 1)) != 0) {
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
                                  iotlbentry->attrs, BP_MEM_WRITE, retaddr);
-
-            /* The backing page may or may not require I/O.  */
-            tlb_addr &= ~TLB_WATCHPOINT;
-            if ((tlb_addr & ~TARGET_PAGE_MASK) == 0) {
-                goto do_aligned_access;
-            }
         }
 
+        need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
+
         /* Handle I/O access.  */
-        io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, op);
+        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
+            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
+                      op ^ (need_swap * MO_BSWAP));
+            return;
+        }
+
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
+        /*
+         * Keep these two store_memop separate to ensure that the compiler
+         * is able to fold the entire function to a single instruction.
+         * There is a build-time assert inside to remind you of this.  ;-)
+         */
+        if (unlikely(need_swap)) {
+            store_memop(haddr, val, op ^ MO_BSWAP);
+        } else {
+            store_memop(haddr, val, op);
+        }
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         return;
     }
 
- do_aligned_access:
     haddr = (void *)((uintptr_t)addr + entry->addend);
     store_memop(haddr, val, op);
 }
-- 
2.17.1

The memory_region_tb_read tracepoint is unreachable, since notdirty
is supposed to apply only to writes.  The memory_region_tb_write
tracepoint is mis-named, because notdirty is not only used for TB
invalidation.  It is also used for e.g. VGA RAM updates and migration.

Replace memory_region_tb_write with memory_notdirty_write_access,
and place it in memory_notdirty_write_prepare where it can catch
all of the instances.  Add memory_notdirty_set_dirty to log when
we no longer intercept writes to a page.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 exec.c       | 3 +++
 memory.c     | 4 ----
 trace-events | 4 ++--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
     ndi->size = size;
     ndi->pages = NULL;
 
+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+
     assert(tcg_enabled());
     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
         ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
     /* we remove the notdirty callback only if the code has been
        flushed */
     if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
+        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
         tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
     }
 }
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_read(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
         /* Accesses to code which has previously been translated into a TB show
          * up in the MMIO path, as accesses to the io_mem_notdirty
          * MemoryRegion. */
-        trace_memory_region_tb_write(get_cpu_index(), addr, tmp, size);
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
diff --git a/trace-events b/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/trace-events
+++ b/trace-events
@@ -XXX,XX +XXX,XX @@ dma_map_wait(void *dbs) "dbs=%p"
 find_ram_offset(uint64_t size, uint64_t offset) "size: 0x%" PRIx64 " @ 0x%" PRIx64
 find_ram_offset_loop(uint64_t size, uint64_t candidate, uint64_t offset, uint64_t next, uint64_t mingap) "trying size: 0x%" PRIx64 " @ 0x%" PRIx64 ", offset: 0x%" PRIx64" next: 0x%" PRIx64 " mingap: 0x%" PRIx64
 ram_block_discard_range(const char *rbname, void *hva, size_t length, bool need_madvise, bool need_fallocate, int ret) "%s@%p + 0x%zx: madvise: %d fallocate: %d ret: %d"
+memory_notdirty_write_access(uint64_t vaddr, uint64_t ram_addr, unsigned size) "0x%" PRIx64 " ram_addr 0x%" PRIx64 " size %u"
+memory_notdirty_set_dirty(uint64_t vaddr) "0x%" PRIx64
 
 # memory.c
 memory_region_ops_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ops_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_subpage_read(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_subpage_write(int cpu_index, void *mr, uint64_t offset, uint64_t value, unsigned size) "cpu %d mr %p offset 0x%"PRIx64" value 0x%"PRIx64" size %u"
-memory_region_tb_read(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
-memory_region_tb_write(int cpu_index, uint64_t addr, uint64_t value, unsigned size) "cpu %d addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ram_device_read(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 memory_region_ram_device_write(int cpu_index, void *mr, uint64_t addr, uint64_t value, unsigned size) "cpu %d mr %p addr 0x%"PRIx64" value 0x%"PRIx64" size %u"
 flatview_new(void *view, void *root) "%p (root %p)"
-- 
2.17.1

It does not require going through the whole I/O path
in order to discard a write.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h    |  5 ++++-
 include/exec/cpu-common.h |  1 -
 accel/tcg/cputlb.c        | 36 ++++++++++++++++++++--------------
 exec.c                    | 41 +--------------------------------------
 4 files changed, 26 insertions(+), 57 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
 /* Set if TLB entry requires byte swap.  */
 #define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
+/* Set if TLB entry writes ignored.  */
+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
 
 /* Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO | TLB_WATCHPOINT | TLB_BSWAP)
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
+    | TLB_WATCHPOINT | TLB_BSWAP | TLB_DISCARD_WRITE)
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
 
 void cpu_flush_icache_range(hwaddr start, hwaddr len);
 
-extern struct MemoryRegion io_mem_rom;
 extern struct MemoryRegion io_mem_notdirty;
 
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
 {
     uintptr_t addr = tlb_entry->addr_write;
 
-    if ((addr & (TLB_INVALID_MASK | TLB_MMIO | TLB_NOTDIRTY)) == 0) {
+    if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
+                 TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
         addr &= TARGET_PAGE_MASK;
         addr += tlb_entry->addend;
         if ((addr - start) < length) {
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
         address |= TLB_MMIO;
         addend = 0;
     } else {
-        /* TLB_MMIO for rom/romd handled below */
         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 
     tn.addr_write = -1;
     if (prot & PAGE_WRITE) {
-        if ((memory_region_is_ram(section->mr) && section->readonly)
-            || memory_region_is_romd(section->mr)) {
-            /* Write access calls the I/O callback.  */
-            tn.addr_write = address | TLB_MMIO;
-        } else if (memory_region_is_ram(section->mr)
-                   && cpu_physical_memory_is_clean(
-                       memory_region_get_ram_addr(section->mr) + xlat)) {
-            tn.addr_write = address | TLB_NOTDIRTY;
-        } else {
-            tn.addr_write = address;
+        tn.addr_write = address;
+        if (memory_region_is_romd(section->mr)) {
+            /* Use the MMIO path so that the device can switch states. */
+            tn.addr_write |= TLB_MMIO;
+        } else if (memory_region_is_ram(section->mr)) {
+            if (section->readonly) {
+                tn.addr_write |= TLB_DISCARD_WRITE;
+            } else if (cpu_physical_memory_is_clean(
+                        memory_region_get_ram_addr(section->mr) + xlat)) {
+                tn.addr_write |= TLB_NOTDIRTY;
+            }
         }
         if (prot & PAGE_WRITE_INV) {
             tn.addr_write |= TLB_INVALID_MASK;
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
     cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     }
 
     /* Reject I/O access, or other required slow-path.  */
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP)) {
+    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             return;
         }
 
+        /* Ignore writes to ROM.  */
+        if (unlikely(tlb_addr & TLB_DISCARD_WRITE)) {
+            return;
+        }
+
         haddr = (void *)((uintptr_t)addr + entry->addend);
 
         /*
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
 AddressSpace address_space_io;
 AddressSpace address_space_memory;
 
-MemoryRegion io_mem_rom, io_mem_notdirty;
+MemoryRegion io_mem_notdirty;
 static MemoryRegion io_mem_unassigned;
 #endif
 
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
 
 #define PHYS_SECTION_UNASSIGNED 0
 #define PHYS_SECTION_NOTDIRTY 1
-#define PHYS_SECTION_ROM 2
 
 static void io_mem_init(void);
 static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
         if (!section->readonly) {
             iotlb |= PHYS_SECTION_NOTDIRTY;
-        } else {
-            iotlb |= PHYS_SECTION_ROM;
         }
     } else {
         AddressSpaceDispatch *d;
@@ -XXX,XX +XXX,XX @@ static uint16_t dummy_section(PhysPageMap *map, FlatView *fv, MemoryRegion *mr)
     return phys_section_add(map, &section);
 }
 
-static void readonly_mem_write(void *opaque, hwaddr addr,
-                               uint64_t val, unsigned size)
-{
-    /* Ignore any write to ROM. */
-}
-
-static bool readonly_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write,
-                                 MemTxAttrs attrs)
-{
-    return is_write;
-}
-
-/* This will only be used for writes, because reads are special cased
- * to directly access the underlying host ram.
- */
-static const MemoryRegionOps readonly_mem_ops = {
-    .write = readonly_mem_write,
-    .valid.accepts = readonly_mem_accepts,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-};
-
 MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                       hwaddr index, MemTxAttrs attrs)
 {
@@ -XXX,XX +XXX,XX @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
 
 static void io_mem_init(void)
 {
-    memory_region_init_io(&io_mem_rom, NULL, &readonly_mem_ops,
-                          NULL, NULL, UINT64_MAX);
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           NULL, UINT64_MAX);
 
@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
     assert(n == PHYS_SECTION_UNASSIGNED);
     n = dummy_section(&d->map, fv, &io_mem_notdirty);
     assert(n == PHYS_SECTION_NOTDIRTY);
-    n = dummy_section(&d->map, fv, &io_mem_rom);
-    assert(n == PHYS_SECTION_ROM);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 
-- 
2.17.1

Pages that we want to track for NOTDIRTY are RAM.  We do not
really need to go through the I/O path to handle them.

Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  2 --
 accel/tcg/cputlb.c        | 26 +++++++++++++++++---
 exec.c                    | 50 ---------------------------------------
 memory.c                  | 16 -------------
 4 files changed, 23 insertions(+), 71 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void qemu_flush_coalesced_mmio_buffer(void);
 
 void cpu_flush_icache_range(hwaddr start, hwaddr len);
 
-extern struct MemoryRegion io_mem_notdirty;
-
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
     mr = section->mr;
     mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_notdirty && !cpu->can_do_io) {
+    if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
     cpu->mem_io_vaddr = addr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
-        if (likely(tlb_addr & (TLB_MMIO | TLB_NOTDIRTY))) {
+        if (tlb_addr & TLB_MMIO) {
             io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
                       op ^ (need_swap * MO_BSWAP));
             return;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         haddr = (void *)((uintptr_t)addr + entry->addend);
 
+        /* Handle clean RAM pages.  */
+        if (tlb_addr & TLB_NOTDIRTY) {
+            NotDirtyInfo ndi;
+
+            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
+            env_cpu(env)->mem_io_pc = retaddr;
+
+            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
+                                          addr + iotlbentry->addr, size);
+
+            if (unlikely(need_swap)) {
+                store_memop(haddr, val, op ^ MO_BSWAP);
+            } else {
+                store_memop(haddr, val, op);
+            }
+
+            memory_notdirty_write_complete(&ndi);
+            return;
+        }
+
         /*
          * Keep these two store_memop separate to ensure that the compiler
          * is able to fold the entire function to a single instruction.
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *system_io;
 AddressSpace address_space_io;
 AddressSpace address_space_memory;
 
-MemoryRegion io_mem_notdirty;
 static MemoryRegion io_mem_unassigned;
 #endif
 
@@ -XXX,XX +XXX,XX @@ typedef struct subpage_t {
 } subpage_t;
 
 #define PHYS_SECTION_UNASSIGNED 0
-#define PHYS_SECTION_NOTDIRTY 1
 
 static void io_mem_init(void);
 static void memory_map_init(void);
@@ -XXX,XX +XXX,XX @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
     if (memory_region_is_ram(section->mr)) {
         /* Normal RAM.  */
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
-        if (!section->readonly) {
-            iotlb |= PHYS_SECTION_NOTDIRTY;
-        }
     } else {
         AddressSpaceDispatch *d;
 
@@ -XXX,XX +XXX,XX @@ void memory_notdirty_write_complete(NotDirtyInfo *ndi)
     }
 }
 
-/* Called within RCU critical section.  */
-static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
-                               uint64_t val, unsigned size)
-{
-    NotDirtyInfo ndi;
-
-    memory_notdirty_write_prepare(&ndi, current_cpu, current_cpu->mem_io_vaddr,
-                         ram_addr, size);
-
-    stn_p(qemu_map_ram_ptr(NULL, ram_addr), size, val);
-    memory_notdirty_write_complete(&ndi);
-}
-
-static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write,
-                                 MemTxAttrs attrs)
-{
-    return is_write;
-}
-
-static const MemoryRegionOps notdirty_mem_ops = {
-    .write = notdirty_mem_write,
-    .valid.accepts = notdirty_mem_accepts,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-        .unaligned = false,
-    },
-};
-
 /* Generate a debug exception if a watchpoint has been hit.  */
 void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                           MemTxAttrs attrs, int flags, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static void io_mem_init(void)
 {
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           NULL, UINT64_MAX);
-
-    /* io_mem_notdirty calls tb_invalidate_phys_page_fast,
-     * which can be called without the iothread mutex.
-     */
-    memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
-                          NULL, UINT64_MAX);
-    memory_region_clear_global_locking(&io_mem_notdirty);
 }
 
 AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
@@ -XXX,XX +XXX,XX @@ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)
 
     n = dummy_section(&d->map, fv, &io_mem_unassigned);
     assert(n == PHYS_SECTION_UNASSIGNED);
-    n = dummy_section(&d->map, fv, &io_mem_notdirty);
-    assert(n == PHYS_SECTION_NOTDIRTY);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .skip = 1 };
 
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult  memory_region_read_accessor(MemoryRegion *mr,
     tmp = mr->ops->read(mr->opaque, addr, size);
     if (mr->subpage) {
         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
     r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs);
     if (mr->subpage) {
         trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
 
     if (mr->subpage) {
         trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
@@ -XXX,XX +XXX,XX @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
 
     if (mr->subpage) {
         trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
-    } else if (mr == &io_mem_notdirty) {
-        /* Accesses to code which has previously been translated into a TB show
-         * up in the MMIO path, as accesses to the io_mem_notdirty
-         * MemoryRegion. */
     } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {
         hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
         trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);
-- 
2.17.1

There is only one caller, tlb_set_page_with_attrs.  We cannot
inline the entire function because the AddressSpaceDispatch
structure is private to exec.c, and cannot easily be moved to
include/exec/memory-internal.h.

Compute is_ram and is_romd once within tlb_set_page_with_attrs.
Fold the number of tests against these predicates.  Compute
cpu_physical_memory_is_clean outside of the tlb lock region.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |  6 +---
 accel/tcg/cputlb.c      | 68 ++++++++++++++++++++++++++---------------
 exec.c                  | 22 ++-----------
 3 files changed, 47 insertions(+), 49 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
                                   hwaddr *xlat, hwaddr *plen,
                                   MemTxAttrs attrs, int *prot);
 hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section,
-                                       target_ulong vaddr,
-                                       hwaddr paddr, hwaddr xlat,
-                                       int prot,
-                                       target_ulong *address);
+                                       MemoryRegionSection *section);
 #endif
 
 /* vl.c */
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     MemoryRegionSection *section;
     unsigned int index;
     target_ulong address;
-    target_ulong code_address;
+    target_ulong write_address;
     uintptr_t addend;
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
     target_ulong vaddr_page;
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     int wp_flags;
+    bool is_ram, is_romd;
 
     assert_cpu_is_self(cpu);
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     if (attrs.byte_swap) {
         address |= TLB_BSWAP;
     }
-    if (!memory_region_is_ram(section->mr) &&
-        !memory_region_is_romd(section->mr)) {
-        /* IO memory case */
-        address |= TLB_MMIO;
-        addend = 0;
-    } else {
+
+    is_ram = memory_region_is_ram(section->mr);
+    is_romd = memory_region_is_romd(section->mr);
+
+    if (is_ram || is_romd) {
+        /* RAM and ROMD both have associated host memory. */
         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr) + xlat;
+    } else {
+        /* I/O does not; force the host address to NULL. */
+        addend = 0;
+    }
+
+    write_address = address;
+    if (is_ram) {
+        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
+        /*
+         * Computing is_clean is expensive; avoid all that unless
+         * the page is actually writable.
+         */
+        if (prot & PAGE_WRITE) {
+            if (section->readonly) {
+                write_address |= TLB_DISCARD_WRITE;
+            } else if (cpu_physical_memory_is_clean(iotlb)) {
+                write_address |= TLB_NOTDIRTY;
+            }
+        }
+    } else {
+        /* I/O or ROMD */
+        iotlb = memory_region_section_get_iotlb(cpu, section) + xlat;
+        /*
+         * Writes to romd devices must go through MMIO to enable write.
+         * Reads to romd devices go through the ram_ptr found above,
+         * but of course reads to I/O must go through MMIO.
+         */
+        write_address |= TLB_MMIO;
+        if (!is_romd) {
+            address = write_address;
+        }
     }
 
-    code_address = address;
-    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr_page,
-                                            paddr_page, xlat, prot, &address);
     wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
                                               TARGET_PAGE_SIZE);
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     /*
      * At this point iotlb contains a physical section number in the lower
      * TARGET_PAGE_BITS, and either
-     *  + the ram_addr_t of the page base of the target RAM (if NOTDIRTY or ROM)
-     *  + the offset within section->mr of the page base (otherwise)
+     *  + the ram_addr_t of the page base of the target RAM (RAM)
+     *  + the offset within section->mr of the page base (I/O, ROMD)
      * We subtract the vaddr_page (which is page aligned and thus won't
      * disturb the low bits) to give an offset which can be added to the
      * (non-page-aligned) vaddr of the eventual memory access to get
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     }
 
     if (prot & PAGE_EXEC) {
-        tn.addr_code = code_address;
+        tn.addr_code = address;
     } else {
         tn.addr_code = -1;
     }
 
     tn.addr_write = -1;
     if (prot & PAGE_WRITE) {
-        tn.addr_write = address;
-        if (memory_region_is_romd(section->mr)) {
-            /* Use the MMIO path so that the device can switch states. */
-            tn.addr_write |= TLB_MMIO;
-        } else if (memory_region_is_ram(section->mr)) {
-            if (section->readonly) {
-                tn.addr_write |= TLB_DISCARD_WRITE;
-            } else if (cpu_physical_memory_is_clean(
-                        memory_region_get_ram_addr(section->mr) + xlat)) {
-                tn.addr_write |= TLB_NOTDIRTY;
-            }
-        }
+        tn.addr_write = write_address;
         if (prot & PAGE_WRITE_INV) {
             tn.addr_write |= TLB_INVALID_MASK;
         }
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
 
 /* Called from RCU critical section */
 hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section,
-                                       target_ulong vaddr,
-                                       hwaddr paddr, hwaddr xlat,
-                                       int prot,
-                                       target_ulong *address)
+                                       MemoryRegionSection *section)
 {
-    hwaddr iotlb;
-
-    if (memory_region_is_ram(section->mr)) {
-        /* Normal RAM.  */
-        iotlb = memory_region_get_ram_addr(section->mr) + xlat;
-    } else {
-        AddressSpaceDispatch *d;
-
-        d = flatview_to_dispatch(section->fv);
-        iotlb = section - d->map.sections;
-        iotlb += xlat;
-    }
-
-    return iotlb;
+    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
+    return section - d->map.sections;
 }
 #endif /* defined(CONFIG_USER_ONLY) */
 
-- 
2.17.1

Since 9458a9a1df1a, all readers of the dirty bitmaps wait
for the rcu lock, which means that they wait until the end
of any executing TranslationBlock.

As a consequence, there is no need for the actual access
to happen in between the _prepare and _complete.  Therefore,
we can improve things by merging the two functions into
notdirty_write and dropping the NotDirtyInfo structure.

In addition, the only users of notdirty_write are in cputlb.c,
so move the merged function there.  Pass in the CPUIOTLBEntry
from which the ram_addr_t may be computed.

Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/memory-internal.h | 65 -----------------------------
 accel/tcg/cputlb.c             | 76 +++++++++++++++++++---------------
 exec.c                         | 44 --------------------
 3 files changed, 42 insertions(+), 143 deletions(-)

diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -XXX,XX +XXX,XX @@ void address_space_dispatch_free(AddressSpaceDispatch *d);
 
 void mtree_print_dispatch(struct AddressSpaceDispatch *d,
                           MemoryRegion *root);
-
-struct page_collection;
-
-/* Opaque struct for passing info from memory_notdirty_write_prepare()
- * to memory_notdirty_write_complete(). Callers should treat all fields
- * as private, with the exception of @active.
- *
- * @active is a field which is not touched by either the prepare or
- * complete functions, but which the caller can use if it wishes to
- * track whether it has called prepare for this struct and so needs
- * to later call the complete function.
- */
-typedef struct {
-    CPUState *cpu;
-    struct page_collection *pages;
-    ram_addr_t ram_addr;
-    vaddr mem_vaddr;
-    unsigned size;
-    bool active;
-} NotDirtyInfo;
-
-/**
- * memory_notdirty_write_prepare: call before writing to non-dirty memory
- * @ndi: pointer to opaque NotDirtyInfo struct
- * @cpu: CPU doing the write
- * @mem_vaddr: virtual address of write
- * @ram_addr: the ram address of the write
- * @size: size of write in bytes
- *
- * Any code which writes to the host memory corresponding to
- * guest RAM which has been marked as NOTDIRTY must wrap those
- * writes in calls to memory_notdirty_write_prepare() and
- * memory_notdirty_write_complete():
- *
- *  NotDirtyInfo ndi;
- *  memory_notdirty_write_prepare(&ndi, ....);
- *  ... perform write here ...
- *  memory_notdirty_write_complete(&ndi);
- *
- * These calls will ensure that we flush any TCG translated code for
- * the memory being written, update the dirty bits and (if possible)
- * remove the slowpath callback for writing to the memory.
- *
- * This must only be called if we are using TCG; it will assert otherwise.
- *
- * We may take locks in the prepare call, so callers must ensure that
- * they don't exit (via longjump or otherwise) without calling complete.
- *
- * This call must only be made inside an RCU critical section.
- * (Note that while we're executing a TCG TB we're always in an
- * RCU critical section, which is likely to be the case for callers
- * of these functions.)
- */
-void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
-                                   CPUState *cpu,
-                                   vaddr mem_vaddr,
-                                   ram_addr_t ram_addr,
-                                   unsigned size);
-/**
- * memory_notdirty_write_complete: finish write to non-dirty memory
- * @ndi: pointer to the opaque NotDirtyInfo struct which was initialized
- * by memory_not_dirty_write_prepare().
- */
-void memory_notdirty_write_complete(NotDirtyInfo *ndi);
-
 #endif
 #endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "qemu/atomic.h"
 #include "qemu/atomic128.h"
+#include "translate-all.h"
 
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
     return qemu_ram_addr_from_host_nofail(p);
 }
 
+static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
+                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+{
+    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
+
+    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
+
+    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
+        struct page_collection *pages
+            = page_collection_lock(ram_addr, ram_addr + size);
+
+        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
+        cpu->mem_io_pc = retaddr;
+
+        tb_invalidate_phys_page_fast(pages, ram_addr, size);
+        page_collection_unlock(pages);
+    }
+
+    /*
+     * Set both VGA and migration bits for simplicity and to remove
+     * the notdirty callback faster.
+     */
+    cpu_physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
+
+    /* We remove the notdirty callback only if the code has been flushed. */
+    if (!cpu_physical_memory_is_clean(ram_addr)) {
+        trace_memory_notdirty_set_dirty(mem_vaddr);
+        tlb_set_dirty(cpu, mem_vaddr);
+    }
+}
+
 /*
  * Probe for whether the specified guest access is permitted. If it is not
  * permitted then an exception will be taken in the same way as if this
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
 /* Probe for a read-modify-write atomic operation.  Do not allow unaligned
  * operations, or io operations to proceed.  Return the host address.  */
 static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               TCGMemOpIdx oi, uintptr_t retaddr,
-                               NotDirtyInfo *ndi)
+                               TCGMemOpIdx oi, uintptr_t retaddr)
 {
     size_t mmu_idx = get_mmuidx(oi);
     uintptr_t index = tlb_index(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
     hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
 
-    ndi->active = false;
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
-        ndi->active = true;
-        memory_notdirty_write_prepare(ndi, env_cpu(env), addr,
-                                      qemu_ram_addr_from_host_nofail(hostaddr),
-                                      1 << s_bits);
+        notdirty_write(env_cpu(env), addr, 1 << s_bits,
+                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
     }
 
     return hostaddr;
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             return;
         }
 
-        haddr = (void *)((uintptr_t)addr + entry->addend);
-
         /* Handle clean RAM pages.  */
         if (tlb_addr & TLB_NOTDIRTY) {
-            NotDirtyInfo ndi;
-
-            /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
-            env_cpu(env)->mem_io_pc = retaddr;
-
-            memory_notdirty_write_prepare(&ndi, env_cpu(env), addr,
-                                          addr + iotlbentry->addr, size);
-
-            if (unlikely(need_swap)) {
-                store_memop(haddr, val, op ^ MO_BSWAP);
-            } else {
-                store_memop(haddr, val, op);
-            }
-
-            memory_notdirty_write_complete(&ndi);
-            return;
+            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
         }
 
+        haddr = (void *)((uintptr_t)addr + entry->addend);
+
         /*
          * Keep these two store_memop separate to ensure that the compiler
          * is able to fold the entire function to a single instruction.
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
 #define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
 #define ATOMIC_NAME(X) \
     HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
-#define ATOMIC_MMU_DECLS NotDirtyInfo ndi
-#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr, &ndi)
-#define ATOMIC_MMU_CLEANUP                              \
-    do {                                                \
-        if (unlikely(ndi.active)) {                     \
-            memory_notdirty_write_complete(&ndi);       \
-        }                                               \
-    } while (0)
+#define ATOMIC_MMU_DECLS
+#define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, oi, retaddr)
+#define ATOMIC_MMU_CLEANUP
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
@@ -XXX,XX +XXX,XX @@ void helper_be_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
 #undef ATOMIC_MMU_LOOKUP
 #define EXTRA_ARGS         , TCGMemOpIdx oi
 #define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC(), &ndi)
+#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
 
 #define DATA_SIZE 1
 #include "atomic_template.h"
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
-/* Called within RCU critical section. */
-void memory_notdirty_write_prepare(NotDirtyInfo *ndi,
-                          CPUState *cpu,
-                          vaddr mem_vaddr,
-                          ram_addr_t ram_addr,
-                          unsigned size)
-{
-    ndi->cpu = cpu;
-    ndi->ram_addr = ram_addr;
-    ndi->mem_vaddr = mem_vaddr;
-    ndi->size = size;
-    ndi->pages = NULL;
-
-    trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
-
-    assert(tcg_enabled());
-    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
-        ndi->pages = page_collection_lock(ram_addr, ram_addr + size);
-        tb_invalidate_phys_page_fast(ndi->pages, ram_addr, size);
-    }
-}
-
-/* Called within RCU critical section. */
-void memory_notdirty_write_complete(NotDirtyInfo *ndi)
-{
-    if (ndi->pages) {
-        assert(tcg_enabled());
-        page_collection_unlock(ndi->pages);
-        ndi->pages = NULL;
-    }
-
-    /* Set both VGA and migration bits for simplicity and to remove
-     * the notdirty callback faster.
-     */
-    cpu_physical_memory_set_dirty_range(ndi->ram_addr, ndi->size,
-                                        DIRTY_CLIENTS_NOCODE);
-    /* we remove the notdirty callback only if the code has been
-       flushed */
-    if (!cpu_physical_memory_is_clean(ndi->ram_addr)) {
-        trace_memory_notdirty_set_dirty(ndi->mem_vaddr);
-        tlb_set_dirty(ndi->cpu, ndi->mem_vaddr);
-    }
-}
-
 /* Generate a debug exception if a watchpoint has been hit.  */
 void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                           MemTxAttrs attrs, int flags, uintptr_t ra)
-- 
2.17.1

We can use notdirty_write for the write and return a valid host
pointer for this case.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
         return NULL;
     }
 
-    /* Handle watchpoints.  */
-    if (tlb_addr & TLB_WATCHPOINT) {
-        cpu_check_watchpoint(env_cpu(env), addr, size,
-                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
-                             wp_access, retaddr);
-    }
+    if (unlikely(tlb_addr & TLB_FLAGS_MASK)) {
+        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 
-    /* Reject I/O access, or other required slow-path.  */
-    if (tlb_addr & (TLB_NOTDIRTY | TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
-        return NULL;
+        /* Reject I/O access, or other required slow-path.  */
+        if (tlb_addr & (TLB_MMIO | TLB_BSWAP | TLB_DISCARD_WRITE)) {
+            return NULL;
+        }
+
+        /* Handle watchpoints.  */
+        if (tlb_addr & TLB_WATCHPOINT) {
+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                                 iotlbentry->attrs, wp_access, retaddr);
+        }
+
+        /* Handle clean RAM pages.  */
+        if (tlb_addr & TLB_NOTDIRTY) {
+            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
+        }
     }
 
     return (void *)((uintptr_t)addr + entry->addend);
-- 
2.17.1

With the merge of notdirty handling into store_helper,
the last user of cpu->mem_io_vaddr was removed.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 2 --
 accel/tcg/cputlb.c    | 2 --
 hw/core/cpu.c         | 1 -
 3 files changed, 5 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
  * @next_cpu: Next CPU sharing TB cache.
  * @opaque: User data.
  * @mem_io_pc: Host Program Counter at which the memory was accessed.
- * @mem_io_vaddr: Target virtual address at which the memory was accessed.
  * @kvm_fd: vCPU file descriptor for KVM.
  * @work_mutex: Lock to prevent multiple access to queued_work_*.
  * @queued_work_first: First asynchronous work pending.
@@ -XXX,XX +XXX,XX @@ struct CPUState {
      * we store some rarely used information in the CPU context.
      */
     uintptr_t mem_io_pc;
-    vaddr mem_io_vaddr;
     /*
      * This is only needed for the legacy cpu_unassigned_access() hook;
      * when all targets using it have been converted to use
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         cpu_io_recompile(cpu, retaddr);
     }
 
-    cpu->mem_io_vaddr = addr;
     cpu->mem_io_access_type = access_type;
 
     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
-    cpu->mem_io_vaddr = addr;
     cpu->mem_io_pc = retaddr;
 
     if (mr->global_locking && !qemu_mutex_iothread_locked()) {
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(CPUState *cpu)
     cpu->interrupt_request = 0;
     cpu->halted = 0;
     cpu->mem_io_pc = 0;
-    cpu->mem_io_vaddr = 0;
     cpu->icount_extra = 0;
     atomic_set(&cpu->icount_decr_ptr->u32, 0);
     cpu->can_do_io = 1;
-- 
2.17.1

All callers pass false to this argument.  Remove it and pass the
constant on to tb_invalidate_phys_page_range__locked.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h | 3 +--
 accel/tcg/translate-all.c | 6 ++----
 exec.c                    | 4 ++--
 3 files changed, 5 insertions(+), 8 deletions(-)

Rather than rely on cpu->mem_io_pc, pass retaddr down directly.

