Series comparison

-[PULL 00/16] tcg patch queue
+[PULL 00/11] tcg patch queue
-The following changes since commit 3e08b2b9cb64bff2b73fa9128c0e49bfcde0dd40:
+The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
-  Merge remote-tracking branch 'remotes/philmd-gitlab/tags/edk2-next-20200121' into staging (2020-01-21 15:29:25 +0000)
+  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20200121
+  https://github.com/rth7680/qemu.git tags/pull-tcg-20201008
-for you to fetch changes up to 75fa376cdab5e5db2c7fdd107358e16f95503ac6:
+for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:
-  scripts/git.orderfile: Display decodetree before C source (2020-01-21 15:26:09 -1000)
+  accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)
 ----------------------------------------------------------------
-Remove another limit to NB_MMU_MODES.
+Extend maximum gvec vector size
-Fix compilation using uclibc.
+Fix i386 avx2 dupi
-Fix defaulting of -accel parameters.
+Fix mips host user-only write detection
-Tidy cputlb basic routines.
+Misc cleanups.
 Adjust git.orderfile for decodetree.
 ----------------------------------------------------------------
-Carlos Santos (1):
+Kele Huang (1):
-      util/cacheinfo: fix crash when compiling with uClibc
+      accel/tcg: Fix computing of is_write for MIPS
-Philippe Mathieu-Daudé (1):
+Richard Henderson (10):
-      scripts/git.orderfile: Display decodetree before C source
+      tcg: Adjust simd_desc size encoding
       tcg: Drop union from TCGArgConstraint
       tcg: Move sorted_args into TCGArgConstraint.sort_index
       tcg: Remove TCG_CT_REG
       tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
       tcg: Remove TCGOpDef.used
       tcg/i386: Fix dupi for avx2 32-bit hosts
       tcg: Fix generation of dupi_vec for 32-bit host
       tcg/optimize: Fold dup2_vec
       tcg: Remove TCG_TARGET_HAS_cmp_vec
-Richard Henderson (14):
+ include/tcg/tcg-gvec-desc.h  | 38 ++++++++++++------
-      cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
+ include/tcg/tcg.h            | 22 ++++------
-      vl: Remove unused variable in configure_accelerators
+ tcg/aarch64/tcg-target.h     |  1 -
-      vl: Reduce scope of variables in configure_accelerators
+ tcg/i386/tcg-target.h        |  1 -
-      vl: Remove useless test in configure_accelerators
+ tcg/ppc/tcg-target.h         |  1 -
-      vl: Only choose enabled accelerators in configure_accelerators
+ accel/tcg/user-exec.c        | 43 ++++++++++++++++++--
-      cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
+ tcg/optimize.c               | 15 +++++++
-      cputlb: Make tlb_n_entries private to cputlb.c
+ tcg/tcg-op-gvec.c            | 35 ++++++++++++----
-      cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
+ tcg/tcg-op-vec.c             | 12 ++++--
-      cputlb: Hoist tlb portions in tlb_mmu_resize_locked
+ tcg/tcg.c                    | 96 +++++++++++++++++++-------------------------
-      cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
+ tcg/aarch64/tcg-target.c.inc | 17 ++++----
-      cputlb: Split out tlb_mmu_flush_locked
+ tcg/arm/tcg-target.c.inc     | 29 ++++++-------
-      cputlb: Partially merge tlb_dyn_init into tlb_init
+ tcg/i386/tcg-target.c.inc    | 39 +++++++-----------
-      cputlb: Initialize tlbs as flushed
+ tcg/mips/tcg-target.c.inc    | 21 +++++-----
-      cputlb: Hoist timestamp outside of loops over tlbs
+ tcg/ppc/tcg-target.c.inc     | 29 ++++++-------
  tcg/riscv/tcg-target.c.inc   | 16 ++++----
  tcg/s390/tcg-target.c.inc    | 22 +++++-----
  tcg/sparc/tcg-target.c.inc   | 21 ++++------
  tcg/tci/tcg-target.c.inc     |  3 +-
 files changed, 244 insertions(+), 217 deletions(-)
- include/exec/cpu_ldst.h |   5 -
- accel/tcg/cputlb.c      | 287 +++++++++++++++++++++++++++++++++---------------
- util/cacheinfo.c        |  10 +-
- vl.c                    |  27 +++--
- scripts/git.orderfile   |   3 +
-files changed, 223 insertions(+), 109 deletions(-)

-[PULL 13/16] cputlb: Partially merge tlb_dyn_init into tlb_init
+[PULL 01/11] tcg: Adjust simd_desc size encoding
-Merge into the only caller, but at the same time split
+With larger vector sizes, it turns out oprsz == maxsz, and we only
-out tlb_mmu_init to initialize a single tlb entry.
+need to represent mismatch for oprsz <= 32.  We do, however, need
 to represent larger oprsz and do so without reducing SIMD_DATA_BITS.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reduce the size of the oprsz field and increase the maxsz field.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Steal the oprsz value of 24 to indicate equality with maxsz.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 33 ++++++++++++++++-----------------
+ include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
-file changed, 16 insertions(+), 17 deletions(-)
+ tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 files changed, 52 insertions(+), 21 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/tcg/tcg-gvec-desc.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/tcg/tcg-gvec-desc.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
+@@ -XXX,XX +XXX,XX @@
-     desc->window_max_entries = max_entries;
+ #ifndef TCG_TCG_GVEC_DESC_H
- }
+ #define TCG_TCG_GVEC_DESC_H
--static void tlb_dyn_init(CPUArchState *env)
+-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
 -#define SIMD_OPRSZ_SHIFT   0
 -#define SIMD_OPRSZ_BITS    5
 +/*
 + * This configuration allows MAXSZ to represent 2048 bytes, and
 + * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
 + *
 + * Encode this with:
 + *   0, 1, 3 -> 8, 16, 32
 + *   2       -> maxsz
 + *
 + * This steals the input that would otherwise map to 24 to match maxsz.
 + */
 +#define SIMD_MAXSZ_SHIFT   0
 +#define SIMD_MAXSZ_BITS    8
 -#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 -#define SIMD_MAXSZ_BITS    5
 +#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
 +#define SIMD_OPRSZ_BITS    2
 -#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
 +#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
  #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
  /* Create a descriptor from components.  */
  uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 -/* Extract the operation size from a descriptor.  */
 -static inline intptr_t simd_oprsz(uint32_t desc)
 -{
--    int i;
+-    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
 -
 -    for (i = 0; i < NB_MMU_MODES; i++) {
 -        CPUTLBDesc *desc = &env_tlb(env)->d[i];
 -        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
 -
 -        tlb_window_reset(desc, get_clock_realtime(), 0);
 -        desc->n_used_entries = 0;
 -        env_tlb(env)->f[i].mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
 -        env_tlb(env)->f[i].table = g_new(CPUTLBEntry, n_entries);
 -        env_tlb(env)->d[i].iotlb = g_new(CPUIOTLBEntry, n_entries);
 -    }
 -}
 -
- /**
+ /* Extract the max vector size from a descriptor.  */
-  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
+ static inline intptr_t simd_maxsz(uint32_t desc)
-  * @desc: The CPUTLBDesc portion of the TLB
+ {
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+-    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
-     tlb_mmu_flush_locked(desc, fast);
++    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
  }
 +static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
 +{
 +    size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
 +
 +    tlb_window_reset(desc, now, 0);
 +    desc->n_used_entries = 0;
 +    fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
 +    fast->table = g_new(CPUTLBEntry, n_entries);
 +    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
 +}
 +
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
++/* Extract the operation size from a descriptor.  */
 +static inline intptr_t simd_oprsz(uint32_t desc)
 +{
 +    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
 +    intptr_t o = f * 8 + 8;
 +    intptr_t m = simd_maxsz(desc);
 +    return f == 2 ? m : o;
  }
  /* Extract the operation-specific data from a descriptor.  */
 diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op-gvec.c
 +++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
     of the operand offsets so that we can check them all at once.  */
  static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
  {
-     env_tlb(env)->d[mmu_idx].n_used_entries++;
+-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-@@ -XXX,XX +XXX,XX @@ static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
+-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
- void tlb_init(CPUState *cpu)
+-    tcg_debug_assert(oprsz > 0);
 -    tcg_debug_assert(oprsz <= maxsz);
 -    tcg_debug_assert((oprsz & opr_align) == 0);
 +    uint32_t max_align;
 +
 +    switch (oprsz) {
 +    case 8:
 +    case 16:
 +    case 32:
 +        tcg_debug_assert(oprsz <= maxsz);
 +        break;
 +    default:
 +        tcg_debug_assert(oprsz == maxsz);
 +        break;
 +    }
 +    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
 +
 +    max_align = maxsz >= 16 ? 15 : 7;
      tcg_debug_assert((maxsz & max_align) == 0);
      tcg_debug_assert((ofs & max_align) == 0);
  }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
  {
-     CPUArchState *env = cpu->env_ptr;
+     uint32_t desc = 0;
-+    int64_t now = get_clock_realtime();
-+    int i;
+-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
+-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-     qemu_spin_init(&env_tlb(env)->c.lock);
+-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
++    check_size_align(oprsz, maxsz, 0);
-     /* Ensure that cpu_reset performs a full flush.  */
++    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
-     env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
+     oprsz = (oprsz / 8) - 1;
--    tlb_dyn_init(env);
+     maxsz = (maxsz / 8) - 1;
-+    for (i = 0; i < NB_MMU_MODES; i++) {
++
-+        tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
++    /*
 +     * We have just asserted in check_size_align that either
 +     * oprsz is {8,16,32} or matches maxsz.  Encode the final
 +     * case with '2', as that would otherwise map to 24.
 +     */
 +    if (oprsz == maxsz) {
 +        oprsz = 2;
 +    }
- }
++
+     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
- /* flush_all_helper: run fn across all cpus
+     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
      desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
 --
-.20.1
+.25.1

