Series comparison

-[PULL 00/16] tcg patch queue
+[PULL v2 0/8] tcg patch queue
-The following changes since commit 3e08b2b9cb64bff2b73fa9128c0e49bfcde0dd40:
+The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:
-  Merge remote-tracking branch 'remotes/philmd-gitlab/tags/edk2-next-20200121' into staging (2020-01-21 15:29:25 +0000)
+  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20200121
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221
-for you to fetch changes up to 75fa376cdab5e5db2c7fdd107358e16f95503ac6:
+for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:
-  scripts/git.orderfile: Display decodetree before C source (2020-01-21 15:26:09 -1000)
+  sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)
 ----------------------------------------------------------------
-Remove another limit to NB_MMU_MODES.
+tcg: Allow first half of insn in ram, and second half in mmio
-Fix compilation using uclibc.
+linux-user/sparc: SIGILL for unknown trap vectors
-Fix defaulting of -accel parameters.
+linux-user/microblaze: SIGILL for privileged insns
-Tidy cputlb basic routines.
+linux-user: Fix deadlock while exiting due to signal
-Adjust git.orderfile for decodetree.
+target/microblaze: Add gdbstub xml
 util: Adjust cacheflush for windows-arm64
 include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64
 ----------------------------------------------------------------
-Carlos Santos (1):
+Ilya Leoshkevich (3):
-      util/cacheinfo: fix crash when compiling with uClibc
+      linux-user: Always exit from exclusive state in fork_end()
       cpus: Make {start,end}_exclusive() recursive
       linux-user/microblaze: Handle privileged exception
-Philippe Mathieu-Daudé (1):
+Pierrick Bouvier (2):
-      scripts/git.orderfile: Display decodetree before C source
+      util/cacheflush: fix cache on windows-arm64
       sysemu/os-win32: fix setjmp/longjmp on windows-arm64
-Richard Henderson (14):
+Richard Henderson (3):
-      cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
+      accel/tcg: Allow the second page of an instruction to be MMIO
-      vl: Remove unused variable in configure_accelerators
+      linux-user/sparc: Raise SIGILL for all unhandled software traps
-      vl: Reduce scope of variables in configure_accelerators
+      target/microblaze: Add gdbstub xml
       vl: Remove useless test in configure_accelerators
       vl: Only choose enabled accelerators in configure_accelerators
       cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
       cputlb: Make tlb_n_entries private to cputlb.c
       cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
       cputlb: Hoist tlb portions in tlb_mmu_resize_locked
       cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
       cputlb: Split out tlb_mmu_flush_locked
       cputlb: Partially merge tlb_dyn_init into tlb_init
       cputlb: Initialize tlbs as flushed
       cputlb: Hoist timestamp outside of loops over tlbs
- include/exec/cpu_ldst.h |   5 -
+ include/hw/core/cpu.h                       |  4 +-
- accel/tcg/cputlb.c      | 287 +++++++++++++++++++++++++++++++++---------------
+ include/sysemu/os-win32.h                   | 28 ++++++++++--
- util/cacheinfo.c        |  10 +-
+ target/microblaze/cpu.h                     |  2 +
- vl.c                    |  27 +++--
+ accel/tcg/translator.c                      | 12 +++++-
- scripts/git.orderfile   |   3 +
+ cpus-common.c                               | 12 +++++-
-files changed, 223 insertions(+), 109 deletions(-)
+ linux-user/main.c                           | 10 +++--
+ linux-user/microblaze/cpu_loop.c            | 10 ++++-
  linux-user/sparc/cpu_loop.c                 |  8 ++++
  linux-user/syscall.c                        |  1 +
  target/microblaze/cpu.c                     |  7 ++-
  target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
  util/cacheflush.c                           | 14 ++++--
  configs/targets/microblaze-linux-user.mak   |  1 +
  configs/targets/microblaze-softmmu.mak      |  1 +
  configs/targets/microblazeel-linux-user.mak |  1 +
  configs/targets/microblazeel-softmmu.mak    |  1 +
  gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
  gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
  meson.build                                 | 21 +++++++++
 files changed, 229 insertions(+), 34 deletions(-)
  create mode 100644 gdb-xml/microblaze-core.xml
  create mode 100644 gdb-xml/microblaze-stack-protect.xml

-[PULL 16/16] scripts/git.orderfile: Display decodetree before C source
+[PULL v2 1/8] accel/tcg: Allow the second page of an instruction to be MMIO
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+If an instruction straddles a page boundary, and the first page
 was ram, but the second page was MMIO, we would abort.  Handle
 this as if both pages are MMIO, by setting the ram_addr_t for
 the first page to -1.