Within tb_invalidate_phys_page_range__locked, the is_cpu_write_access
parameter is non-zero exactly when retaddr would be non-zero, so that
is a simple replacement.

Recognize that current_tb_not_found is true only when mem_io_pc
(and now retaddr) are also non-zero, so remove a redundant test.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h |  3 ++-
 accel/tcg/cputlb.c        |  6 +-----
 accel/tcg/translate-all.c | 39 +++++++++++++++++++--------------------
 3 files changed, 22 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -XXX,XX +XXX,XX @@ struct page_collection *page_collection_lock(tb_page_addr_t start,
                                              tb_page_addr_t end);
 void page_collection_unlock(struct page_collection *set);
 void tb_invalidate_phys_page_fast(struct page_collection *pages,
-                                  tb_page_addr_t start, int len);
+                                  tb_page_addr_t start, int len,
+                                  uintptr_t retaddr);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
         struct page_collection *pages
             = page_collection_lock(ram_addr, ram_addr + size);
-
-        /* We require mem_io_pc in tb_invalidate_phys_page_range.  */
-        cpu->mem_io_pc = retaddr;
-
-        tb_invalidate_phys_page_fast(pages, ram_addr, size);
+        tb_invalidate_phys_page_fast(pages, ram_addr, size, retaddr);
         page_collection_unlock(pages);
     }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void
 tb_invalidate_phys_page_range__locked(struct page_collection *pages,
                                       PageDesc *p, tb_page_addr_t start,
                                       tb_page_addr_t end,
-                                      int is_cpu_write_access)
+                                      uintptr_t retaddr)
 {
     TranslationBlock *tb;
     tb_page_addr_t tb_start, tb_end;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
 #ifdef TARGET_HAS_PRECISE_SMC
     CPUState *cpu = current_cpu;
     CPUArchState *env = NULL;
-    int current_tb_not_found = is_cpu_write_access;
+    bool current_tb_not_found = retaddr != 0;
+    bool current_tb_modified = false;
     TranslationBlock *current_tb = NULL;
-    int current_tb_modified = 0;
     target_ulong current_pc = 0;
     target_ulong current_cs_base = 0;
     uint32_t current_flags = 0;
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
         if (!(tb_end <= start || tb_start >= end)) {
 #ifdef TARGET_HAS_PRECISE_SMC
             if (current_tb_not_found) {
-                current_tb_not_found = 0;
-                current_tb = NULL;
-                if (cpu->mem_io_pc) {
-                    /* now we have a real cpu fault */
-                    current_tb = tcg_tb_lookup(cpu->mem_io_pc);
-                }
+                current_tb_not_found = false;
+                /* now we have a real cpu fault */
+                current_tb = tcg_tb_lookup(retaddr);
             }
             if (current_tb == tb &&
                 (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
-                /* If we are modifying the current TB, we must stop
-                its execution. We could be more precise by checking
-                that the modification is after the current PC, but it
-                would require a specialized function to partially
-                restore the CPU state */
-
-                current_tb_modified = 1;
-                cpu_restore_state_from_tb(cpu, current_tb,
-                                          cpu->mem_io_pc, true);
+                /*
+                 * If we are modifying the current TB, we must stop
+                 * its execution. We could be more precise by checking
+                 * that the modification is after the current PC, but it
+                 * would require a specialized function to partially
+                 * restore the CPU state.
+                 */
+                current_tb_modified = true;
+                cpu_restore_state_from_tb(cpu, current_tb, retaddr, true);
                 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                      &current_flags);
             }
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_range(target_ulong start, target_ulong end)
  * Call with all @pages in the range [@start, @start + len[ locked.
  */
 void tb_invalidate_phys_page_fast(struct page_collection *pages,
-                                  tb_page_addr_t start, int len)
+                                  tb_page_addr_t start, int len,
+                                  uintptr_t retaddr)
 {
     PageDesc *p;
 
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
         }
     } else {
     do_invalidate:
-        tb_invalidate_phys_page_range__locked(pages, p, start, start + len, 1);
+        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
+                                              retaddr);
     }
 }
 #else
-- 
2.17.1

Fixes the previous TLB_WATCHPOINT patches because we are currently
failing to set cpu->mem_io_pc with the call to cpu_check_watchpoint.
Pass down the retaddr directly because it's readily available.

Fixes: 50b107c5d61
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.h | 2 +-
 accel/tcg/translate-all.c | 6 +++---
 exec.c                    | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/translate-all.h b/accel/tcg/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
                                   tb_page_addr_t start, int len,
                                   uintptr_t retaddr);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
-void tb_check_watchpoint(CPUState *cpu);
+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 
 #ifdef CONFIG_USER_ONLY
 int page_unprotect(target_ulong address, uintptr_t pc);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static bool tb_invalidate_phys_page(tb_page_addr_t addr, uintptr_t pc)
 #endif
 
 /* user-mode: call with mmap_lock held */
-void tb_check_watchpoint(CPUState *cpu)
+void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
 {
     TranslationBlock *tb;
 
     assert_memory_lock();
 
-    tb = tcg_tb_lookup(cpu->mem_io_pc);
+    tb = tcg_tb_lookup(retaddr);
     if (tb) {
         /* We can use retranslation to find the PC.  */
-        cpu_restore_state_from_tb(cpu, tb, cpu->mem_io_pc, true);
+        cpu_restore_state_from_tb(cpu, tb, retaddr, true);
         tb_phys_invalidate(tb, -1);
     } else {
         /* The exception probably happened in a helper.  The CPU state should
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
                 cpu->watchpoint_hit = wp;
 
                 mmap_lock();
-                tb_check_watchpoint(cpu);
+                tb_check_watchpoint(cpu, ra);
                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                     cpu->exception_index = EXCP_DEBUG;
                     mmap_unlock();
-- 
2.17.1

The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

----------------------------------------------------------------
Respect PROT_EXEC in user-only mode.
Fix s390x, i386 and riscv for translations crossing a page.

----------------------------------------------------------------
Ilya Leoshkevich (4):
      linux-user: Clear translations on mprotect()
      accel/tcg: Introduce is_same_page()
      target/s390x: Make translator stop before the end of a page
      target/i386: Make translator stop before the end of a page

Richard Henderson (16):
      linux-user/arm: Mark the commpage executable
      linux-user/hppa: Allocate page zero as a commpage
      linux-user/x86_64: Allocate vsyscall page as a commpage
      linux-user: Honor PT_GNU_STACK
      tests/tcg/i386: Move smc_code2 to an executable section
      accel/tcg: Properly implement get_page_addr_code for user-only
      accel/tcg: Unlock mmap_lock after longjmp
      accel/tcg: Make tb_htable_lookup static
      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
      accel/tcg: Document the faulting lookup in tb_lookup_cmp
      accel/tcg: Remove translator_ldsw
      accel/tcg: Add pc and host_pc params to gen_intermediate_code
      accel/tcg: Add fast path for translator_ld*
      target/riscv: Add MAX_INSN_LEN and insn_len
      target/riscv: Make translator stop before the end of a page

include/elf.h                     |   1 +
 include/exec/cpu-common.h         |   1 +
 include/exec/exec-all.h           |  89 ++++++++----------------
 include/exec/translator.h         |  96 ++++++++++++++++---------
 linux-user/arm/target_cpu.h       |   4 +-
 linux-user/qemu.h                 |   1 +
 accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
 accel/tcg/cputlb.c                |  93 +++++++------------------
 accel/tcg/translate-all.c         |  29 ++++----
 accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
 accel/tcg/user-exec.c             |  17 ++++-
 linux-user/elfload.c              |  82 ++++++++++++++++++++--
 linux-user/mmap.c                 |   6 +-
 softmmu/physmem.c                 |  12 ++++
 target/alpha/translate.c          |   5 +-
 target/arm/translate.c            |   5 +-
 target/avr/translate.c            |   5 +-
 target/cris/translate.c           |   5 +-
 target/hexagon/translate.c        |   6 +-
 target/hppa/translate.c           |   5 +-
 target/i386/tcg/translate.c       |  71 +++++++++++--------
 target/loongarch/translate.c      |   6 +-
 target/m68k/translate.c           |   5 +-
 target/microblaze/translate.c     |   5 +-
 target/mips/tcg/translate.c       |   5 +-
 target/nios2/translate.c          |   5 +-
 target/openrisc/translate.c       |   6 +-
 target/ppc/translate.c            |   5 +-
 target/riscv/translate.c          |  32 +++++++--
 target/rx/translate.c             |   5 +-
 target/s390x/tcg/translate.c      |  20 ++++--
 target/sh4/translate.c            |   5 +-
 target/sparc/translate.c          |   5 +-
 target/tricore/translate.c        |   6 +-
 target/xtensa/translate.c         |   6 +-
 tests/tcg/i386/test-i386.c        |   2 +-
 tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
 tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
 tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |   1 +
 tests/tcg/s390x/Makefile.target   |   1 +
 tests/tcg/x86_64/Makefile.target  |   3 +-
 43 files changed, 966 insertions(+), 367 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/x86_64/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

We're about to start validating PAGE_EXEC, which means
that we've got to mark the commpage executable.  We had
been placing the commpage outside of reserved_va, which
was incorrect and lead to an abort.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_cpu.h | 4 ++--
 linux-user/elfload.c        | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_cpu.h
+++ b/linux-user/arm/target_cpu.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
     } else {
         /*
          * We need to be able to map the commpage.
-         * See validate_guest_space in linux-user/elfload.c.
+         * See init_guest_commpage in linux-user/elfload.c.
          */
-        return 0xffff0000ul;
+        return 0xfffffffful;
     }
 }
 #define MAX_RESERVED_VA  arm_max_reserved_va
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+    void *want = g2h_untagged(commpage);
     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         perror("Protecting guest commpage");
         exit(EXIT_FAILURE);
     }
+
+    page_set_flags(commpage, commpage + qemu_host_page_size,
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
 
-- 
2.34.1

While there are no target-specific nonfaulting probes,
generic code may grow some uses at some point.