-[PULL 10/16] cputlb: Hoist tlb portions in tlb_mmu_resize_locked
+[PULL 02/11] tcg: Drop union from TCGArgConstraint
-No functional change, but the smaller expressions make
+The union is unused; let "regs" appear in the main structure
-the code easier to read.
+without the "u.regs" wrapping.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 35 +++++++++++++++++------------------
+ include/tcg/tcg.h            |  4 +---
-file changed, 17 insertions(+), 18 deletions(-)
+ tcg/tcg.c                    | 22 +++++++++++-----------
  tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
  tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
  tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
  tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
  tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
  tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
  tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
  tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
  tcg/tci/tcg-target.c.inc     |  2 +-
 files changed, 91 insertions(+), 93 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/tcg/tcg.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+ typedef struct TCGArgConstraint {
- /**
+     uint16_t ct;
-  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
+     uint8_t alias_index;
-- * @env: CPU that owns the TLB
+-    union {
-- * @mmu_idx: MMU index of the TLB
+-        TCGRegSet regs;
-+ * @desc: The CPUTLBDesc portion of the TLB
+-    } u;
-+ * @fast: The CPUTLBDescFast portion of the same TLB
++    TCGRegSet regs;
-  *
+ } TCGArgConstraint;
-  * Called with tlb_lock_held.
-  *
+ #define TCG_MAX_OP_ARGS 16
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
+diff --git a/tcg/tcg.c b/tcg/tcg.c
-  * high), since otherwise we are likely to have a significant amount of
+index XXXXXXX..XXXXXXX 100644
-  * conflict misses.
+--- a/tcg/tcg.c
-  */
++++ b/tcg/tcg.c
--static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
-+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+             return 0;
- {
+         n = 0;
--    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
--    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
+-            if (tcg_regset_test_reg(arg_ct->u.regs, i))
-+    size_t old_size = tlb_n_entries(fast);
++            if (tcg_regset_test_reg(arg_ct->regs, i))
-     size_t rate;
+                 n++;
-     size_t new_size = old_size;
+         }
-     int64_t now = get_clock_realtime();
+     }
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
              /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].u.regs = 0;
 +            def->args_ct[i].regs = 0;
              def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      pset = la_temp_pref(ts);
                      set = *pset;
 -                    set &= ct->u.regs;
 +                    set &= ct->regs;
                      if (ct->ct & TCG_CT_IALIAS) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
                      if (set == 0) {
 -                        set = ct->u.regs;
 +                        set = ct->regs;
                      }
                      *pset = set;
                  }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
          return;
      }
--    g_free(env_tlb(env)->f[mmu_idx].table);
+-    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
--    g_free(env_tlb(env)->d[mmu_idx].iotlb);
+-    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
-+    g_free(fast->table);
++    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
-+    g_free(desc->iotlb);
++    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
-     tlb_window_reset(desc, now, 0);
+     /* Allocate the output register now.  */
-     /* desc->n_used_entries is cleared by the caller */
+     if (ots->val_type != TEMP_VAL_REG) {
--    env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
--    env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
+             }
 -    env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
 +    fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
 +    fast->table = g_try_new(CPUTLBEntry, new_size);
 +    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
 +
      /*
       * If the allocations fail, try smaller sizes. We just freed some
       * memory, so going back to half of new_size has a good chance of working.
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
       * allocations to fail though, so we progressively reduce the allocation
       * size, aborting if we cannot even allocate the smallest TLB we support.
       */
 -    while (env_tlb(env)->f[mmu_idx].table == NULL ||
 -           env_tlb(env)->d[mmu_idx].iotlb == NULL) {
 +    while (fast->table == NULL || desc->iotlb == NULL) {
          if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
              error_report("%s: %s", __func__, strerror(errno));
              abort();
          }
-         new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
--        env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+-        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
-+        fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
++        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
+         reg = ts->reg;
--        g_free(env_tlb(env)->f[mmu_idx].table);
--        g_free(env_tlb(env)->d[mmu_idx].iotlb);
+-        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
--        env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
++        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
--        env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
+             /* nothing to do : the constraint is satisfied */
-+        g_free(fast->table);
+         } else {
-+        g_free(desc->iotlb);
+         allocate_in_reg:
-+        fast->table = g_try_new(CPUTLBEntry, new_size);
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-+        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+                and move the temporary register into it */
-     }
+             temp_load(s, ts, tcg_target_available_regs[ts->type],
- }
+                       i_allocated_regs, 0);
+-            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
- static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
- {
+                                 o_preferred_regs, ts->indirect_base);
--    tlb_mmu_resize_locked(env, mmu_idx);
+             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
-+    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
+                 /*
-     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
+                 && !const_args[arg_ct->alias_index]) {
-     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
+                 reg = new_args[arg_ct->alias_index];
              } else if (arg_ct->ct & TCG_CT_NEWREG) {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              } else {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              }
              tcg_regset_set_reg(o_allocated_regs, reg);
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r': /* general registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffffu;
 +        ct->regs |= 0xffffffffu;
          break;
      case 'w': /* advsimd registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffff00000000ull;
 +        ct->regs |= 0xffffffff00000000ull;
          break;
      case 'l': /* qemu_ld / qemu_st address, data_reg */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffffu;
 +        ct->regs = 0xffffffffu;
  #ifdef CONFIG_SOFTMMU
          /* x0 and x1 will be overwritten when reading the tlb entry,
             and x2, and x3 for helper args, better to avoid using them. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
  #endif
          break;
      case 'A': /* Valid for arithmetic immediate (positive or negative).  */
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      /* qemu_ld address */
      case 'l':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
  #ifdef CONFIG_SOFTMMU
          /* r0-r2,lr will be overwritten when reading the tlb entry,
             so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
      /* qemu_st address & data */
      case 's':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
  #if defined(CONFIG_SOFTMMU)
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
  #if TARGET_LONG_BITS == 64
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #endif
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch(*ct_str++) {
      case 'a':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
          break;
      case 'b':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
          break;
      case 'c':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
          break;
      case 'd':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
          break;
      case 'S':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
          break;
      case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
          break;
      case 'q':
          /* A register that can be used as a byte operand.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
          break;
      case 'Q':
          /* A register with an addressable second byte (e.g. %ah).  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xf;
 +        ct->regs = 0xf;
          break;
      case 'r':
          /* A general register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_GENERAL_REGS;
 +        ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
          /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'x':
          /* A vector register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_VECTOR_REGS;
 +        ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
          break;
      case 'e':
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch(*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'L': /* qemu_ld input arg constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
          if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
          }
  #endif
          break;
      case 'S': /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
          if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
          } else {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
          }
  #endif
          break;
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
 +        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'v':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff00000000ull;
 +        ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
  #endif
          break;
      case 'I':
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
  #endif
          break;
      case 'I':
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':                  /* all registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 +        ct->regs = 0xffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
      case 'A':
          ct->ct |= TCG_CT_CONST_S33;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'R':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
 +        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
          ct->ct |= TCG_CT_CONST_S11;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
 +        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
          return NULL;
 --
-.20.1
+.25.1

-[PULL 06/16] vl: Only choose enabled accelerators in configure_accelerators
+[PULL 03/11] tcg: Move sorted_args into TCGArgConstraint.sort_index
-By choosing "tcg:kvm" when kvm is not enabled, we generate
+This uses an existing hole in the TCGArgConstraint structure
-an incorrect warning: "invalid accelerator kvm".
+and will be convenient for keeping the data in one place.
-At the same time, use g_str_has_suffix rather than open-coding
-the same operation.
-Presumably the inverse is also true with --disable-tcg.
-Fixes: 28a0961757fc
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- vl.c | 21 +++++++++++++--------
+ include/tcg/tcg.h |  2 +-
-file changed, 13 insertions(+), 8 deletions(-)
+ tcg/tcg.c         | 35 +++++++++++++++++------------------
 files changed, 18 insertions(+), 19 deletions(-)
-diff --git a/vl.c b/vl.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/vl.c
+--- a/include/tcg/tcg.h
-+++ b/vl.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+ typedef struct TCGArgConstraint {
-         if (accel == NULL) {
+     uint16_t ct;
-             /* Select the default accelerator */
+     uint8_t alias_index;
--            if (!accel_find("tcg") && !accel_find("kvm")) {
++    uint8_t sort_index;
--                error_report("No accelerator selected and"
+     TCGRegSet regs;
--                             " no default accelerator available");
+ } TCGArgConstraint;
--                exit(1);
--            } else {
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
--                int pnlen = strlen(progname);
+     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
--                if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
+     uint8_t flags;
-+            bool have_tcg = accel_find("tcg");
+     TCGArgConstraint *args_ct;
-+            bool have_kvm = accel_find("kvm");
+-    int *sorted_args;
-+
+ #if defined(CONFIG_DEBUG_TCG)
-+            if (have_tcg && have_kvm) {
+     int used;
-+                if (g_str_has_suffix(progname, "kvm")) {
+ #endif
-                     /* If the program name ends with "kvm", we prefer KVM */
+diff --git a/tcg/tcg.c b/tcg/tcg.c
-                     accel = "kvm:tcg";
+index XXXXXXX..XXXXXXX 100644
-                 } else {
+--- a/tcg/tcg.c
-                     accel = "tcg:kvm";
++++ b/tcg/tcg.c
-                 }
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
-+            } else if (have_kvm) {
+     int op, total_args, n, i;
-+                accel = "kvm";
+     TCGOpDef *def;
-+            } else if (have_tcg) {
+     TCGArgConstraint *args_ct;
-+                accel = "tcg";
+-    int *sorted_args;
-+            } else {
+     TCGTemp *ts;
-+                error_report("No accelerator selected and"
-+                             " no default accelerator available");
+     memset(s, 0, sizeof(*s));
-+                exit(1);
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
      }
      args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
 -    sorted_args = g_malloc(sizeof(int) * total_args);
      for(op = 0; op < NB_OPS; op++) {
          def = &tcg_op_defs[op];
          def->args_ct = args_ct;
 -        def->sorted_args = sorted_args;
          n = def->nb_iargs + def->nb_oargs;
 -        sorted_args += n;
          args_ct += n;
      }
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
  /* sort from highest priority to lowest */
  static void sort_constraints(TCGOpDef *def, int start, int n)
  {
 -    int i, j, p1, p2, tmp;
 +    int i, j;
 +    TCGArgConstraint *a = def->args_ct;
 -    for(i = 0; i < n; i++)
 -        def->sorted_args[start + i] = start + i;
 -    if (n <= 1)
 +    for (i = 0; i < n; i++) {
 +        a[start + i].sort_index = start + i;
 +    }
 +    if (n <= 1) {
          return;
 -    for(i = 0; i < n - 1; i++) {
 -        for(j = i + 1; j < n; j++) {
 -            p1 = get_constraint_priority(def, def->sorted_args[start + i]);
 -            p2 = get_constraint_priority(def, def->sorted_args[start + j]);
 +    }
 +    for (i = 0; i < n - 1; i++) {
 +        for (j = i + 1; j < n; j++) {
 +            int p1 = get_constraint_priority(def, a[start + i].sort_index);
 +            int p2 = get_constraint_priority(def, a[start + j].sort_index);
              if (p1 < p2) {
 -                tmp = def->sorted_args[start + i];
 -                def->sorted_args[start + i] = def->sorted_args[start + j];
 -                def->sorted_args[start + j] = tmp;
 +                int tmp = a[start + i].sort_index;
 +                a[start + i].sort_index = a[start + j].sort_index;
 +                a[start + j].sort_index = tmp;
              }
          }
--
+     }
-         accel_list = g_strsplit(accel, ":", 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
+     for (k = 0; k < nb_iargs; k++) {
-         for (tmp = accel_list; *tmp; tmp++) {
+         TCGRegSet i_preferred_regs, o_preferred_regs;
 -        i = def->sorted_args[nb_oargs + k];
 +        i = def->args_ct[nb_oargs + k].sort_index;
          arg = op->args[i];
          arg_ct = &def->args_ct[i];
          ts = arg_temp(arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      int k2, i2;
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
 -                        i2 = def->sorted_args[nb_oargs + k2];
 +                        i2 = def->args_ct[nb_oargs + k2].sort_index;
                          if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
                              reg == new_args[i2]) {
                              goto allocate_in_reg;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          /* satisfy the output constraints */
          for(k = 0; k < nb_oargs; k++) {
 -            i = def->sorted_args[k];
 +            i = def->args_ct[k].sort_index;
              arg = op->args[i];
              arg_ct = &def->args_ct[i];
              ts = arg_temp(arg);
 --
-.20.1
+.25.1