-To avoid scrolling each instruction when reviewing tcg
+Reported-by: Sid Manning <sidneym@quicinc.com>
-helpers written for the decodetree script, display the
+Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
-.decode files (similar to header declarations) before
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 the C source (implementation of previous declarations).
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20191230082856.30556-1-philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- scripts/git.orderfile | 3 +++
+ accel/tcg/translator.c | 12 ++++++++++--
-file changed, 3 insertions(+)
+file changed, 10 insertions(+), 2 deletions(-)
-diff --git a/scripts/git.orderfile b/scripts/git.orderfile
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
---- a/scripts/git.orderfile
+--- a/accel/tcg/translator.c
-+++ b/scripts/git.orderfile
++++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ qga/*.json
+@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
- # headers
+         if (host == NULL) {
- *.h
+             tb_page_addr_t phys_page =
+                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-+# decoding tree specification
+-            /* We cannot handle MMIO as second page. */
-+*.decode
+-            assert(phys_page != -1);
 +
- # code
++            /*
- *.c
++             * If the second page is MMIO, treat as if the first page
 +             * was MMIO as well, so that we do not cache the TB.
 +             */
 +            if (unlikely(phys_page == -1)) {
 +                tb_set_page_addr0(tb, -1);
 +                return NULL;
 +            }
 +
              tb_set_page_addr1(tb, phys_page);
  #ifdef CONFIG_USER_ONLY
              page_protect(end);
 --
-.20.1
+.34.1

-[PULL 15/16] cputlb: Hoist timestamp outside of loops over tlbs
+[PULL v2 2/8] linux-user/sparc: Raise SIGILL for all unhandled software traps
-Do not call get_clock_realtime() in tlb_mmu_resize_locked,
+The linux kernel's trap tables vector all unassigned trap
-but hoist outside of any loop over a set of tlbs.  This is
+numbers to BAD_TRAP, which then raises SIGILL.
 only two (indirect) callers, tlb_flush_by_mmuidx_async_work
 and tlb_flush_page_locked, so not onerous.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 14 ++++++++------
+ linux-user/sparc/cpu_loop.c | 8 ++++++++
-file changed, 8 insertions(+), 6 deletions(-)
+file changed, 8 insertions(+)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/linux-user/sparc/cpu_loop.c
-+++ b/accel/tcg/cputlb.c
++++ b/linux-user/sparc/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
+@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
-  * high), since otherwise we are likely to have a significant amount of
+             cpu_exec_step_atomic(cs);
-  * conflict misses.
+             break;
-  */
+         default:
--static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
++            /*
-+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
++             * Most software trap numbers vector to BAD_TRAP.
-+                                  int64_t now)
++             * Handle anything not explicitly matched above.
- {
++             */
-     size_t old_size = tlb_n_entries(fast);
++            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
-     size_t rate;
++                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
-     size_t new_size = old_size;
++                break;
--    int64_t now = get_clock_realtime();
++            }
-     int64_t window_len_ms = 100;
+             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
-     int64_t window_len_ns = window_len_ms * 1000 * 1000;
+             cpu_dump_state(cs, stderr, 0);
-     bool window_expired = now > desc->window_begin_ns + window_len_ns;
+             exit(EXIT_FAILURE);
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
      memset(desc->vtable, -1, sizeof(desc->vtable));
  }
 -static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 +static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx,
 +                                        int64_t now)
  {
      CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
      CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
 -    tlb_mmu_resize_locked(desc, fast);
 +    tlb_mmu_resize_locked(desc, fast, now);
      tlb_mmu_flush_locked(desc, fast);
  }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      CPUArchState *env = cpu->env_ptr;
      uint16_t asked = data.host_int;
      uint16_t all_dirty, work, to_clean;
 +    int64_t now = get_clock_realtime();
      assert_cpu_is_self(cpu);
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      for (work = to_clean; work != 0; work &= work - 1) {
          int mmu_idx = ctz32(work);
 -        tlb_flush_one_mmuidx_locked(env, mmu_idx);
 +        tlb_flush_one_mmuidx_locked(env, mmu_idx, now);
      }
      qemu_spin_unlock(&env_tlb(env)->c.lock);
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
          tlb_debug("forcing full flush midx %d ("
                    TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
                    midx, lp_addr, lp_mask);
 -        tlb_flush_one_mmuidx_locked(env, midx);
 +        tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
      } else {
          if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
              tlb_n_used_entries_dec(env, midx);
 --
-.20.1
+.34.1

-[PULL 14/16] cputlb: Initialize tlbs as flushed
+[PULL v2 3/8] linux-user: Always exit from exclusive state in fork_end()
-There's little point in leaving these data structures half initialized,
+From: Ilya Leoshkevich <iii@linux.ibm.com>
 and relying on a flush to be done during reset.