Note that the attrs argument was incorrect -- it should have
been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    int prot = 0;
-    MemTxAttrs attrs = {};
+    int prot, page_size = TARGET_PAGE_SIZE;
     uint32_t paddr;
 
     address &= TARGET_PAGE_MASK;
 
     if (mmu_idx == MMU_CODE_IDX) {
-        /* access to code in flash */
+        /* Access to code in flash. */
         paddr = OFFSET_CODE + address;
         prot = PAGE_READ | PAGE_EXEC;
-        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
+        if (paddr >= OFFSET_DATA) {
+            /*
+             * This should not be possible via any architectural operations.
+             * There is certainly not an exception that we can deliver.
+             * Accept probing that might come from generic code.
+             */
+            if (probe) {
+                return false;
+            }
             error_report("execution left flash memory");
             abort();
         }
-    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /*
-         * access to CPU registers, exit and rebuilt this TB to use full access
-         * incase it touches specially handled registers like SREG or SP
-         */
-        AVRCPU *cpu = AVR_CPU(cs);
-        CPUAVRState *env = &cpu->env;
-        env->fullacc = 1;
-        cpu_loop_exit_restore(cs, retaddr);
     } else {
-        /* access to memory. nothing special */
+        /* Access to memory. */
         paddr = OFFSET_DATA + address;
         prot = PAGE_READ | PAGE_WRITE;
+        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
+            /*
+             * Access to CPU registers, exit and rebuilt this TB to use
+             * full access in case it touches specially handled registers
+             * like SREG or SP.  For probing, set page_size = 1, in order
+             * to force tlb_fill to be called for the next access.
+             */
+            if (probe) {
+                page_size = 1;
+            } else {
+                AVRCPU *cpu = AVR_CPU(cs);
+                CPUAVRState *env = &cpu->env;
+                env->fullacc = 1;
+                cpu_loop_exit_restore(cs, retaddr);
+            }
+        }
     }
 
-    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
-                            mmu_idx, TARGET_PAGE_SIZE);
-
+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
     return true;
 }
 
-- 
2.34.1

There is no need to go through cc->tcg_ops when
we know what value that must have.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     bool ret = false;
-    CPUClass *cc = CPU_GET_CLASS(cs);
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             if (!env->intsrc) {
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark page zero executable.  We had been special casing this
entirely within translate.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
     regs->gr[31] = infop->entry;
 }
 
+#define LO_COMMPAGE  0
+
+static bool init_guest_commpage(void)
+{
+    void *want = g2h_untagged(LO_COMMPAGE);
+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    if (addr == MAP_FAILED) {
+        perror("Allocating guest commpage");
+        exit(EXIT_FAILURE);
+    }
+    if (addr != want) {
+        return false;
+    }
+
+    /*
+     * On Linux, page zero is normally marked execute only + gateway.
+     * Normal read or write is supposed to fail (thus PROT_NONE above),
+     * but specific offsets have kernel code mapped to raise permissions
+     * and implement syscalls.  Here, simply mark the page executable.
+     * Special case the entry points during translation (see do_page_zero).
+     */
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 #endif /* TARGET_HPPA */
 
 #ifdef TARGET_XTENSA
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 }
 
 #if defined(HI_COMMPAGE)
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #elif defined(LO_COMMPAGE)
 #define HI_COMMPAGE 0
 #else
 #define HI_COMMPAGE 0
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #define init_guest_commpage() true
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
         } else {
             offset = -(HI_COMMPAGE & -align);
         }
-    } else if (LO_COMMPAGE != 0) {
+    } else if (LO_COMMPAGE != -1) {
         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
     }
 
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark the vsyscall page executable.  We had been special
casing this entirely within translate.

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
 }
 
+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
+#define INIT_GUEST_COMMPAGE
+static bool init_guest_commpage(void)
+{
+    /*
+     * The vsyscall page is at a high negative address aka kernel space,
+     * which means that we cannot actually allocate it with target_mmap.
+     * We still should be able to use page_set_flags, unless the user
+     * has specified -R reserved_va, which would trigger an assert().
+     */
+    if (reserved_va != 0 &&
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
+        error_report("Cannot allocate vsyscall page");
+        exit(EXIT_FAILURE);
+    }
+    page_set_flags(TARGET_VSYSCALL_PAGE,
+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+#endif
 #else
 
 #define ELF_START_MMAP 0x80000000
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #else
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
+#ifndef INIT_GUEST_COMMPAGE
 #define init_guest_commpage() true
 #endif
+#endif
 
 static void pgb_fail_in_use(const char *image_name)
 {
-- 
2.34.1

We cannot deliver two interrupts simultaneously;
the first interrupt handler must execute first.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

This bit is not saved across interrupts, so we must
delay delivering the interrupt until the skip has
been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c    |  9 +++++++++
 target/avr/translate.c | 26 ++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
+    /*
+     * We cannot separate a skip from the next instruction,
+     * as the skip would not be preserved across the interrupt.
+     * Separating the two insn normally only happens at page boundaries.
+     */
+    if (env->skip) {
+        return false;
+    }
+
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (skip_label) {
         canonicalize_skip(ctx);
         gen_set_label(skip_label);
-        if (ctx->base.is_jmp == DISAS_NORETURN) {
+
+        switch (ctx->base.is_jmp) {
+        case DISAS_NORETURN:
             ctx->base.is_jmp = DISAS_CHAIN;
+            break;
+        case DISAS_NEXT:
+            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
+                ctx->base.is_jmp = DISAS_TOO_MANY;
+            }
+            break;
+        default:
+            break;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     bool nonconst_skip = canonicalize_skip(ctx);
+    /*
+     * Because we disable interrupts while env->skip is set,
+     * we must return to the main loop to re-evaluate afterward.
+     */
+    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
 
     switch (ctx->base.is_jmp) {
     case DISAS_NORETURN:
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
     case DISAS_CHAIN:
-        if (!nonconst_skip) {
+        if (!nonconst_skip && !force_exit) {
             /* Note gen_goto_tb checks singlestep.  */
             gen_goto_tb(ctx, 1, ctx->npc);
             break;
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        tcg_gen_lookup_and_goto_ptr();
-        break;
+        if (!force_exit) {
+            tcg_gen_lookup_and_goto_ptr();
+            break;
+        }
+        /* fall through */
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;
-- 
2.34.1

Map the stack executable if required by default or on demand.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/elf.h        |  1 +
 linux-user/qemu.h    |  1 +
 linux-user/elfload.c | 19 ++++++++++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/elf.h b/include/elf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
 #define PT_LOPROC  0x70000000
 #define PT_HIPROC  0x7fffffff
 
+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
 #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
 
 #define PT_MIPS_REGINFO   0x70000000
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
         uint32_t        elf_flags;
         int             personality;
         abi_ulong       alignment;
+        bool            exec_stack;
 
         /* Generic semihosting knows about these pointers. */
         abi_ulong       arg_strings;   /* strings for argv */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
 #define ELF_ARCH        EM_386
 
 #define ELF_PLATFORM get_elf_platform()
+#define EXSTACK_DEFAULT true
 
 static const char *get_elf_platform(void)
 {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #define ELF_ARCH        EM_ARM
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #else
 
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define ELF_CLASS   ELFCLASS64
 #define ELF_ARCH    EM_LOONGARCH
+#define EXSTACK_DEFAULT true
 
 #define elf_check_arch(x) ((x) == EM_LOONGARCH)
 
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 #define ELF_CLASS   ELFCLASS32
 #endif
 #define ELF_ARCH    EM_MIPS
+#define EXSTACK_DEFAULT true
 
 #ifdef TARGET_ABI_MIPSN32
 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #define bswaptls(ptr) bswap32s(ptr)
 #endif
 
+#ifndef EXSTACK_DEFAULT
+#define EXSTACK_DEFAULT false
+#endif
+
 #include "elf.h"
 
 /* We must delay the following stanzas until after "elf.h". */
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
                                  struct image_info *info)
 {
     abi_ulong size, error, guard;
+    int prot;
 
     size = guest_stack_size;
     if (size < STACK_LOWER_LIMIT) {
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
         guard = qemu_real_host_page_size();
     }
 
-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
+    prot = PROT_READ | PROT_WRITE;
+    if (info->exec_stack) {
+        prot |= PROT_EXEC;
+    }
+    error = target_mmap(0, size + guard, prot,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
     if (error == -1) {
         perror("mmap stack");
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
      */
     loaddr = -1, hiaddr = 0;
     info->alignment = 0;
+    info->exec_stack = EXSTACK_DEFAULT;
     for (i = 0; i < ehdr->e_phnum; ++i) {
         struct elf_phdr *eppnt = phdr + i;
         if (eppnt->p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
                 goto exit_errmsg;
             }
+        } else if (eppnt->p_type == PT_GNU_STACK) {
+            info->exec_stack = eppnt->p_flags & PF_X;
         }
     }
 
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Introduce a function that checks whether a given address is on the same
page as where disassembly started. Having it improves readability of
the following patches.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Make the DisasContextBase parameter const.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 
 #undef GEN_TRANSLATOR_LD
 
+/*
+ * Return whether addr is on the same page as where disassembly started.
+ * Translators can use this to enforce the rule that only single-insn
+ * translation blocks are allowed to cross page boundaries.
+ */
+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
+{
+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
+}
+
 #endif /* EXEC__TRANSLATOR_H */
-- 
2.34.1

The current implementation is a no-op, simply returning addr.
This is incorrect, because we ought to be checking the page
permissions for execution.