-[PULL 16/16] scripts/git.orderfile: Display decodetree before C source
+[PULL 04/11] tcg: Remove TCG_CT_REG
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+This wasn't actually used for anything, really.  All variable
 operands must accept registers, and which are indicated by the
 set in TCGArgConstraint.regs.
-To avoid scrolling each instruction when reviewing tcg
-helpers written for the decodetree script, display the
-.decode files (similar to header declarations) before
-the C source (implementation of previous declarations).
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20191230082856.30556-1-philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- scripts/git.orderfile | 3 +++
+ include/tcg/tcg.h            |  1 -
-file changed, 3 insertions(+)
+ tcg/tcg.c                    | 15 ++++-----------
  tcg/aarch64/tcg-target.c.inc |  3 ---
  tcg/arm/tcg-target.c.inc     |  3 ---
  tcg/i386/tcg-target.c.inc    | 11 -----------
  tcg/mips/tcg-target.c.inc    |  3 ---
  tcg/ppc/tcg-target.c.inc     |  5 -----
  tcg/riscv/tcg-target.c.inc   |  2 --
  tcg/s390/tcg-target.c.inc    |  4 ----
  tcg/sparc/tcg-target.c.inc   |  5 -----
  tcg/tci/tcg-target.c.inc     |  1 -
 files changed, 4 insertions(+), 49 deletions(-)
-diff --git a/scripts/git.orderfile b/scripts/git.orderfile
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/scripts/git.orderfile
+--- a/include/tcg/tcg.h
-+++ b/scripts/git.orderfile
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ qga/*.json
+@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
- # headers
+ #define TCG_CT_ALIAS  0x80
- *.h
+ #define TCG_CT_IALIAS 0x40
+ #define TCG_CT_NEWREG 0x20 /* output requires a new register */
-+# decoding tree specification
+-#define TCG_CT_REG    0x01
-+*.decode
+ #define TCG_CT_CONST  0x02 /* any constant of register size */
-+
- # code
+ typedef struct TCGArgConstraint {
- *.c
+diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
  /* we give more priority to constraints with less registers */
  static int get_constraint_priority(const TCGOpDef *def, int k)
  {
 -    const TCGArgConstraint *arg_ct;
 +    const TCGArgConstraint *arg_ct = &def->args_ct[k];
 +    int n;
 -    int i, n;
 -    arg_ct = &def->args_ct[k];
      if (arg_ct->ct & TCG_CT_ALIAS) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
 -        if (!(arg_ct->ct & TCG_CT_REG))
 -            return 0;
 -        n = 0;
 -        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
 -            if (tcg_regset_test_reg(arg_ct->regs, i))
 -                n++;
 -        }
 +        n = ctpop64(arg_ct->regs);
      }
      return TCG_TARGET_NB_REGS - n + 1;
  }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          int oarg = *ct_str - '0';
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
 -                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
 +                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                          /* TCG_CT_ALIAS is for the output arguments.
                             The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r': /* general registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= 0xffffffffu;
          break;
      case 'w': /* advsimd registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= 0xffffffff00000000ull;
          break;
      case 'l': /* qemu_ld / qemu_st address, data_reg */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffffu;
  #ifdef CONFIG_SOFTMMU
          /* x0 and x1 will be overwritten when reading the tlb entry,
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      /* qemu_ld address */
      case 'l':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
  #ifdef CONFIG_SOFTMMU
          /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      /* qemu_st address & data */
      case 's':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch(*ct_str++) {
      case 'a':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
          break;
      case 'b':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
          break;
      case 'c':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
          break;
      case 'd':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
          break;
      case 'S':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
          break;
      case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
          break;
      case 'q':
          /* A register that can be used as a byte operand.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
          break;
      case 'Q':
          /* A register with an addressable second byte (e.g. %ah).  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xf;
          break;
      case 'r':
          /* A general register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          break;
      case 'x':
          /* A vector register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
          tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch(*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L': /* qemu_ld input arg constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
          break;
      case 'S': /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'v':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':                  /* all registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'R':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
          tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
 --
-.20.1
+.25.1

-[PULL 15/16] cputlb: Hoist timestamp outside of loops over tlbs
+[PULL 05/11] tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
-Do not call get_clock_realtime() in tlb_mmu_resize_locked,
+These are easier to set and test when they have their own fields.
-but hoist outside of any loop over a set of tlbs.  This is
+Reduce the size of alias_index and sort_index to 4 bits, which is
-only two (indirect) callers, tlb_flush_by_mmuidx_async_work
+sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
-and tlb_flush_page_locked, so not onerous.
+constants within the ct field.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Move all initialization to allocation time, rather than init
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+individual fields in process_op_defs.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 14 ++++++++------
+ include/tcg/tcg.h | 14 +++++++-------
-file changed, 8 insertions(+), 6 deletions(-)
+ tcg/tcg.c         | 28 ++++++++++++----------------
 files changed, 19 insertions(+), 23 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/tcg/tcg.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
+@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
-  * high), since otherwise we are likely to have a significant amount of
+ void tcg_dump_info(void);
-  * conflict misses.
+ void tcg_dump_op_count(void);
-  */
--static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+-#define TCG_CT_ALIAS  0x80
-+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+-#define TCG_CT_IALIAS 0x40
-+                                  int64_t now)
+-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
- {
+-#define TCG_CT_CONST  0x02 /* any constant of register size */
-     size_t old_size = tlb_n_entries(fast);
++#define TCG_CT_CONST  1 /* any constant of register size */
-     size_t rate;
-     size_t new_size = old_size;
+ typedef struct TCGArgConstraint {
--    int64_t now = get_clock_realtime();
+-    uint16_t ct;
-     int64_t window_len_ms = 100;
+-    uint8_t alias_index;
-     int64_t window_len_ns = window_len_ms * 1000 * 1000;
+-    uint8_t sort_index;
-     bool window_expired = now > desc->window_begin_ns + window_len_ns;
++    unsigned ct : 16;
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
++    unsigned alias_index : 4;
-     memset(desc->vtable, -1, sizeof(desc->vtable));
++    unsigned sort_index : 4;
- }
++    bool oalias : 1;
++    bool ialias : 1;
--static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++    bool newreg : 1;
-+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx,
+     TCGRegSet regs;
-+                                        int64_t now)
+ } TCGArgConstraint;
- {
-     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+diff --git a/tcg/tcg.c b/tcg/tcg.c
-     CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tcg.c
--    tlb_mmu_resize_locked(desc, fast);
++++ b/tcg/tcg.c
-+    tlb_mmu_resize_locked(desc, fast, now);
+@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
-     tlb_mmu_flush_locked(desc, fast);
+         total_args += n;
  }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      CPUArchState *env = cpu->env_ptr;
      uint16_t asked = data.host_int;
      uint16_t all_dirty, work, to_clean;
 +    int64_t now = get_clock_realtime();
      assert_cpu_is_self(cpu);
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      for (work = to_clean; work != 0; work &= work - 1) {
          int mmu_idx = ctz32(work);
 -        tlb_flush_one_mmuidx_locked(env, mmu_idx);
 +        tlb_flush_one_mmuidx_locked(env, mmu_idx, now);
      }
-     qemu_spin_unlock(&env_tlb(env)->c.lock);
+-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
++    args_ct = g_new0(TCGArgConstraint, total_args);
-         tlb_debug("forcing full flush midx %d ("
-                   TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
+     for(op = 0; op < NB_OPS; op++) {
-                   midx, lp_addr, lp_mask);
+         def = &tcg_op_defs[op];
--        tlb_flush_one_mmuidx_locked(env, midx);
+@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
-+        tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
+     const TCGArgConstraint *arg_ct = &def->args_ct[k];
      int n;
 -    if (arg_ct->ct & TCG_CT_ALIAS) {
 +    if (arg_ct->oalias) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
-         if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
+@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
-             tlb_n_used_entries_dec(env, midx);
+             /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].regs = 0;
 -            def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
                  case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
                          tcg_debug_assert(def->args_ct[oarg].regs != 0);
 -                        /* TCG_CT_ALIAS is for the output arguments.
 -                           The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 -                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
 +                        /* The output sets oalias.  */
 +                        def->args_ct[oarg].oalias = true;
                          def->args_ct[oarg].alias_index = i;
 -                        def->args_ct[i].ct |= TCG_CT_IALIAS;
 +                        /* The input sets ialias. */
 +                        def->args_ct[i].ialias = true;
                          def->args_ct[i].alias_index = oarg;
                      }
                      ct_str++;
                      break;
                  case '&':
 -                    def->args_ct[i].ct |= TCG_CT_NEWREG;
 +                    def->args_ct[i].newreg = true;
                      ct_str++;
                      break;
                  case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      set = *pset;
                      set &= ct->regs;
 -                    if (ct->ct & TCG_CT_IALIAS) {
 +                    if (ct->ialias) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          }
          i_preferred_regs = o_preferred_regs = 0;
 -        if (arg_ct->ct & TCG_CT_IALIAS) {
 +        if (arg_ct->ialias) {
              o_preferred_regs = op->output_pref[arg_ct->alias_index];
              if (ts->fixed_reg) {
                  /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
                          i2 = def->args_ct[nb_oargs + k2].sort_index;
 -                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
 -                            reg == new_args[i2]) {
 +                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                              goto allocate_in_reg;
                          }
                      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              /* ENV should not be modified.  */
              tcg_debug_assert(!ts->fixed_reg);
 -            if ((arg_ct->ct & TCG_CT_ALIAS)
 -                && !const_args[arg_ct->alias_index]) {
 +            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
 -            } else if (arg_ct->ct & TCG_CT_NEWREG) {
 +            } else if (arg_ct->newreg) {
                  reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
 --
-.20.1
+.25.1

-[PULL 14/16] cputlb: Initialize tlbs as flushed
+[PULL 06/11] tcg: Remove TCGOpDef.used
-There's little point in leaving these data structures half initialized,
+The last user of this field disappeared in f69d277ece4.
 and relying on a flush to be done during reset.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 +++--
+ include/tcg/tcg.h | 3 ---
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 3 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/tcg/tcg.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
+@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
-     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
+     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
-     fast->table = g_new(CPUTLBEntry, n_entries);
+     uint8_t flags;
-     desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+     TCGArgConstraint *args_ct;
-+    tlb_mmu_flush_locked(desc, fast);
+-#if defined(CONFIG_DEBUG_TCG)
- }
+-    int used;
+-#endif
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
+ } TCGOpDef;
-@@ -XXX,XX +XXX,XX @@ void tlb_init(CPUState *cpu)
+ extern TCGOpDef tcg_op_defs[];
      qemu_spin_init(&env_tlb(env)->c.lock);
 -    /* Ensure that cpu_reset performs a full flush.  */
 -    env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
 +    /* All tlbs are initialized flushed. */
 +    env_tlb(env)->c.dirty = 0;
      for (i = 0; i < NB_MMU_MODES; i++) {
          tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
 --
-.20.1
+.25.1

-[PULL 05/16] vl: Remove useless test in configure_accelerators
+[PULL 07/11] tcg/i386: Fix dupi for avx2 32-bit hosts
-The result of g_strsplit is never NULL.
+The previous change wrongly stated that 32-bit avx2 should have
 used VPBROADCASTW.  But that's a 16-bit broadcast and we want a
 -bit broadcast.
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Fixes: 7b60ef3264e
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- vl.c | 2 +-
+ tcg/i386/tcg-target.c.inc | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/vl.c b/vl.c
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/vl.c
+--- a/tcg/i386/tcg-target.c.inc
-+++ b/vl.c
++++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type,
+         new_pool_label(s, arg, R_386_PC32, s->code_ptr - 4, -4);
-         accel_list = g_strsplit(accel, ":", 0);
+     } else {
+         if (have_avx2) {
--        for (tmp = accel_list; tmp && *tmp; tmp++) {
+-            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTW + vex_l, ret);
-+        for (tmp = accel_list; *tmp; tmp++) {
++            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTD + vex_l, ret);
-             /*
+         } else {
-              * Filter invalid accelerators here, to prevent obscenities
+             tcg_out_vex_modrm_pool(s, OPC_VBROADCASTSS, ret);
-              * such as "-machine accel=tcg,,thread=single".
+         }
 --
-.20.1
+.25.1