Make get_page_addr_code inline for both implementations.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 85 ++++++++++++++---------------------------
 accel/tcg/cputlb.c      |  5 ---
 accel/tcg/user-exec.c   | 14 +++++++
 3 files changed, 42 insertions(+), 62 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 #endif
 
-#if defined(CONFIG_USER_ONLY)
-void mmap_lock(void);
-void mmap_unlock(void);
-bool have_mmap_lock(void);
-
 /**
- * get_page_addr_code() - user-mode version
+ * get_page_addr_code_hostp()
  * @env: CPUArchState
  * @addr: guest virtual address of guest code
  *
- * Returns @addr.
+ * See get_page_addr_code() (full-system version) for documentation on the
+ * return value.
+ *
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ * to the host address where @addr's content is kept.
+ *
+ * Note: this function can trigger an exception.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp);
+
+/**
+ * get_page_addr_code()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * If we cannot translate and execute from the entire RAM page, or if
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+ * ram_addr_t corresponding to the guest code at @addr.
+ *
+ * Note: this function can trigger an exception.
  */
 static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
                                                 target_ulong addr)
 {
-    return addr;
+    return get_page_addr_code_hostp(env, addr, NULL);
 }
 
-/**
- * get_page_addr_code_hostp() - user-mode version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * Returns @addr.
- *
- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
- * is kept.
- */
-static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
-                                                      target_ulong addr,
-                                                      void **hostp)
-{
-    if (hostp) {
-        *hostp = g2h_untagged(addr);
-    }
-    return addr;
-}
+#if defined(CONFIG_USER_ONLY)
+void mmap_lock(void);
+void mmap_unlock(void);
+bool have_mmap_lock(void);
 
 /**
  * adjust_signal_pc:
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
 
-/**
- * get_page_addr_code() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * If we cannot translate and execute from the entire RAM page, or if
- * the region is not backed by RAM, returns -1. Otherwise, returns the
- * ram_addr_t corresponding to the guest code at @addr.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
-
-/**
- * get_page_addr_code_hostp() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * See get_page_addr_code() (full-system version) for documentation on the
- * return value.
- *
- * Sets *@hostp (when @hostp is non-NULL) as follows.
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
- * to the host address where @addr's content is kept.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp);
-
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
     return qemu_ram_addr_from_host_nofail(p);
 }
 
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-{
-    return get_page_addr_code_hostp(env, addr, NULL);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    int flags;
+
+    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
+    g_assert(flags == 0);
+
+    if (hostp) {
+        *hostp = g2h_untagged(addr);
+    }
+    return addr;
+}
+
 /* The softmmu versions of these helpers are in cputlb.c.  */
 
 /*
-- 
2.34.1

The mmap_lock is held around tb_gen_code.  While the comment
is correct that the lock is dropped when tb_gen_code runs out
of memory, the lock is *not* dropped when an exception is
raised reading code for translation.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c  | 12 ++++++------
 accel/tcg/user-exec.c |  3 ---
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
-        /*
-         * The mmap_lock is dropped by tb_gen_code if it runs out of
-         * memory.
-         */
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
          * (and if the translator doesn't handle page boundaries correctly
          * there's little we can do about that here).  Therefore, do not
          * trigger the unwinder.
-         *
-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
          */
-        mmap_unlock();
         *pc = 0;
         return MMU_INST_FETCH;
     }
-- 
2.34.1

The function is not used outside of cpu-exec.c.  Move it and
its subroutines up in the file, before the first use.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |   3 -
 accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
 2 files changed, 61 insertions(+), 64 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif
 void tb_flush(CPUState *cpu);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
     return cflags;
 }
 
+struct tb_desc {
+    target_ulong pc;
+    target_ulong cs_base;
+    CPUArchState *env;
+    tb_page_addr_t phys_page1;
+    uint32_t flags;
+    uint32_t cflags;
+    uint32_t trace_vcpu_dstate;
+};
+
+static bool tb_lookup_cmp(const void *p, const void *d)
+{
+    const TranslationBlock *tb = p;
+    const struct tb_desc *desc = d;
+
+    if (tb->pc == desc->pc &&
+        tb->page_addr[0] == desc->phys_page1 &&
+        tb->cs_base == desc->cs_base &&
+        tb->flags == desc->flags &&
+        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
+        tb_cflags(tb) == desc->cflags) {
+        /* check next page if needed */
+        if (tb->page_addr[1] == -1) {
+            return true;
+        } else {
+            tb_page_addr_t phys_page2;
+            target_ulong virt_page2;
+
+            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            phys_page2 = get_page_addr_code(desc->env, virt_page2);
+            if (tb->page_addr[1] == phys_page2) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+                                          target_ulong cs_base, uint32_t flags,
+                                          uint32_t cflags)
+{
+    tb_page_addr_t phys_pc;
+    struct tb_desc desc;
+    uint32_t h;
+
+    desc.env = cpu->env_ptr;
+    desc.cs_base = cs_base;
+    desc.flags = flags;
+    desc.cflags = cflags;
+    desc.trace_vcpu_dstate = *cpu->trace_dstate;
+    desc.pc = pc;
+    phys_pc = get_page_addr_code(desc.env, pc);
+    if (phys_pc == -1) {
+        return NULL;
+    }
+    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
+}
+
 /* Might cause an exception, so have a longjmp destination ready */
 static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
     end_exclusive();
 }
 
-struct tb_desc {
-    target_ulong pc;
-    target_ulong cs_base;
-    CPUArchState *env;
-    tb_page_addr_t phys_page1;
-    uint32_t flags;
-    uint32_t cflags;
-    uint32_t trace_vcpu_dstate;
-};
-
-static bool tb_lookup_cmp(const void *p, const void *d)
-{
-    const TranslationBlock *tb = p;
-    const struct tb_desc *desc = d;
-
-    if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
-        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-        tb_cflags(tb) == desc->cflags) {
-        /* check next page if needed */
-        if (tb->page_addr[1] == -1) {
-            return true;
-        } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
-
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags)
-{
-    tb_page_addr_t phys_pc;
-    struct tb_desc desc;
-    uint32_t h;
-
-    desc.env = cpu->env_ptr;
-    desc.cs_base = cs_base;
-    desc.flags = flags;
-    desc.cflags = cflags;
-    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-    desc.pc = pc;
-    phys_pc = get_page_addr_code(desc.env, pc);
-    if (phys_pc == -1) {
-        return NULL;
-    }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
-    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
-}
-
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
 {
     if (TCG_TARGET_HAS_direct_jump) {
-- 
2.34.1

The base qemu_ram_addr_from_host function is already in
softmmu/physmem.c; move the nofail version to be adjacent.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  1 +
 accel/tcg/cputlb.c        | 12 ------------
 softmmu/physmem.c         | 12 ++++++++++++
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
 ram_addr_t qemu_ram_addr_from_host(void *ptr);
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
 RAMBlock *qemu_ram_block_by_name(const char *name);
 RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
                                    ram_addr_t *offset);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                             prot, mmu_idx, size);
 }
 
-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-{
-    ram_addr_t ram_addr;
-
-    ram_addr = qemu_ram_addr_from_host(ptr);
-    if (ram_addr == RAM_ADDR_INVALID) {
-        error_report("Bad ram pointer %p", ptr);
-        abort();
-    }
-    return ram_addr;
-}
-
 /*
  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+{
+    ram_addr_t ram_addr;
+
+    ram_addr = qemu_ram_addr_from_host(ptr);
+    if (ram_addr == RAM_ADDR_INVALID) {
+        error_report("Bad ram pointer %p", ptr);
+        abort();
+    }
+    return ram_addr;
+}
+
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.34.1

Simplify the implementation of get_page_addr_code_hostp
by reusing the existing probe_access infrastructure.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 50 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
                  (ADDR) & TARGET_PAGE_MASK)
 
-/*
- * Return a ram_addr_t for the virtual address for execution.
- *
- * Return -1 if we can't translate and execute from an entire page
- * of RAM.  This will force us to execute by loading and translating
- * one insn at a time, without caching.
- *
- * NOTE: This function will trigger an exception if the page is
- * not executable.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp)
-{
-    uintptr_t mmu_idx = cpu_mmu_index(env, true);
-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    void *p;
-
-    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
-        if (!VICTIM_TLB_HIT(addr_code, addr)) {
-            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
-
-            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
-                /*
-                 * The MMU protection covers a smaller range than a target
-                 * page, so we must redo the MMU check for every insn.
-                 */
-                return -1;
-            }
-        }
-        assert(tlb_hit(entry->addr_code, addr));
-    }
-
-    if (unlikely(entry->addr_code & TLB_MMIO)) {
-        /* The region is not backed by RAM.  */
-        if (hostp) {
-            *hostp = NULL;
-        }
-        return -1;
-    }
-
-    p = (void *)((uintptr_t)addr + entry->addend);
-    if (hostp) {
-        *hostp = p;
-    }
-    return qemu_ram_addr_from_host_nofail(p);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
     return flags ? NULL : host;
 }
 
+/*
+ * Return a ram_addr_t for the virtual address for execution.
+ *
+ * Return -1 if we can't translate and execute from an entire page
+ * of RAM.  This will force us to execute by loading and translating
+ * one insn at a time, without caching.
+ *
+ * NOTE: This function will trigger an exception if the page is
+ * not executable.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    void *p;
+
+    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
+                                cpu_mmu_index(env, true), false, &p, 0);
+    if (p == NULL) {
+        return -1;
+    }
+    if (hostp) {
+        *hostp = p;
+    }
+    return qemu_ram_addr_from_host_nofail(p);
+}
+
 #ifdef CONFIG_PLUGIN
 /*
  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
-- 
2.34.1

It was non-obvious to me why we can raise an exception in
the middle of a comparison function, but it works.
While nearby, use TARGET_PAGE_ALIGN instead of open-coding.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
             tb_page_addr_t phys_page2;
             target_ulong virt_page2;
 
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            /*
+             * We know that the first page matched, and an otherwise valid TB
+             * encountered an incomplete instruction at the end of that page,
+             * therefore we know that generating a new TB from the current PC
+             * must also require reading from the next page -- even if the
+             * second pages do not match, and therefore the resulting insn
+             * is different for the new TB.  Therefore any exception raised
+             * here by the faulting lookup is not premature.
+             */
+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
             phys_page2 = get_page_addr_code(desc->env, virt_page2);
             if (tb->page_addr[1] == phys_page2) {
                 return true;
-- 
2.34.1

The only user can easily use translator_lduw and
adjust the type to signed during the return.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h   | 1 -
 target/i386/tcg/translate.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define FOR_EACH_TRANSLATOR_LD(F)                                       \
     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
-- 
2.34.1