-[PULL 01/16] cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
+[PULL 08/11] tcg: Fix generation of dupi_vec for 32-bit host
-In target/arm we will shortly have "too many" mmu_idx.
+The definition of INDEX_op_dupi_vec is that it operates on
-The current minimum barrier is caused by the way in which
+units of tcg_target_ulong -- in this case 32 bits.  It does
-tlb_flush_page_by_mmuidx is coded.
+not work to use this for a uint64_t value that happens to be
 small enough to fit in tcg_target_ulong.
-We can remove this limitation by allocating memory for
+Fixes: d2fd745fe8b
-consumption by the worker.  Let us assume that this is
+Fixes: db432672dc5
-the unlikely case, as will be the case for the majority
+Cc: qemu-stable@nongnu.org
 of targets which have so far satisfied the BUILD_BUG_ON,
 and only allocate memory when necessary.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 167 +++++++++++++++++++++++++++++++++++----------
+ tcg/tcg-op-vec.c | 12 ++++++++----
-file changed, 132 insertions(+), 35 deletions(-)
+file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tcg/tcg-op-vec.c
-+++ b/accel/tcg/cputlb.c
++++ b/tcg/tcg-op-vec.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
+@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
-     }
- }
+ void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
 -/* As we are going to hijack the bottom bits of the page address for a
 - * mmuidx bit mask we need to fail to build if we can't do that
 +/**
 + * tlb_flush_page_by_mmuidx_async_0:
 + * @cpu: cpu on which to flush
 + * @addr: page of virtual address to flush
 + * @idxmap: set of mmu_idx to flush
 + *
 + * Helper for tlb_flush_page_by_mmuidx and friends, flush one page
 + * at @addr from the tlbs indicated by @idxmap from @cpu.
   */
 -QEMU_BUILD_BUG_ON(NB_MMU_MODES > TARGET_PAGE_BITS_MIN);
 -
 -static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
 -                                                run_on_cpu_data data)
 +static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
 +                                             target_ulong addr,
 +                                             uint16_t idxmap)
  {
-     CPUArchState *env = cpu->env_ptr;
+-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
--    target_ulong addr_and_mmuidx = (target_ulong) data.target_ptr;
+-        do_dupi_vec(r, MO_32, a);
--    target_ulong addr = addr_and_mmuidx & TARGET_PAGE_MASK;
+-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
--    unsigned long mmu_idx_bitmap = addr_and_mmuidx & ALL_MMUIDX_BITS;
++    if (TCG_TARGET_REG_BITS == 64) {
-     int mmu_idx;
+         do_dupi_vec(r, MO_64, a);
++    } else if (a == dup_const(MO_32, a)) {
-     assert_cpu_is_self(cpu);
++        do_dupi_vec(r, MO_32, a);
+     } else {
--    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%lx\n",
+         TCGv_i64 c = tcg_const_i64(a);
--              addr, mmu_idx_bitmap);
+         tcg_gen_dup_i64_vec(MO_64, r, c);
-+    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%x\n", addr, idxmap);
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
-     qemu_spin_lock(&env_tlb(env)->c.lock);
+ void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
      for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
 -        if (test_bit(mmu_idx, &mmu_idx_bitmap)) {
 +        if ((idxmap >> mmu_idx) & 1) {
              tlb_flush_page_locked(env, mmu_idx, addr);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
      tb_flush_jmp_cache(cpu, addr);
  }
 +/**
 + * tlb_flush_page_by_mmuidx_async_1:
 + * @cpu: cpu on which to flush
 + * @data: encoded addr + idxmap
 + *
 + * Helper for tlb_flush_page_by_mmuidx and friends, called through
 + * async_run_on_cpu.  The idxmap parameter is encoded in the page
 + * offset of the target_ptr field.  This limits the set of mmu_idx
 + * that can be passed via this method.
 + */
 +static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
 +                                             run_on_cpu_data data)
 +{
 +    target_ulong addr_and_idxmap = (target_ulong) data.target_ptr;
 +    target_ulong addr = addr_and_idxmap & TARGET_PAGE_MASK;
 +    uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
 +
 +    tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 +}
 +
 +typedef struct {
 +    target_ulong addr;
 +    uint16_t idxmap;
 +} TLBFlushPageByMMUIdxData;
 +
 +/**
 + * tlb_flush_page_by_mmuidx_async_2:
 + * @cpu: cpu on which to flush
 + * @data: allocated addr + idxmap
 + *
 + * Helper for tlb_flush_page_by_mmuidx and friends, called through
 + * async_run_on_cpu.  The addr+idxmap parameters are stored in a
 + * TLBFlushPageByMMUIdxData structure that has been allocated
 + * specifically for this helper.  Free the structure when done.
 + */
 +static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
 +                                             run_on_cpu_data data)
 +{
 +    TLBFlushPageByMMUIdxData *d = data.host_ptr;
 +
 +    tlb_flush_page_by_mmuidx_async_0(cpu, d->addr, d->idxmap);
 +    g_free(d);
 +}
 +
  void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
  {
--    target_ulong addr_and_mmu_idx;
+-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
--
++    if (vece == MO_64) {
-     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%" PRIx16 "\n", addr, idxmap);
++        tcg_gen_dup64i_vec(r, a);
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    if (!qemu_cpu_is_self(cpu)) {
 -        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_work,
 -                         RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    if (qemu_cpu_is_self(cpu)) {
 +        tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 +    } else if (idxmap < TARGET_PAGE_SIZE) {
 +        /*
 +         * Most targets have only a few mmu_idx.  In the case where
 +         * we can stuff idxmap into the low TARGET_PAGE_BITS, avoid
 +         * allocating memory for this operation.
 +         */
 +        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
      } else {
 -        tlb_flush_page_by_mmuidx_async_work(
 -            cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +        TLBFlushPageByMMUIdxData *d = g_new(TLBFlushPageByMMUIdxData, 1);
 +
 +        /* Otherwise allocate a structure, freed by the worker.  */
 +        d->addr = addr;
 +        d->idxmap = idxmap;
 +        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_2,
 +                         RUN_ON_CPU_HOST_PTR(d));
      }
  }
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page(CPUState *cpu, target_ulong addr)
  void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
                                         uint16_t idxmap)
  {
 -    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
 -    target_ulong addr_and_mmu_idx;
 -
      tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 -    fn(src_cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    /*
 +     * Allocate memory to hold addr+idxmap only when needed.
 +     * See tlb_flush_page_by_mmuidx for details.
 +     */
 +    if (idxmap < TARGET_PAGE_SIZE) {
 +        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +    } else {
-+        CPUState *dst_cpu;
++        do_dupi_vec(r, MO_REG, dup_const(vece, a));
 +
 +        /* Allocate a separate data block for each destination cpu.  */
 +        CPU_FOREACH(dst_cpu) {
 +            if (dst_cpu != src_cpu) {
 +                TLBFlushPageByMMUIdxData *d
 +                    = g_new(TLBFlushPageByMMUIdxData, 1);
 +
 +                d->addr = addr;
 +                d->idxmap = idxmap;
 +                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                                 RUN_ON_CPU_HOST_PTR(d));
 +            }
 +        }
 +    }
 +
 +    tlb_flush_page_by_mmuidx_async_0(src_cpu, addr, idxmap);
  }
  void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                                target_ulong addr,
                                                uint16_t idxmap)
  {
 -    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
 -    target_ulong addr_and_mmu_idx;
 -
      tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 -    async_safe_run_on_cpu(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    /*
 +     * Allocate memory to hold addr+idxmap only when needed.
 +     * See tlb_flush_page_by_mmuidx for details.
 +     */
 +    if (idxmap < TARGET_PAGE_SIZE) {
 +        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                              RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +    } else {
 +        CPUState *dst_cpu;
 +        TLBFlushPageByMMUIdxData *d;
 +
 +        /* Allocate a separate data block for each destination cpu.  */
 +        CPU_FOREACH(dst_cpu) {
 +            if (dst_cpu != src_cpu) {
 +                d = g_new(TLBFlushPageByMMUIdxData, 1);
 +                d->addr = addr;
 +                d->idxmap = idxmap;
 +                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                                 RUN_ON_CPU_HOST_PTR(d));
 +            }
 +        }
 +
 +        d = g_new(TLBFlushPageByMMUIdxData, 1);
 +        d->addr = addr;
 +        d->idxmap = idxmap;
 +        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                              RUN_ON_CPU_HOST_PTR(d));
 +    }
  }
- void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr)
+ void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
 --
-.20.1
+.25.1

-[PULL 02/16] util/cacheinfo: fix crash when compiling with uClibc
+Deleted patch
-From: Carlos Santos <casantos@redhat.com>
-uClibc defines _SC_LEVEL1_ICACHE_LINESIZE and _SC_LEVEL1_DCACHE_LINESIZE
-but the corresponding sysconf calls returns -1, which is a valid result,
-meaning that the limit is indeterminate.
-Handle this situation using the fallback values instead of crashing due
-to an assertion failure.
-Signed-off-by: Carlos Santos <casantos@redhat.com>
-Message-Id: <20191017123713.30192-1-casantos@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- util/cacheinfo.c | 10 ++++++++--
-file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/util/cacheinfo.c b/util/cacheinfo.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/cacheinfo.c
-+++ b/util/cacheinfo.c
-@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
- static void sys_cache_info(int *isize, int *dsize)
- {
- # ifdef _SC_LEVEL1_ICACHE_LINESIZE
--    *isize = sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
-+    int tmp_isize = (int) sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
-+    if (tmp_isize > 0) {
-+        *isize = tmp_isize;
-+    }
- # endif
- # ifdef _SC_LEVEL1_DCACHE_LINESIZE
--    *dsize = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
-+    int tmp_dsize = (int) sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
-+    if (tmp_dsize > 0) {
-+        *dsize = tmp_dsize;
-+    }
- # endif
- }
- #endif /* sys_cache_info */
---
-.20.1

-[PULL 03/16] vl: Remove unused variable in configure_accelerators
+Deleted patch
-The accel_initialised variable no longer has any setters.
-Fixes: 6f6e1698a68c
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
- {
-     const char *accel;
-     char **accel_list, **tmp;
--    bool accel_initialised = false;
-     bool init_failed = false;
-     qemu_opts_foreach(qemu_find_opts("icount"),
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-         accel_list = g_strsplit(accel, ":", 0);
--        for (tmp = accel_list; !accel_initialised && tmp && *tmp; tmp++) {
-+        for (tmp = accel_list; tmp && *tmp; tmp++) {
-             /*
-              * Filter invalid accelerators here, to prevent obscenities
-              * such as "-machine accel=tcg,,thread=single".
---
-.20.1

-[PULL 04/16] vl: Reduce scope of variables in configure_accelerators
+Deleted patch
-The accel_list and tmp variables are only used when manufacturing
--machine accel, options based on -accel.
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
- static void configure_accelerators(const char *progname)
- {
-     const char *accel;
--    char **accel_list, **tmp;
-     bool init_failed = false;
-     qemu_opts_foreach(qemu_find_opts("icount"),
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-     accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
-     if (QTAILQ_EMPTY(&qemu_accel_opts.head)) {
-+        char **accel_list, **tmp;
-+
-         if (accel == NULL) {
-             /* Select the default accelerator */
-             if (!accel_find("tcg") && !accel_find("kvm")) {
---
-.20.1

-[PULL 07/16] cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
+Deleted patch
-There is only one caller for tlb_table_flush_by_mmuidx.  Place
-the result at the earlier line number, due to an expected user
-in the near future.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 19 +++++++------------
-file changed, 7 insertions(+), 12 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-     }
- }
--static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
-+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
- {
-     tlb_mmu_resize_locked(env, mmu_idx);
--    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
-+    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-+    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-+    env_tlb(env)->d[mmu_idx].vindex = 0;
-+    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-+    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-+           sizeof(env_tlb(env)->d[0].vtable));
- }
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-@@ -XXX,XX +XXX,XX @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
-     *pelide = elide;
- }
--static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
--{
--    tlb_table_flush_by_mmuidx(env, mmu_idx);
--    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
--    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
--    env_tlb(env)->d[mmu_idx].vindex = 0;
--    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
--           sizeof(env_tlb(env)->d[0].vtable));
--}
--
- static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
- {
-     CPUArchState *env = cpu->env_ptr;
---
-.20.1

-[PULL 08/16] cputlb: Make tlb_n_entries private to cputlb.c
+Deleted patch
-There are no users of this function outside cputlb.c,
-and its interface will change in the next patch.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/cpu_ldst.h | 5 -----
- accel/tcg/cputlb.c      | 5 +++++
-files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu_ldst.h
-+++ b/include/exec/cpu_ldst.h
-@@ -XXX,XX +XXX,XX @@ static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
-     return (addr >> TARGET_PAGE_BITS) & size_mask;
- }
--static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
--{
--    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
--}
--
- /* Find the TLB entry corresponding to the mmu_idx + address pair.  */
- static inline CPUTLBEntry *tlb_entry(CPUArchState *env, uintptr_t mmu_idx,
-                                      target_ulong addr)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
- QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
- #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
-+static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
-+{
-+    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
-+}
-+
- static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
- {
-     return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
---
-.20.1

-[PULL 12/16] cputlb: Split out tlb_mmu_flush_locked
+[PULL 09/11] tcg/optimize: Fold dup2_vec
-We will want to be able to flush a tlb without resizing.
+When the two arguments are identical, this can be reduced to
 dup_vec or to mov_vec from a tcg_constant_vec.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 15 ++++++++++-----
+ tcg/optimize.c | 15 +++++++++++++++
-file changed, 10 insertions(+), 5 deletions(-)
+file changed, 15 insertions(+)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tcg/optimize.c
-+++ b/accel/tcg/cputlb.c
++++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
-     }
+             }
- }
+             goto do_default;
--static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++        case INDEX_op_dup2_vec:
-+static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
++            assert(TCG_TARGET_REG_BITS == 32);
- {
++            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
--    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
++                tmp = arg_info(op->args[1])->val;
--    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
++                if (tmp == arg_info(op->args[2])->val) {
--
++                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
--    tlb_mmu_resize_locked(desc, fast);
++                    break;
-     desc->n_used_entries = 0;
++                }
-     desc->large_page_addr = -1;
++            } else if (args_are_copies(op->args[1], op->args[2])) {
-     desc->large_page_mask = -1;
++                op->opc = INDEX_op_dup_vec;
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++                TCGOP_VECE(op) = MO_32;
-     memset(desc->vtable, -1, sizeof(desc->vtable));
++                nb_iargs = 1;
- }
++            }
++            goto do_default;
 +static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 +{
 +    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
 +    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
 +
-+    tlb_mmu_resize_locked(desc, fast);
+         CASE_OP_32_64(not):
-+    tlb_mmu_flush_locked(desc, fast);
+         CASE_OP_32_64(neg):
-+}
+         CASE_OP_32_64(ext8s):
 +
  static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
  {
      env_tlb(env)->d[mmu_idx].n_used_entries++;
 --
-.20.1
+.25.1

-[PULL 11/16] cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
+[PULL 10/11] tcg: Remove TCG_TARGET_HAS_cmp_vec
-No functional change, but the smaller expressions make
+The cmp_vec opcode is mandatory; this symbol is unused.
 the code easier to read.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 19 ++++++++++---------
+ tcg/aarch64/tcg-target.h | 1 -
-file changed, 10 insertions(+), 9 deletions(-)
+ tcg/i386/tcg-target.h    | 1 -
  tcg/ppc/tcg-target.h     | 1 -
 files changed, 3 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tcg/aarch64/tcg-target.h
-+++ b/accel/tcg/cputlb.c
++++ b/tcg/aarch64/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+ #define TCG_TARGET_HAS_shi_vec          1
- static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+ #define TCG_TARGET_HAS_shs_vec          0
- {
+ #define TCG_TARGET_HAS_shv_vec          1
--    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
+-#define TCG_TARGET_HAS_cmp_vec          1
--    env_tlb(env)->d[mmu_idx].n_used_entries = 0;
+ #define TCG_TARGET_HAS_mul_vec          1
--    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
+ #define TCG_TARGET_HAS_sat_vec          1
--    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
+ #define TCG_TARGET_HAS_minmax_vec       1
--    env_tlb(env)->d[mmu_idx].vindex = 0;
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
--    memset(env_tlb(env)->f[mmu_idx].table, -1,
+index XXXXXXX..XXXXXXX 100644
--           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
+--- a/tcg/i386/tcg-target.h
--    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
++++ b/tcg/i386/tcg-target.h
--           sizeof(env_tlb(env)->d[0].vtable));
+@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
-+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+ #define TCG_TARGET_HAS_shi_vec          1
-+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+ #define TCG_TARGET_HAS_shs_vec          1
-+
+ #define TCG_TARGET_HAS_shv_vec          have_avx2
-+    tlb_mmu_resize_locked(desc, fast);
+-#define TCG_TARGET_HAS_cmp_vec          1
-+    desc->n_used_entries = 0;
+ #define TCG_TARGET_HAS_mul_vec          1
-+    desc->large_page_addr = -1;
+ #define TCG_TARGET_HAS_sat_vec          1
-+    desc->large_page_mask = -1;
+ #define TCG_TARGET_HAS_minmax_vec       1
-+    desc->vindex = 0;
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
-+    memset(fast->table, -1, sizeof_tlb(fast));
+index XXXXXXX..XXXXXXX 100644
-+    memset(desc->vtable, -1, sizeof(desc->vtable));
+--- a/tcg/ppc/tcg-target.h
- }
++++ b/tcg/ppc/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
+ #define TCG_TARGET_HAS_shi_vec          0
  #define TCG_TARGET_HAS_shs_vec          0
  #define TCG_TARGET_HAS_shv_vec          1
 -#define TCG_TARGET_HAS_cmp_vec          1
  #define TCG_TARGET_HAS_mul_vec          1
  #define TCG_TARGET_HAS_sat_vec          1
  #define TCG_TARGET_HAS_minmax_vec       1
 --
-.20.1
+.25.1

-[PULL 09/16] cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
+[PULL 11/11] accel/tcg: Fix computing of is_write for MIPS
-We do not need the entire CPUArchState to compute these values.
+From: Kele Huang <kele.hwang@gmail.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Detect all MIPS store instructions in cpu_signal_handler for all available
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+MIPS versions, and set is_write if encountering such store instructions.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 This fixed the error while dealing with self-modified code for MIPS.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Kele Huang <kele.hwang@gmail.com>
 Signed-off-by: Xu Zou <iwatchnima@gmail.com>
 Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
 [rth: Use uintptr_t for pc to fix n32 build error.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 15 ++++++++-------
+ accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
-file changed, 8 insertions(+), 7 deletions(-)
+file changed, 39 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/cputlb.c
++++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
+@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
- QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
- #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
+ #elif defined(__mips__)
--static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
++#if defined(__misp16) || defined(__mips_micromips)
-+static inline size_t tlb_n_entries(CPUTLBDescFast *fast)
++#error "Unsupported encoding"
 +#endif
 +
  int cpu_signal_handler(int host_signum, void *pinfo,
                         void *puc)
  {
--    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
+     siginfo_t *info = pinfo;
-+    return (fast->mask >> CPU_TLB_ENTRY_BITS) + 1;
+     ucontext_t *uc = puc;
 -    greg_t pc = uc->uc_mcontext.pc;
 -    int is_write;
 +    uintptr_t pc = uc->uc_mcontext.pc;
 +    uint32_t insn = *(uint32_t *)pc;
 +    int is_write = 0;
 +
 +    /* Detect all store instructions at program counter. */
 +    switch((insn >> 26) & 077) {
 +    case 050: /* SB */
 +    case 051: /* SH */
 +    case 052: /* SWL */
 +    case 053: /* SW */
 +    case 054: /* SDL */
 +    case 055: /* SDR */
 +    case 056: /* SWR */
 +    case 070: /* SC */
 +    case 071: /* SWC1 */
 +    case 074: /* SCD */
 +    case 075: /* SDC1 */
 +    case 077: /* SD */
 +#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
 +    case 072: /* SWC2 */
 +    case 076: /* SDC2 */
 +#endif
 +        is_write = 1;
 +        break;
 +    case 023: /* COP1X */
 +        /* Required in all versions of MIPS64 since
 +           MIPS64r1 and subsequent versions of MIPS32r2. */
 +        switch (insn & 077) {
 +        case 010: /* SWXC1 */
 +        case 011: /* SDXC1 */
 +        case 015: /* SUXC1 */
 +            is_write = 1;
 +        }
 +        break;
 +    }
 -    /* XXX: compute is_write */
 -    is_write = 0;
      return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
  }
--static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
-+static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
- {
--    return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
-+    return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
- }
- static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
- static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
- {
-     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
--    size_t old_size = tlb_n_entries(env, mmu_idx);
-+    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
-     size_t rate;
-     size_t new_size = old_size;
-     int64_t now = get_clock_realtime();
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
-     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-     env_tlb(env)->d[mmu_idx].vindex = 0;
--    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-+    memset(env_tlb(env)->f[mmu_idx].table, -1,
-+           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
-     memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-            sizeof(env_tlb(env)->d[0].vtable));
- }
-@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
-     qemu_spin_lock(&env_tlb(env)->c.lock);
-     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-         unsigned int i;
--        unsigned int n = tlb_n_entries(env, mmu_idx);
-+        unsigned int n = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
-         for (i = 0; i < n; i++) {
-             tlb_reset_dirty_range_locked(&env_tlb(env)->f[mmu_idx].table[i],
 --
-.20.1
+.25.1

The following changes since commit 3e08b2b9cb64bff2b73fa9128c0e49bfcde0dd40:

Merge remote-tracking branch 'remotes/philmd-gitlab/tags/edk2-next-20200121' into staging (2020-01-21 15:29:25 +0000)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20200121

for you to fetch changes up to 75fa376cdab5e5db2c7fdd107358e16f95503ac6:

scripts/git.orderfile: Display decodetree before C source (2020-01-21 15:26:09 -1000)

----------------------------------------------------------------
Remove another limit to NB_MMU_MODES.
Fix compilation using uclibc.
Fix defaulting of -accel parameters.
Tidy cputlb basic routines.
Adjust git.orderfile for decodetree.

----------------------------------------------------------------
Carlos Santos (1):
      util/cacheinfo: fix crash when compiling with uClibc

Philippe Mathieu-Daudé (1):
      scripts/git.orderfile: Display decodetree before C source

Richard Henderson (14):
      cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
      vl: Remove unused variable in configure_accelerators
      vl: Reduce scope of variables in configure_accelerators
      vl: Remove useless test in configure_accelerators
      vl: Only choose enabled accelerators in configure_accelerators
      cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
      cputlb: Make tlb_n_entries private to cputlb.c
      cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
      cputlb: Hoist tlb portions in tlb_mmu_resize_locked
      cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
      cputlb: Split out tlb_mmu_flush_locked
      cputlb: Partially merge tlb_dyn_init into tlb_init
      cputlb: Initialize tlbs as flushed
      cputlb: Hoist timestamp outside of loops over tlbs

In target/arm we will shortly have "too many" mmu_idx.
The current minimum barrier is caused by the way in which
tlb_flush_page_by_mmuidx is coded.