Pass these along to translator_loop -- pc may be used instead
of tb->pc, and host_pc is currently unused.  Adjust all targets
at one time.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  1 -
 include/exec/translator.h     | 24 ++++++++++++++++++++----
 accel/tcg/translate-all.c     |  6 ++++--
 accel/tcg/translator.c        |  9 +++++----
 target/alpha/translate.c      |  5 +++--
 target/arm/translate.c        |  5 +++--
 target/avr/translate.c        |  5 +++--
 target/cris/translate.c       |  5 +++--
 target/hexagon/translate.c    |  6 ++++--
 target/hppa/translate.c       |  5 +++--
 target/i386/tcg/translate.c   |  5 +++--
 target/loongarch/translate.c  |  6 ++++--
 target/m68k/translate.c       |  5 +++--
 target/microblaze/translate.c |  5 +++--
 target/mips/tcg/translate.c   |  5 +++--
 target/nios2/translate.c      |  5 +++--
 target/openrisc/translate.c   |  6 ++++--
 target/ppc/translate.c        |  5 +++--
 target/riscv/translate.c      |  5 +++--
 target/rx/translate.c         |  5 +++--
 target/s390x/tcg/translate.c  |  5 +++--
 target/sh4/translate.c        |  5 +++--
 target/sparc/translate.c      |  5 +++--
 target/tricore/translate.c    |  6 ++++--
 target/xtensa/translate.c     |  6 ++++--
 25 files changed, 97 insertions(+), 53 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
 #endif
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
 void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
+/**
+ * gen_intermediate_code
+ * @cpu: cpu context
+ * @tb: translation block
+ * @max_insns: max number of instructions to translate
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ *
+ * This function must be provided by the target, which should create
+ * the target-specific DisasContext, and then invoke translator_loop.
+ */
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc);
 
 /**
  * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
 
 /**
  * translator_loop:
- * @ops: Target-specific operations.
- * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
  * @max_insns: Maximum number of insns to translate.
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ * @ops: Target-specific operations.
+ * @db: Disassembly context.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When single-stepping is enabled (system-wide or on the current vCPU).
  * - When too many instructions have been translated.
  */
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns);
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/cputlb.h"
 #include "exec/translate-all.h"
+#include "exec/translator.h"
 #include "qemu/bitmap.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
 #endif
+    void *host_pc;
 
     assert_memory_lock();
     qemu_thread_jit_write();
 
-    phys_pc = get_page_addr_code(env, pc);
+    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
 
     if (phys_pc == -1) {
         /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(cpu, tb, max_insns);
+    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
     assert(tb->size != 0);
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
 #endif
 }
 
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db)
 {
     uint32_t cflags = tb_cflags(tb);
     bool plugin_enabled;
 
     /* Initialize DisasContext */
     db->tb = tb;
-    db->pc_first = tb->pc;
-    db->pc_next = db->pc_first;
+    db->pc_first = pc;
+    db->pc_next = pc;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
     db->max_insns = max_insns;
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
     .disas_log          = avr_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
-    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
     .disas_log          = cris_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
     .disas_log          = hexagon_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &hexagon_tr_ops, &ctx.base);
 }
 
 #define NAME_LEN               64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
     .disas_log          = loongarch_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &loongarch_tr_ops, &ctx.base);
 }
 
 void loongarch_translate_init(void)
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
     .disas_log          = mb_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
 }
 
 void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
 }
 
 void mips_tcg_init(void)
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
     .disas_log          = nios2_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
 }
 
 void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &openrisc_tr_ops, &ctx.base);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
 }
 
 void riscv_translate_init(void)
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
     .disas_log          = rx_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
 };
 
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &tricore_tr_ops, &ctx.base);
 }
 
 void
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc,
+                    &xtensa_translator_ops, &dc.base);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.34.1

Cache the translation from guest to host address, so we may
use direct loads when we hit on the primary translation page.

Look up the second translation page only once, during translation.
This obviates another lookup of the second page within tb_gen_code
after translation.

Fixes a bug in that plugin_insn_append should be passed the bytes
in the original memory order, not bswapped by pieces.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h |  63 +++++++++++--------
 accel/tcg/translate-all.c |  23 +++----
 accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
 3 files changed, 141 insertions(+), 71 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
  * Architecture-agnostic disassembly context.
  */
 typedef struct DisasContextBase {
-    const TranslationBlock *tb;
+    TranslationBlock *tb;
     target_ulong pc_first;
     target_ulong pc_next;
     DisasJumpType is_jmp;
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
-#ifdef CONFIG_USER_ONLY
-    /*
-     * Guest address of the last byte of the last protected page.
-     *
-     * Pages containing the translated instructions are made non-writable in
-     * order to achieve consistency in case another thread is modifying the
-     * code while translate_insn() fetches the instruction bytes piecemeal.
-     * Such writer threads are blocked on mmap_lock() in page_unprotect().
-     */
-    target_ulong page_protect_end;
-#endif
+    void *host_addr[2];
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  * the relevant information at translation time.
  */
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap);                   \
-    static inline type fullname(CPUArchState *env,                      \
-                                DisasContextBase *dcbase, abi_ptr pc)   \
-    {                                                                   \
-        return fullname ## _swap(env, dcbase, pc, false);               \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+
+static inline uint16_t
+translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
+                     abi_ptr pc, bool do_swap)
+{
+    uint16_t ret = translator_lduw(env, db, pc);
+    if (do_swap) {
+        ret = bswap16(ret);
     }
+    return ret;
+}
 
-#define FOR_EACH_TRANSLATOR_LD(F)                                       \
-    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+static inline uint32_t
+translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint32_t ret = translator_ldl(env, db, pc);
+    if (do_swap) {
+        ret = bswap32(ret);
+    }
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-
-#undef GEN_TRANSLATOR_LD
+static inline uint64_t
+translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint64_t ret = translator_ldq_swap(env, db, pc, false);
+    if (do_swap) {
+        ret = bswap64(ret);
+    }
+    return ret;
+}
 
 /*
  * Return whether addr is on the same page as where disassembly started.
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb, *existing_tb;
-    tb_page_addr_t phys_pc, phys_page2;
-    target_ulong virt_page2;
+    tb_page_addr_t phys_pc;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->flags = flags;
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+    tb->page_addr[0] = phys_pc;
+    tb->page_addr[1] = -1;
     tcg_ctx->tb_cflags = cflags;
  tb_overflow:
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
 
     /*
-     * If the TB is not associated with a physical RAM page then
-     * it must be a temporary one-insn TB, and we have nothing to do
-     * except fill in the page_addr[] fields. Return early before
-     * attempting to link to other TBs or add to the lookup table.
+     * If the TB is not associated with a physical RAM page then it must be
+     * a temporary one-insn TB, and we have nothing left to do. Return early
+     * before attempting to link to other TBs or add to the lookup table.
      */
-    if (phys_pc == -1) {
-        tb->page_addr[0] = tb->page_addr[1] = -1;
+    if (tb->page_addr[0] == -1) {
         return tb;
     }
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      */
     tcg_tb_insert(tb);
 
-    /* check next page if needed */
-    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
-    phys_page2 = -1;
-    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
-        phys_page2 = get_page_addr_code(env, virt_page2);
-    }
     /*
      * No explicit memory barrier is required -- tb_link_page() makes the
      * TB visible in a consistent state.
      */
-    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
+    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
     /* if the TB already exists, discard what we just translated */
     if (unlikely(existing_tb != tb)) {
         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
-static inline void translator_page_protect(DisasContextBase *dcbase,
-                                           target_ulong pc)
-{
-#ifdef CONFIG_USER_ONLY
-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-    page_protect(pc);
-#endif
-}
-
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                      target_ulong pc, void *host_pc,
                      const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
-    translator_page_protect(db, db->pc_next);
+    db->host_addr[0] = host_pc;
+    db->host_addr[1] = NULL;
+
+#ifdef CONFIG_USER_ONLY
+    page_protect(pc);
+#endif
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 #endif
 }
 
-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
-                                                 target_ulong pc, size_t len)
+static void *translator_access(CPUArchState *env, DisasContextBase *db,
+                               target_ulong pc, size_t len)
 {
-#ifdef CONFIG_USER_ONLY
-    target_ulong end = pc + len - 1;
+    void *host;
+    target_ulong base, end;
+    TranslationBlock *tb;
 
-    if (end > dcbase->page_protect_end) {
-        translator_page_protect(dcbase, end);
+    tb = db->tb;
+
+    /* Use slow path if first page is MMIO. */
+    if (unlikely(tb->page_addr[0] == -1)) {
+        return NULL;
     }
+
+    end = pc + len - 1;
+    if (likely(is_same_page(db, end))) {
+        host = db->host_addr[0];
+        base = db->pc_first;
+    } else {
+        host = db->host_addr[1];
+        base = TARGET_PAGE_ALIGN(db->pc_first);
+        if (host == NULL) {
+            tb->page_addr[1] =
+                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+#ifdef CONFIG_USER_ONLY
+            page_protect(end);
 #endif
+            /* We cannot handle MMIO as second page. */
+            assert(tb->page_addr[1] != -1);
+            host = db->host_addr[1];
+        }
+
+        /* Use slow path when crossing pages. */
+        if (is_same_page(db, pc)) {
+            return NULL;
+        }
+    }
+
+    tcg_debug_assert(pc >= base);
+    return host + (pc - base);
 }
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap)                    \
-    {                                                                   \
-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(pc, &ret, sizeof(ret));                      \
-        return ret;                                                     \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint8_t ret;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldub_p(p);
     }
+    ret = cpu_ldub_code(env, pc);
+    plugin_insn_append(pc, &ret, sizeof(ret));
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint16_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
 
-#undef GEN_TRANSLATOR_LD
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return lduw_p(p);
+    }
+    ret = cpu_lduw_code(env, pc);
+    plug = tswap16(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint32_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldl_p(p);
+    }
+    ret = cpu_ldl_code(env, pc);
+    plug = tswap32(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint64_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldq_p(p);
+    }
+    ret = cpu_ldq_code(env, pc);
+    plug = tswap64(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c     |  15 +++-
 tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
 tests/tcg/s390x/Makefile.target  |   1 +
 4 files changed, 257 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
     dc->insn_start = tcg_last_op();
 }
 