We can remove this limitation by allocating memory for
consumption by the worker.  Let us assume that this is
the unlikely case, as will be the case for the majority
of targets which have so far satisfied the BUILD_BUG_ON,
and only allocate memory when necessary.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 167 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 132 insertions(+), 35 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
     }
 }
 
-/* As we are going to hijack the bottom bits of the page address for a
- * mmuidx bit mask we need to fail to build if we can't do that
+/**
+ * tlb_flush_page_by_mmuidx_async_0:
+ * @cpu: cpu on which to flush
+ * @addr: page of virtual address to flush
+ * @idxmap: set of mmu_idx to flush
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, flush one page
+ * at @addr from the tlbs indicated by @idxmap from @cpu.
  */
-QEMU_BUILD_BUG_ON(NB_MMU_MODES > TARGET_PAGE_BITS_MIN);
-
-static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
-                                                run_on_cpu_data data)
+static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
+                                             target_ulong addr,
+                                             uint16_t idxmap)
 {
     CPUArchState *env = cpu->env_ptr;
-    target_ulong addr_and_mmuidx = (target_ulong) data.target_ptr;
-    target_ulong addr = addr_and_mmuidx & TARGET_PAGE_MASK;
-    unsigned long mmu_idx_bitmap = addr_and_mmuidx & ALL_MMUIDX_BITS;
     int mmu_idx;
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%lx\n",
-              addr, mmu_idx_bitmap);
+    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%x\n", addr, idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        if (test_bit(mmu_idx, &mmu_idx_bitmap)) {
+        if ((idxmap >> mmu_idx) & 1) {
             tlb_flush_page_locked(env, mmu_idx, addr);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
     tb_flush_jmp_cache(cpu, addr);
 }
 
+/**
+ * tlb_flush_page_by_mmuidx_async_1:
+ * @cpu: cpu on which to flush
+ * @data: encoded addr + idxmap
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, called through
+ * async_run_on_cpu.  The idxmap parameter is encoded in the page
+ * offset of the target_ptr field.  This limits the set of mmu_idx
+ * that can be passed via this method.
+ */
+static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
+                                             run_on_cpu_data data)
+{
+    target_ulong addr_and_idxmap = (target_ulong) data.target_ptr;
+    target_ulong addr = addr_and_idxmap & TARGET_PAGE_MASK;
+    uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
+
+    tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
+}
+
+typedef struct {
+    target_ulong addr;
+    uint16_t idxmap;
+} TLBFlushPageByMMUIdxData;
+
+/**
+ * tlb_flush_page_by_mmuidx_async_2:
+ * @cpu: cpu on which to flush
+ * @data: allocated addr + idxmap
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, called through
+ * async_run_on_cpu.  The addr+idxmap parameters are stored in a
+ * TLBFlushPageByMMUIdxData structure that has been allocated
+ * specifically for this helper.  Free the structure when done.
+ */
+static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
+                                             run_on_cpu_data data)
+{
+    TLBFlushPageByMMUIdxData *d = data.host_ptr;
+
+    tlb_flush_page_by_mmuidx_async_0(cpu, d->addr, d->idxmap);
+    g_free(d);
+}
+
 void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
 {
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%" PRIx16 "\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    if (!qemu_cpu_is_self(cpu)) {
-        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_work,
-                         RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    if (qemu_cpu_is_self(cpu)) {
+        tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
+    } else if (idxmap < TARGET_PAGE_SIZE) {
+        /*
+         * Most targets have only a few mmu_idx.  In the case where
+         * we can stuff idxmap into the low TARGET_PAGE_BITS, avoid
+         * allocating memory for this operation.
+         */
+        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
     } else {
-        tlb_flush_page_by_mmuidx_async_work(
-            cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+        TLBFlushPageByMMUIdxData *d = g_new(TLBFlushPageByMMUIdxData, 1);
+
+        /* Otherwise allocate a structure, freed by the worker.  */
+        d->addr = addr;
+        d->idxmap = idxmap;
+        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_2,
+                         RUN_ON_CPU_HOST_PTR(d));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page(CPUState *cpu, target_ulong addr)
 void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
                                        uint16_t idxmap)
 {
-    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
-    fn(src_cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    /*
+     * Allocate memory to hold addr+idxmap only when needed.
+     * See tlb_flush_page_by_mmuidx for details.
+     */
+    if (idxmap < TARGET_PAGE_SIZE) {
+        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+    } else {
+        CPUState *dst_cpu;
+
+        /* Allocate a separate data block for each destination cpu.  */
+        CPU_FOREACH(dst_cpu) {
+            if (dst_cpu != src_cpu) {
+                TLBFlushPageByMMUIdxData *d
+                    = g_new(TLBFlushPageByMMUIdxData, 1);
+
+                d->addr = addr;
+                d->idxmap = idxmap;
+                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
+                                 RUN_ON_CPU_HOST_PTR(d));
+            }
+        }
+    }
+
+    tlb_flush_page_by_mmuidx_async_0(src_cpu, addr, idxmap);
 }
 
 void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                               target_ulong addr,
                                               uint16_t idxmap)
 {
-    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
-    async_safe_run_on_cpu(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    /*
+     * Allocate memory to hold addr+idxmap only when needed.
+     * See tlb_flush_page_by_mmuidx for details.
+     */
+    if (idxmap < TARGET_PAGE_SIZE) {
+        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                              RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+    } else {
+        CPUState *dst_cpu;
+        TLBFlushPageByMMUIdxData *d;
+
+        /* Allocate a separate data block for each destination cpu.  */
+        CPU_FOREACH(dst_cpu) {
+            if (dst_cpu != src_cpu) {
+                d = g_new(TLBFlushPageByMMUIdxData, 1);
+                d->addr = addr;
+                d->idxmap = idxmap;
+                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
+                                 RUN_ON_CPU_HOST_PTR(d));
+            }
+        }
+
+        d = g_new(TLBFlushPageByMMUIdxData, 1);
+        d->addr = addr;
+        d->idxmap = idxmap;
+        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_2,
+                              RUN_ON_CPU_HOST_PTR(d));
+    }
 }
 
 void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr)
-- 
2.20.1

From: Carlos Santos <casantos@redhat.com>

uClibc defines _SC_LEVEL1_ICACHE_LINESIZE and _SC_LEVEL1_DCACHE_LINESIZE
but the corresponding sysconf calls returns -1, which is a valid result,
meaning that the limit is indeterminate.

Handle this situation using the fallback values instead of crashing due
to an assertion failure.

Signed-off-by: Carlos Santos <casantos@redhat.com>
Message-Id: <20191017123713.30192-1-casantos@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/cacheinfo.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/util/cacheinfo.c b/util/cacheinfo.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheinfo.c
+++ b/util/cacheinfo.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static void sys_cache_info(int *isize, int *dsize)
 {
 # ifdef _SC_LEVEL1_ICACHE_LINESIZE
-    *isize = sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+    int tmp_isize = (int) sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+    if (tmp_isize > 0) {
+        *isize = tmp_isize;
+    }
 # endif
 # ifdef _SC_LEVEL1_DCACHE_LINESIZE
-    *dsize = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+    int tmp_dsize = (int) sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+    if (tmp_dsize > 0) {
+        *dsize = tmp_dsize;
+    }
 # endif
 }
 #endif /* sys_cache_info */
-- 
2.20.1

The accel_initialised variable no longer has any setters.

Fixes: 6f6e1698a68c
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 {
     const char *accel;
     char **accel_list, **tmp;
-    bool accel_initialised = false;
     bool init_failed = false;
 
     qemu_opts_foreach(qemu_find_opts("icount"),
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
         accel_list = g_strsplit(accel, ":", 0);
 
-        for (tmp = accel_list; !accel_initialised && tmp && *tmp; tmp++) {
+        for (tmp = accel_list; tmp && *tmp; tmp++) {
             /*
              * Filter invalid accelerators here, to prevent obscenities
              * such as "-machine accel=tcg,,thread=single".
-- 
2.20.1

The accel_list and tmp variables are only used when manufacturing
-machine accel, options based on -accel.

Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
 static void configure_accelerators(const char *progname)
 {
     const char *accel;
-    char **accel_list, **tmp;
     bool init_failed = false;
 
     qemu_opts_foreach(qemu_find_opts("icount"),
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
     accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
     if (QTAILQ_EMPTY(&qemu_accel_opts.head)) {
+        char **accel_list, **tmp;
+
         if (accel == NULL) {
             /* Select the default accelerator */
             if (!accel_find("tcg") && !accel_find("kvm")) {
-- 
2.20.1

By choosing "tcg:kvm" when kvm is not enabled, we generate
an incorrect warning: "invalid accelerator kvm".

At the same time, use g_str_has_suffix rather than open-coding
the same operation.

Presumably the inverse is also true with --disable-tcg.

Fixes: 28a0961757fc
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
         if (accel == NULL) {
             /* Select the default accelerator */
-            if (!accel_find("tcg") && !accel_find("kvm")) {
-                error_report("No accelerator selected and"
-                             " no default accelerator available");
-                exit(1);
-            } else {
-                int pnlen = strlen(progname);
-                if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
+            bool have_tcg = accel_find("tcg");
+            bool have_kvm = accel_find("kvm");
+
+            if (have_tcg && have_kvm) {
+                if (g_str_has_suffix(progname, "kvm")) {
                     /* If the program name ends with "kvm", we prefer KVM */
                     accel = "kvm:tcg";
                 } else {
                     accel = "tcg:kvm";
                 }
+            } else if (have_kvm) {
+                accel = "kvm";
+            } else if (have_tcg) {
+                accel = "tcg";
+            } else {
+                error_report("No accelerator selected and"
+                             " no default accelerator available");
+                exit(1);
             }
         }
-
         accel_list = g_strsplit(accel, ":", 0);
 
         for (tmp = accel_list; *tmp; tmp++) {
-- 
2.20.1

There is only one caller for tlb_table_flush_by_mmuidx.  Place
the result at the earlier line number, due to an expected user
in the near future.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
     }
 }
 
-static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
     tlb_mmu_resize_locked(env, mmu_idx);
-    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
+    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
+    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
+    env_tlb(env)->d[mmu_idx].vindex = 0;
+    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
+    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
+           sizeof(env_tlb(env)->d[0].vtable));
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
@@ -XXX,XX +XXX,XX @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
-{
-    tlb_table_flush_by_mmuidx(env, mmu_idx);
-    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-    env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-           sizeof(env_tlb(env)->d[0].vtable));
-}
-
 static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 {
     CPUArchState *env = cpu->env_ptr;
-- 
2.20.1

There are no users of this function outside cputlb.c,
and its interface will change in the next patch.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu_ldst.h | 5 -----
 accel/tcg/cputlb.c      | 5 +++++
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -XXX,XX +XXX,XX @@ static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
     return (addr >> TARGET_PAGE_BITS) & size_mask;
 }
 
-static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
-{
-    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
-}
-
 /* Find the TLB entry corresponding to the mmu_idx + address pair.  */
 static inline CPUTLBEntry *tlb_entry(CPUArchState *env, uintptr_t mmu_idx,
                                      target_ulong addr)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
+static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
+{
+    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
+}
+
 static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
 {
     return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
-- 
2.20.1

We do not need the entire CPUArchState to compute these values.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
-static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
+static inline size_t tlb_n_entries(CPUTLBDescFast *fast)
 {
-    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
+    return (fast->mask >> CPU_TLB_ENTRY_BITS) + 1;
 }
 
-static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
+static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
 {
-    return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
+    return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
 }
 
 static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
 static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
 {
     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    size_t old_size = tlb_n_entries(env, mmu_idx);
+    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
     size_t rate;
     size_t new_size = old_size;
     int64_t now = get_clock_realtime();
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
     env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
+    memset(env_tlb(env)->f[mmu_idx].table, -1,
+           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
     memset(env_tlb(env)->d[mmu_idx].vtable, -1,
            sizeof(env_tlb(env)->d[0].vtable));
 }
@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         unsigned int i;
-        unsigned int n = tlb_n_entries(env, mmu_idx);
+        unsigned int n = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
 
         for (i = 0; i < n; i++) {
             tlb_reset_dirty_range_locked(&env_tlb(env)->f[mmu_idx].table[i],
-- 
2.20.1

No functional change, but the smaller expressions make
the code easier to read.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
 
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
- * @env: CPU that owns the TLB
- * @mmu_idx: MMU index of the TLB
+ * @desc: The CPUTLBDesc portion of the TLB
+ * @fast: The CPUTLBDescFast portion of the same TLB
  *
  * Called with tlb_lock_held.
  *
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
  * high), since otherwise we are likely to have a significant amount of
  * conflict misses.
  */
-static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 {
-    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
+    size_t old_size = tlb_n_entries(fast);
     size_t rate;
     size_t new_size = old_size;
     int64_t now = get_clock_realtime();
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
         return;
     }
 
-    g_free(env_tlb(env)->f[mmu_idx].table);
-    g_free(env_tlb(env)->d[mmu_idx].iotlb);
+    g_free(fast->table);
+    g_free(desc->iotlb);
 
     tlb_window_reset(desc, now, 0);
     /* desc->n_used_entries is cleared by the caller */
-    env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-    env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
-    env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
+    fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+    fast->table = g_try_new(CPUTLBEntry, new_size);
+    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+
     /*
      * If the allocations fail, try smaller sizes. We just freed some
      * memory, so going back to half of new_size has a good chance of working.
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
      * allocations to fail though, so we progressively reduce the allocation
      * size, aborting if we cannot even allocate the smallest TLB we support.
      */
-    while (env_tlb(env)->f[mmu_idx].table == NULL ||
-           env_tlb(env)->d[mmu_idx].iotlb == NULL) {
+    while (fast->table == NULL || desc->iotlb == NULL) {
         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
             error_report("%s: %s", __func__, strerror(errno));
             abort();
         }
         new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
-        env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+        fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
 
-        g_free(env_tlb(env)->f[mmu_idx].table);
-        g_free(env_tlb(env)->d[mmu_idx].iotlb);
-        env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
-        env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
+        g_free(fast->table);
+        g_free(desc->iotlb);
+        fast->table = g_try_new(CPUTLBEntry, new_size);
+        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
     }
 }
 
 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_mmu_resize_locked(env, mmu_idx);
+    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-- 
2.20.1

No functional change, but the smaller expressions make
the code easier to read.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 
 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
-    env_tlb(env)->d[mmu_idx].n_used_entries = 0;
-    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-    env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->f[mmu_idx].table, -1,
-           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
-    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-           sizeof(env_tlb(env)->d[0].vtable));
+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+
+    tlb_mmu_resize_locked(desc, fast);
+    desc->n_used_entries = 0;
+    desc->large_page_addr = -1;
+    desc->large_page_mask = -1;
+    desc->vindex = 0;
+    memset(fast->table, -1, sizeof_tlb(fast));
+    memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-- 
2.20.1

We will want to be able to flush a tlb without resizing.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
     }
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 {
-    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
-
-    tlb_mmu_resize_locked(desc, fast);
     desc->n_used_entries = 0;
     desc->large_page_addr = -1;
     desc->large_page_mask = -1;
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+{
+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+
+    tlb_mmu_resize_locked(desc, fast);
+    tlb_mmu_flush_locked(desc, fast);
+}
+
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
 {
     env_tlb(env)->d[mmu_idx].n_used_entries++;
-- 
2.20.1

Merge into the only caller, but at the same time split
out tlb_mmu_init to initialize a single tlb entry.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
     desc->window_max_entries = max_entries;
 }
 
-static void tlb_dyn_init(CPUArchState *env)
-{
-    int i;
-
-    for (i = 0; i < NB_MMU_MODES; i++) {
-        CPUTLBDesc *desc = &env_tlb(env)->d[i];
-        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
-
-        tlb_window_reset(desc, get_clock_realtime(), 0);
-        desc->n_used_entries = 0;
-        env_tlb(env)->f[i].mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
-        env_tlb(env)->f[i].table = g_new(CPUTLBEntry, n_entries);
-        env_tlb(env)->d[i].iotlb = g_new(CPUIOTLBEntry, n_entries);
-    }
-}
-
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
  * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     tlb_mmu_flush_locked(desc, fast);
 }
 
+static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
+{
+    size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
+
+    tlb_window_reset(desc, now, 0);
+    desc->n_used_entries = 0;
+    fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
+    fast->table = g_new(CPUTLBEntry, n_entries);
+    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+}
+
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
 {
     env_tlb(env)->d[mmu_idx].n_used_entries++;
@@ -XXX,XX +XXX,XX @@ static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
 void tlb_init(CPUState *cpu)
 {
     CPUArchState *env = cpu->env_ptr;
+    int64_t now = get_clock_realtime();
+    int i;
 
     qemu_spin_init(&env_tlb(env)->c.lock);
 
     /* Ensure that cpu_reset performs a full flush.  */
     env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
 
-    tlb_dyn_init(env);
+    for (i = 0; i < NB_MMU_MODES; i++) {
+        tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
+    }
 }
 
 /* flush_all_helper: run fn across all cpus
-- 
2.20.1

There's little point in leaving these data structures half initialized,
and relying on a flush to be done during reset.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_new(CPUTLBEntry, n_entries);
     desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+    tlb_mmu_flush_locked(desc, fast);
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
@@ -XXX,XX +XXX,XX @@ void tlb_init(CPUState *cpu)
 
     qemu_spin_init(&env_tlb(env)->c.lock);
 
-    /* Ensure that cpu_reset performs a full flush.  */
-    env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
+    /* All tlbs are initialized flushed. */
+    env_tlb(env)->c.dirty = 0;
 
     for (i = 0; i < NB_MMU_MODES; i++) {
         tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
-- 
2.20.1

Do not call get_clock_realtime() in tlb_mmu_resize_locked,
but hoist outside of any loop over a set of tlbs.  This is
only two (indirect) callers, tlb_flush_by_mmuidx_async_work
and tlb_flush_page_locked, so not onerous.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
  * high), since otherwise we are likely to have a significant amount of
  * conflict misses.
  */
-static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+                                  int64_t now)
 {
     size_t old_size = tlb_n_entries(fast);
     size_t rate;
     size_t new_size = old_size;
-    int64_t now = get_clock_realtime();
     int64_t window_len_ms = 100;
     int64_t window_len_ns = window_len_ms * 1000 * 1000;
     bool window_expired = now > desc->window_begin_ns + window_len_ns;
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
     memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx,
+                                        int64_t now)
 {
     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
     CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
 
-    tlb_mmu_resize_locked(desc, fast);
+    tlb_mmu_resize_locked(desc, fast, now);
     tlb_mmu_flush_locked(desc, fast);
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
     CPUArchState *env = cpu->env_ptr;
     uint16_t asked = data.host_int;
     uint16_t all_dirty, work, to_clean;
+    int64_t now = get_clock_realtime();
 
     assert_cpu_is_self(cpu);
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 
     for (work = to_clean; work != 0; work &= work - 1) {
         int mmu_idx = ctz32(work);
-        tlb_flush_one_mmuidx_locked(env, mmu_idx);
+        tlb_flush_one_mmuidx_locked(env, mmu_idx, now);
     }
 
     qemu_spin_unlock(&env_tlb(env)->c.lock);
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
         tlb_debug("forcing full flush midx %d ("
                   TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
                   midx, lp_addr, lp_mask);
-        tlb_flush_one_mmuidx_locked(env, midx);
+        tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
     } else {
         if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
             tlb_n_used_entries_dec(env, midx);
-- 
2.20.1

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20201008

for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:

accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)

----------------------------------------------------------------
Extend maximum gvec vector size
Fix i386 avx2 dupi
Fix mips host user-only write detection
Misc cleanups.

----------------------------------------------------------------
Kele Huang (1):
      accel/tcg: Fix computing of is_write for MIPS

Richard Henderson (10):
      tcg: Adjust simd_desc size encoding
      tcg: Drop union from TCGArgConstraint
      tcg: Move sorted_args into TCGArgConstraint.sort_index
      tcg: Remove TCG_CT_REG
      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
      tcg: Remove TCGOpDef.used
      tcg/i386: Fix dupi for avx2 32-bit hosts
      tcg: Fix generation of dupi_vec for 32-bit host
      tcg/optimize: Fold dup2_vec
      tcg: Remove TCG_TARGET_HAS_cmp_vec

With larger vector sizes, it turns out oprsz == maxsz, and we only
need to represent mismatch for oprsz <= 32.  We do, however, need
to represent larger oprsz and do so without reducing SIMD_DATA_BITS.

Reduce the size of the oprsz field and increase the maxsz field.
Steal the oprsz value of 24 to indicate equality with maxsz.

Tested-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
 tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 2 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-gvec-desc.h
+++ b/include/tcg/tcg-gvec-desc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TCG_TCG_GVEC_DESC_H
 #define TCG_TCG_GVEC_DESC_H
 
-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
-#define SIMD_OPRSZ_SHIFT   0
-#define SIMD_OPRSZ_BITS    5
+/*
+ * This configuration allows MAXSZ to represent 2048 bytes, and
+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+ *
+ * Encode this with:
+ *   0, 1, 3 -> 8, 16, 32
+ *   2       -> maxsz
+ *
+ * This steals the input that would otherwise map to 24 to match maxsz.
+ */
+#define SIMD_MAXSZ_SHIFT   0
+#define SIMD_MAXSZ_BITS    8
 
-#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
-#define SIMD_MAXSZ_BITS    5
+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_OPRSZ_BITS    2
 
-#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
 
 /* Create a descriptor from components.  */
 uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 
-/* Extract the operation size from a descriptor.  */
-static inline intptr_t simd_oprsz(uint32_t desc)
-{
-    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
-}
-
 /* Extract the max vector size from a descriptor.  */
 static inline intptr_t simd_maxsz(uint32_t desc)
 {
-    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
+    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
+}
+
+/* Extract the operation size from a descriptor.  */
+static inline intptr_t simd_oprsz(uint32_t desc)
+{
+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+    intptr_t o = f * 8 + 8;
+    intptr_t m = simd_maxsz(desc);
+    return f == 2 ? m : o;
 }
 
 /* Extract the operation-specific data from a descriptor.  */
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
    of the operand offsets so that we can check them all at once.  */
 static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
 {
-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
-    tcg_debug_assert(oprsz > 0);
-    tcg_debug_assert(oprsz <= maxsz);
-    tcg_debug_assert((oprsz & opr_align) == 0);
+    uint32_t max_align;
+
+    switch (oprsz) {
+    case 8:
+    case 16:
+    case 32:
+        tcg_debug_assert(oprsz <= maxsz);
+        break;
+    default:
+        tcg_debug_assert(oprsz == maxsz);
+        break;
+    }
+    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
+
+    max_align = maxsz >= 16 ? 15 : 7;
     tcg_debug_assert((maxsz & max_align) == 0);
     tcg_debug_assert((ofs & max_align) == 0);
 }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
 {
     uint32_t desc = 0;
 