+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
+{
+    uint64_t insn = ld_code2(env, s, pc);
+
+    return pc + get_ilen((insn >> 8) & 0xff);
+}
+
 static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     CPUS390XState *env = cs->env_ptr;
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     dc->base.is_jmp = translate_one(env, dc);
     if (dc->base.is_jmp == DISAS_NEXT) {
-        uint64_t page_start;
-
-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
+        if (!is_same_page(dcbase, dc->base.pc_next) ||
+            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
+            dc->ex_value) {
             dc->base.is_jmp = DISAS_TOO_MANY;
         }
     }
diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->psw.addr;
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[2];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
+    "   br %r14\n"          /* return */
+    "noexec_end:");
+
+extern char exrl_1[];
+extern char exrl_2[];
+extern char exrl_end[];
+
+asm("exrl_1:\n"
+    "   exrl %r0, exrl_2\n"
+    "   br %r14\n"
+    "exrl_2:\n"
+    "   lgfi %r2,2\n"
+    "exrl_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2,
+            .entry_ofs = exrl_1 - exrl_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl [cross]",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2 - 2,
+            .entry_ofs = exrl_1 - exrl_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * Common code for arch-specific MMU_INST_FETCH fault testing.
+ */
+
+#define _GNU_SOURCE
+
+#include <assert.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/ucontext.h>
+
+/* Forward declarations. */
+
+static void *arch_mcontext_pc(const mcontext_t *ctx);
+static int arch_mcontext_arg(const mcontext_t *ctx);
+static void arch_flush(void *p, int len);
+
+/* Testing infrastructure. */
+
+struct noexec_test {
+    const char *name;
+    const char *test_code;
+    int test_len;
+    int page_ofs;
+    int entry_ofs;
+    int expected_si_ofs;
+    int expected_pc_ofs;
+    int expected_arg;
+};
+
+static void *page_base;
+static int page_size;
+static const struct noexec_test *current_noexec_test;
+
+static void handle_err(const char *syscall)
+{
+    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
+    exit(EXIT_FAILURE);
+}
+
+static void handle_segv(int sig, siginfo_t *info, void *ucontext)
+{
+    const struct noexec_test *test = current_noexec_test;
+    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
+    void *expected_si;
+    void *expected_pc;
+    void *pc;
+    int arg;
+
+    if (test == NULL) {
+        printf("[  FAILED  ] unexpected SEGV\n");
+        exit(EXIT_FAILURE);
+    }
+    current_noexec_test = NULL;
+
+    expected_si = page_base + test->expected_si_ofs;
+    if (info->si_addr != expected_si) {
+        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
+               info->si_addr, expected_si);
+        exit(EXIT_FAILURE);
+    }
+
+    pc = arch_mcontext_pc(mc);
+    expected_pc = page_base + test->expected_pc_ofs;
+    if (pc != expected_pc) {
+        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
+        exit(EXIT_FAILURE);
+    }
+
+    arg = arch_mcontext_arg(mc);
+    if (arg != test->expected_arg) {
+        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
+        exit(EXIT_FAILURE);
+    }
+
+    if (mprotect(page_base, page_size,
+                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
+        handle_err("mprotect");
+    }
+}
+
+static void test_noexec_1(const struct noexec_test *test)
+{
+    void *start = page_base + test->page_ofs;
+    void (*fn)(int arg) = page_base + test->entry_ofs;
+
+    memcpy(start, test->test_code, test->test_len);
+    arch_flush(start, test->test_len);
+
+    /* Trigger TB creation in order to test invalidation. */
+    fn(0);
+
+    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
+        handle_err("mprotect");
+    }
+
+    /* Trigger SEGV and check that handle_segv() ran. */
+    current_noexec_test = test;
+    fn(0);
+    assert(current_noexec_test == NULL);
+}
+
+static int test_noexec(struct noexec_test *tests, size_t n_tests)
+{
+    struct sigaction act;
+    size_t i;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = handle_segv;
+    act.sa_flags = SA_SIGINFO;
+    if (sigaction(SIGSEGV, &act, NULL) < 0) {
+        handle_err("sigaction");
+    }
+
+    page_size = getpagesize();
+    page_base = mmap(NULL, 2 * page_size,
+                     PROT_READ | PROT_WRITE | PROT_EXEC,
+                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+    if (page_base == MAP_FAILED) {
+        handle_err("mmap");
+    }
+    page_base += page_size;
+
+    for (i = 0; i < n_tests; i++) {
+        struct noexec_test *test = &tests[i];
+
+        printf("[ RUN      ] %s\n", test->name);
+        test_noexec_1(test);
+        printf("[       OK ]\n");
+    }
+
+    printf("[  PASSED  ]\n");
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
 TESTS+=trap
 TESTS+=signals-s390x
 TESTS+=branch-relative-long
+TESTS+=noexec
 
 Z14_TESTS=vfminmax
 vfminmax: LDFLAGS+=-lm
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

An implementation, like the one arm and s390x have, would require an
i386 length disassembler, which is burdensome to maintain. Another
alternative would be to single-step at the end of a guest page, but
this may come with a performance impact.

Fix by snapshotting disassembly state and restoring it after we figure
out we crossed a page boundary. This includes rolling back cc_op
updates and emitted ops.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
[rth: Simplify end-of-insn cross-page checks.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
 tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
 tests/tcg/x86_64/Makefile.target |  3 +-
 3 files changed, 116 insertions(+), 26 deletions(-)
 create mode 100644 tests/tcg/x86_64/noexec.c

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv_i64 tmp1_i64;
 
     sigjmp_buf jmpbuf;
+    TCGOp *prev_insn_end;
 } DisasContext;
 
 /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 {
     uint64_t pc = s->pc;
 
+    /* This is a subsequent insn that crosses a page boundary.  */
+    if (s->base.num_insns > 1 &&
+        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
+        siglongjmp(s->jmpbuf, 2);
+    }
+
     s->pc += num_bytes;
     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
         /* If the instruction's 16th byte is on a different page than the 1st, a
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     int modrm, reg, rm, mod, op, opreg, val;
     target_ulong next_eip, tval;
     target_ulong pc_start = s->base.pc_next;
+    bool orig_cc_op_dirty = s->cc_op_dirty;
+    CCOp orig_cc_op = s->cc_op;
 
     s->pc_start = s->pc = pc_start;
     s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     s->rip_offset = 0; /* for relative ip address */
     s->vex_l = 0;
     s->vex_v = 0;
-    if (sigsetjmp(s->jmpbuf, 0) != 0) {
+    switch (sigsetjmp(s->jmpbuf, 0)) {
+    case 0:
+        break;
+    case 1:
         gen_exception_gpf(s);
         return s->pc;
+    case 2:
+        /* Restore state that may affect the next instruction. */
+        s->cc_op_dirty = orig_cc_op_dirty;
+        s->cc_op = orig_cc_op;
+        s->base.num_insns--;
+        tcg_remove_ops_after(s->prev_insn_end);
+        s->base.is_jmp = DISAS_TOO_MANY;
+        return pc_start;
+    default:
+        g_assert_not_reached();
     }
 
     prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
+    dc->prev_insn_end = tcg_last_op();
     tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
 }
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 #endif
 
     pc_next = disas_insn(dc, cpu);
-
-    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
-        /* if single step mode, we generate only one instruction and
-           generate an exception */
-        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
-           the flag and abort the translation to give the irqs a
-           chance to happen */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
-               && ((pc_next & TARGET_PAGE_MASK)
-                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
-                       & TARGET_PAGE_MASK)
-                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
-        /* Do not cross the boundary of the pages in icount mode,
-           it can cause an exception. Do it only when boundary is
-           crossed by the first instruction in the block.
-           If current instruction already crossed the bound - it's ok,
-           because an exception hasn't stopped this code.
-         */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    }
-
     dc->base.pc_next = pc_next;
+
+    if (dc->base.is_jmp == DISAS_NEXT) {
+        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
+            /*
+             * If single step mode, we generate only one instruction and
+             * generate an exception.
+             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
+             * the flag and abort the translation to give the irqs a
+             * chance to happen.
+             */
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        } else if (!is_same_page(&dc->base, pc_next)) {
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        }
+    }
 }
 
 static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/x86_64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->gregs[REG_RIP];
+}
+
+int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[REG_RDI];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
+    "    ret\n"
+    "noexec_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/x86_64/Makefile.target
+++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
 
 ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
 X86_64_TESTS += vsyscall
+X86_64_TESTS += noexec
 TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
 else
 TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
 test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
+%: $(SRC_PATH)/tests/tcg/x86_64/%.c
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-- 
2.34.1

These will be useful in properly ending the TB.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 /* Include decoders for factored-out extensions */
 #include "decode-XVentanaCondOps.c.inc"
 
+/* The specification allows for longer insns, but not supported by qemu. */
+#define MAX_INSN_LEN  4
+
+static inline int insn_len(uint16_t first_word)
+{
+    return (first_word & 3) == 3 ? 4 : 2;
+}
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     };
 
     /* Check for compressed insn */
-    if (extract16(opcode, 0, 2) != 3) {
+    if (insn_len(opcode) == 2) {
         if (!has_ext(ctx, RVC)) {
             gen_exception_illegal(ctx);
         } else {
-- 
2.34.1

Right now the translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c          | 17 +++++--
 tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |  1 +
 3 files changed, 93 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     ctx->nftemp = 0;
 
+    /* Only the first insn within a TB is allowed to cross a page boundary. */
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        target_ulong page_start;
-
-        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
-        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
+        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
+        } else {
+            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
+
+            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
+                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
+                int len = insn_len(next_insn);
+
+                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
+                    ctx->base.is_jmp = DISAS_TOO_MANY;
+                }
+            }
         }
     }
 }
diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->__gregs[REG_PC];
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->__gregs[REG_A0];
+}
+
+static void arch_flush(void *p, int len)
+{
+    __builtin___clear_cache(p, p + len);
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm(".option push\n"
+    ".option norvc\n"
+    "noexec_1:\n"
+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   li a0,2\n"      /* a0 is 0/1; set 2. */
+    "   ret\n"
+    "noexec_end:\n"
+    ".option pop");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
 
 VPATH += $(SRC_PATH)/tests/tcg/riscv64
 TESTS += test-div
+TESTS += noexec
-- 
2.34.1