-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
+    check_size_align(oprsz, maxsz, 0);
+    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 
     oprsz = (oprsz / 8) - 1;
     maxsz = (maxsz / 8) - 1;
+
+    /*
+     * We have just asserted in check_size_align that either
+     * oprsz is {8,16,32} or matches maxsz.  Encode the final
+     * case with '2', as that would otherwise map to 24.
+     */
+    if (oprsz == maxsz) {
+        oprsz = 2;
+    }
+
     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
     desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
-- 
2.25.1

The union is unused; let "regs" appear in the main structure
without the "u.regs" wrapping.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h            |  4 +---
 tcg/tcg.c                    | 22 +++++++++++-----------
 tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
 tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
 tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
 tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
 tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
 tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
 tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
 tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
 tcg/tci/tcg-target.c.inc     |  2 +-
 11 files changed, 91 insertions(+), 93 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 typedef struct TCGArgConstraint {
     uint16_t ct;
     uint8_t alias_index;
-    union {
-        TCGRegSet regs;
-    } u;
+    TCGRegSet regs;
 } TCGArgConstraint;
 
 #define TCG_MAX_OP_ARGS 16
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
             return 0;
         n = 0;
         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->u.regs, i))
+            if (tcg_regset_test_reg(arg_ct->regs, i))
                 n++;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].u.regs = 0;
+            def->args_ct[i].regs = 0;
             def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     pset = la_temp_pref(ts);
                     set = *pset;
 
-                    set &= ct->u.regs;
+                    set &= ct->regs;
                     if (ct->ct & TCG_CT_IALIAS) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
                     if (set == 0) {
-                        set = ct->u.regs;
+                        set = ct->regs;
                     }
                     *pset = set;
                 }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
         return;
     }
 
-    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
-    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
+    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
+    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
 
     /* Allocate the output register now.  */
     if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             }
         }
 
-        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
+        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
         reg = ts->reg;
 
-        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
             /* nothing to do : the constraint is satisfied */
         } else {
         allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                and move the temporary register into it */
             temp_load(s, ts, tcg_target_available_regs[ts->type],
                       i_allocated_regs, 0);
-            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
+            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                 o_preferred_regs, ts->indirect_base);
             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
             } else if (arg_ct->ct & TCG_CT_NEWREG) {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             } else {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             }
             tcg_regset_set_reg(o_allocated_regs, reg);
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r': /* general registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffffu;
+        ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffff00000000ull;
+        ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffffu;
+        ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
            and x2, and x3 for helper args, better to avoid using them. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
 #endif
         break;
     case 'A': /* Valid for arithmetic immediate (positive or negative).  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
            so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
     /* qemu_st address & data */
     case 's':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 #if defined(CONFIG_SOFTMMU)
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 #if TARGET_LONG_BITS == 64
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #endif
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'a':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xf;
+        ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_GENERAL_REGS;
+        ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
         /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'x':
         /* A vector register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_VECTOR_REGS;
+        ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
         break;
 
     case 'e':
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
         }
 #endif
         break;
     case 'S': /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
         } else {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
         }
 #endif
         break;
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
+        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'v':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff00000000ull;
+        ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
 #endif
         break;
     case 'I':
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
 #endif
         break;
     case 'I':
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':                  /* all registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        ct->regs = 0xffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
     case 'A':
         ct->ct |= TCG_CT_CONST_S33;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'R':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
+        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
         ct->ct |= TCG_CT_CONST_S11;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
+        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
         return NULL;
-- 
2.25.1

This uses an existing hole in the TCGArgConstraint structure
and will be convenient for keeping the data in one place.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 +-
 tcg/tcg.c         | 35 +++++++++++++++++------------------
 2 files changed, 18 insertions(+), 19 deletions(-)

This wasn't actually used for anything, really.  All variable
operands must accept registers, and which are indicated by the
set in TCGArgConstraint.regs.

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 #define TCG_CT_ALIAS  0x80
 #define TCG_CT_IALIAS 0x40
 #define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_REG    0x01
 #define TCG_CT_CONST  0x02 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
 /* we give more priority to constraints with less registers */
 static int get_constraint_priority(const TCGOpDef *def, int k)
 {
-    const TCGArgConstraint *arg_ct;
+    const TCGArgConstraint *arg_ct = &def->args_ct[k];
+    int n;
 
-    int i, n;
-    arg_ct = &def->args_ct[k];
     if (arg_ct->ct & TCG_CT_ALIAS) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
-        if (!(arg_ct->ct & TCG_CT_REG))
-            return 0;
-        n = 0;
-        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->regs, i))
-                n++;
-        }
+        n = ctpop64(arg_ct->regs);
     }
     return TCG_TARGET_NB_REGS - n + 1;
 }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         int oarg = *ct_str - '0';
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
-                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
+                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                         /* TCG_CT_ALIAS is for the output arguments.
                            The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r': /* general registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
 
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     /* qemu_st address & data */
     case 's':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'a':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
     case 'x':
         /* A vector register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
         tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S': /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'v':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':                  /* all registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'R':
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
         tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'r':
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
-- 
2.25.1

These are easier to set and test when they have their own fields.
Reduce the size of alias_index and sort_index to 4 bits, which is
sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
constants within the ct field.

Move all initialization to allocation time, rather than init
individual fields in process_op_defs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 14 +++++++-------
 tcg/tcg.c         | 28 ++++++++++++----------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(void);
 void tcg_dump_op_count(void);
 
-#define TCG_CT_ALIAS  0x80
-#define TCG_CT_IALIAS 0x40
-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_CONST  0x02 /* any constant of register size */
+#define TCG_CT_CONST  1 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
-    uint16_t ct;
-    uint8_t alias_index;
-    uint8_t sort_index;
+    unsigned ct : 16;
+    unsigned alias_index : 4;
+    unsigned sort_index : 4;
+    bool oalias : 1;
+    bool ialias : 1;
+    bool newreg : 1;
     TCGRegSet regs;
 } TCGArgConstraint;
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
         total_args += n;
     }
 
-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    args_ct = g_new0(TCGArgConstraint, total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
     const TCGArgConstraint *arg_ct = &def->args_ct[k];
     int n;
 
-    if (arg_ct->ct & TCG_CT_ALIAS) {
+    if (arg_ct->oalias) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].regs = 0;
-            def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
                 case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
                         tcg_debug_assert(def->args_ct[oarg].regs != 0);
-                        /* TCG_CT_ALIAS is for the output arguments.
-                           The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
-                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
+                        /* The output sets oalias.  */
+                        def->args_ct[oarg].oalias = true;
                         def->args_ct[oarg].alias_index = i;
-                        def->args_ct[i].ct |= TCG_CT_IALIAS;
+                        /* The input sets ialias. */
+                        def->args_ct[i].ialias = true;
                         def->args_ct[i].alias_index = oarg;
                     }
                     ct_str++;
                     break;
                 case '&':
-                    def->args_ct[i].ct |= TCG_CT_NEWREG;
+                    def->args_ct[i].newreg = true;
                     ct_str++;
                     break;
                 case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     set = *pset;
 
                     set &= ct->regs;
-                    if (ct->ct & TCG_CT_IALIAS) {
+                    if (ct->ialias) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
 
         i_preferred_regs = o_preferred_regs = 0;
-        if (arg_ct->ct & TCG_CT_IALIAS) {
+        if (arg_ct->ialias) {
             o_preferred_regs = op->output_pref[arg_ct->alias_index];
             if (ts->fixed_reg) {
                 /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                     reg = ts->reg;
                     for (k2 = 0 ; k2 < k ; k2++) {
                         i2 = def->args_ct[nb_oargs + k2].sort_index;
-                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
-                            reg == new_args[i2]) {
+                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                             goto allocate_in_reg;
                         }
                     }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             /* ENV should not be modified.  */
             tcg_debug_assert(!ts->fixed_reg);
 
-            if ((arg_ct->ct & TCG_CT_ALIAS)
-                && !const_args[arg_ct->alias_index]) {
+            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
-            } else if (arg_ct->ct & TCG_CT_NEWREG) {
+            } else if (arg_ct->newreg) {
                 reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
-- 
2.25.1

The definition of INDEX_op_dupi_vec is that it operates on
units of tcg_target_ulong -- in this case 32 bits.  It does
not work to use this for a uint64_t value that happens to be
small enough to fit in tcg_target_ulong.

Fixes: d2fd745fe8b
Fixes: db432672dc5
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
 
 void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
 {
-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
-        do_dupi_vec(r, MO_32, a);
-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
+    if (TCG_TARGET_REG_BITS == 64) {
         do_dupi_vec(r, MO_64, a);
+    } else if (a == dup_const(MO_32, a)) {
+        do_dupi_vec(r, MO_32, a);
     } else {
         TCGv_i64 c = tcg_const_i64(a);
         tcg_gen_dup_i64_vec(MO_64, r, c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
 
 void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
 {
-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    if (vece == MO_64) {
+        tcg_gen_dup64i_vec(r, a);
+    } else {
+        do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    }
 }
 
 void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
-- 
2.25.1

When the two arguments are identical, this can be reduced to
dup_vec or to mov_vec from a tcg_constant_vec.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        case INDEX_op_dup2_vec:
+            assert(TCG_TARGET_REG_BITS == 32);
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                tmp = arg_info(op->args[1])->val;
+                if (tmp == arg_info(op->args[2])->val) {
+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                    break;
+                }
+            } else if (args_are_copies(op->args[1], op->args[2])) {
+                op->opc = INDEX_op_dup_vec;
+                TCGOP_VECE(op) = MO_32;
+                nb_iargs = 1;
+            }
+            goto do_default;
+
         CASE_OP_32_64(not):
         CASE_OP_32_64(neg):
         CASE_OP_32_64(ext8s):
-- 
2.25.1

The cmp_vec opcode is mandatory; this symbol is unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h | 1 -
 tcg/i386/tcg-target.h    | 1 -
 tcg/ppc/tcg-target.h     | 1 -
 3 files changed, 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          1
 #define TCG_TARGET_HAS_shv_vec          have_avx2
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
 #define TCG_TARGET_HAS_shi_vec          0
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
-- 
2.25.1

From: Kele Huang <kele.hwang@gmail.com>

Detect all MIPS store instructions in cpu_signal_handler for all available
MIPS versions, and set is_write if encountering such store instructions.

This fixed the error while dealing with self-modified code for MIPS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Kele Huang <kele.hwang@gmail.com>
Signed-off-by: Xu Zou <iwatchnima@gmail.com>
Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
[rth: Use uintptr_t for pc to fix n32 build error.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
 #elif defined(__mips__)
 
+#if defined(__misp16) || defined(__mips_micromips)
+#error "Unsupported encoding"
+#endif
+
 int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
     siginfo_t *info = pinfo;
     ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.pc;
-    int is_write;
+    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
+    int is_write = 0;
+
+    /* Detect all store instructions at program counter. */
+    switch((insn >> 26) & 077) {
+    case 050: /* SB */
+    case 051: /* SH */
+    case 052: /* SWL */
+    case 053: /* SW */
+    case 054: /* SDL */
+    case 055: /* SDR */
+    case 056: /* SWR */
+    case 070: /* SC */
+    case 071: /* SWC1 */
+    case 074: /* SCD */
+    case 075: /* SDC1 */
+    case 077: /* SD */
+#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
+    case 072: /* SWC2 */
+    case 076: /* SDC2 */
+#endif
+        is_write = 1;
+        break;
+    case 023: /* COP1X */
+        /* Required in all versions of MIPS64 since
+           MIPS64r1 and subsequent versions of MIPS32r2. */
+        switch (insn & 077) {
+        case 010: /* SWXC1 */
+        case 011: /* SDXC1 */
+        case 015: /* SUXC1 */
+            is_write = 1;
+        }
+        break;
+    }
 
-    /* XXX: compute is_write */
-    is_write = 0;
     return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }
 
-- 
2.25.1