+fork()ed processes currently start with
+current_cpu->in_exclusive_context set, which is, strictly speaking, not
+correct, but does not cause problems (even assertion failures).
+With one of the next patches, the code begins to rely on this value, so
+fix it by always calling end_exclusive() in fork_end().
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 5 +++--
+ linux-user/main.c    | 10 ++++++----
-file changed, 3 insertions(+), 2 deletions(-)
+ linux-user/syscall.c |  1 +
 files changed, 7 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/linux-user/main.c
-+++ b/accel/tcg/cputlb.c
++++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
+@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
-     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
+         }
-     fast->table = g_new(CPUTLBEntry, n_entries);
+         qemu_init_cpu_list();
-     desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+         gdbserver_fork(thread_cpu);
-+    tlb_mmu_flush_locked(desc, fast);
+-        /* qemu_init_cpu_list() takes care of reinitializing the
 -         * exclusive state, so we don't need to end_exclusive() here.
 -         */
      } else {
          cpu_list_unlock();
 -        end_exclusive();
      }
 +    /*
 +     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
 +     * also need to keep current_cpu consistent, so call end_exclusive() for
 +     * both child and parent.
 +     */
 +    end_exclusive();
  }
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
+ __thread CPUState *thread_cpu;
-@@ -XXX,XX +XXX,XX @@ void tlb_init(CPUState *cpu)
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index XXXXXXX..XXXXXXX 100644
-     qemu_spin_init(&env_tlb(env)->c.lock);
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
--    /* Ensure that cpu_reset performs a full flush.  */
+@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
--    env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
+             cpu_clone_regs_parent(env, flags);
-+    /* All tlbs are initialized flushed. */
+             fork_end(0);
-+    env_tlb(env)->c.dirty = 0;
+         }
++        g_assert(!cpu_in_exclusive_context(cpu));
-     for (i = 0; i < NB_MMU_MODES; i++) {
+     }
-         tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
+     return ret;
  }
 --
-.20.1
+.34.1

-[PULL 01/16] cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
+[PULL v2 4/8] cpus: Make {start,end}_exclusive() recursive
-In target/arm we will shortly have "too many" mmu_idx.
+From: Ilya Leoshkevich <iii@linux.ibm.com>
 The current minimum barrier is caused by the way in which
 tlb_flush_page_by_mmuidx is coded.
-We can remove this limitation by allocating memory for
+Currently dying to one of the core_dump_signal()s deadlocks, because
-consumption by the worker.  Let us assume that this is
+dump_core_and_abort() calls start_exclusive() two times: first via
-the unlikely case, as will be the case for the majority
+stop_all_tasks(), and then via preexit_cleanup() ->
-of targets which have so far satisfied the BUILD_BUG_ON,
+qemu_plugin_user_exit().
 and only allocate memory when necessary.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+There are a number of ways to solve this: resume after dumping core;
 check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
 {start,end}_exclusive() recursive. Pick the last option, since it's
 the most straightforward one.
 Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 167 +++++++++++++++++++++++++++++++++++----------
+ include/hw/core/cpu.h |  4 ++--
-file changed, 132 insertions(+), 35 deletions(-)
+ cpus-common.c         | 12 ++++++++++--
 files changed, 12 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/hw/core/cpu.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
+@@ -XXX,XX +XXX,XX @@ struct CPUState {
-     }
+     bool unplug;
      bool crash_occurred;
      bool exit_request;
 -    bool in_exclusive_context;
 +    int exclusive_context_count;
      uint32_t cflags_next_tb;
      /* updates protected by BQL */
      uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
   */
  static inline bool cpu_in_exclusive_context(const CPUState *cpu)
  {
 -    return cpu->in_exclusive_context;
 +    return cpu->exclusive_context_count;
  }
--/* As we are going to hijack the bottom bits of the page address for a
+ /**
-- * mmuidx bit mask we need to fail to build if we can't do that
+diff --git a/cpus-common.c b/cpus-common.c
-+/**
+index XXXXXXX..XXXXXXX 100644
-+ * tlb_flush_page_by_mmuidx_async_0:
+--- a/cpus-common.c
-+ * @cpu: cpu on which to flush
++++ b/cpus-common.c
-+ * @addr: page of virtual address to flush
+@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
-+ * @idxmap: set of mmu_idx to flush
+     CPUState *other_cpu;
-+ *
+     int running_cpus;
-+ * Helper for tlb_flush_page_by_mmuidx and friends, flush one page
-+ * at @addr from the tlbs indicated by @idxmap from @cpu.
++    if (current_cpu->exclusive_context_count) {
-  */
++        current_cpu->exclusive_context_count++;
--QEMU_BUILD_BUG_ON(NB_MMU_MODES > TARGET_PAGE_BITS_MIN);
++        return;
 -
 -static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
 -                                                run_on_cpu_data data)
 +static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
 +                                             target_ulong addr,
 +                                             uint16_t idxmap)
  {
      CPUArchState *env = cpu->env_ptr;
 -    target_ulong addr_and_mmuidx = (target_ulong) data.target_ptr;
 -    target_ulong addr = addr_and_mmuidx & TARGET_PAGE_MASK;
 -    unsigned long mmu_idx_bitmap = addr_and_mmuidx & ALL_MMUIDX_BITS;
      int mmu_idx;
      assert_cpu_is_self(cpu);
 -    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%lx\n",
 -              addr, mmu_idx_bitmap);
 +    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%x\n", addr, idxmap);
      qemu_spin_lock(&env_tlb(env)->c.lock);
      for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
 -        if (test_bit(mmu_idx, &mmu_idx_bitmap)) {
 +        if ((idxmap >> mmu_idx) & 1) {
              tlb_flush_page_locked(env, mmu_idx, addr);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
      tb_flush_jmp_cache(cpu, addr);
  }
 +/**
 + * tlb_flush_page_by_mmuidx_async_1:
 + * @cpu: cpu on which to flush
 + * @data: encoded addr + idxmap
 + *
 + * Helper for tlb_flush_page_by_mmuidx and friends, called through
 + * async_run_on_cpu.  The idxmap parameter is encoded in the page
 + * offset of the target_ptr field.  This limits the set of mmu_idx
 + * that can be passed via this method.
 + */
 +static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
 +                                             run_on_cpu_data data)
 +{
 +    target_ulong addr_and_idxmap = (target_ulong) data.target_ptr;
 +    target_ulong addr = addr_and_idxmap & TARGET_PAGE_MASK;
 +    uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
 +
 +    tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 +}
 +
 +typedef struct {
 +    target_ulong addr;
 +    uint16_t idxmap;
 +} TLBFlushPageByMMUIdxData;
 +
 +/**
 + * tlb_flush_page_by_mmuidx_async_2:
 + * @cpu: cpu on which to flush
 + * @data: allocated addr + idxmap
 + *
 + * Helper for tlb_flush_page_by_mmuidx and friends, called through
 + * async_run_on_cpu.  The addr+idxmap parameters are stored in a
 + * TLBFlushPageByMMUIdxData structure that has been allocated
 + * specifically for this helper.  Free the structure when done.
 + */
 +static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
 +                                             run_on_cpu_data data)
 +{
 +    TLBFlushPageByMMUIdxData *d = data.host_ptr;
 +
 +    tlb_flush_page_by_mmuidx_async_0(cpu, d->addr, d->idxmap);
 +    g_free(d);
 +}
 +
  void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
  {
 -    target_ulong addr_and_mmu_idx;
 -
      tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%" PRIx16 "\n", addr, idxmap);
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    if (!qemu_cpu_is_self(cpu)) {
 -        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_work,
 -                         RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    if (qemu_cpu_is_self(cpu)) {
 +        tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 +    } else if (idxmap < TARGET_PAGE_SIZE) {
 +        /*
 +         * Most targets have only a few mmu_idx.  In the case where
 +         * we can stuff idxmap into the low TARGET_PAGE_BITS, avoid
 +         * allocating memory for this operation.
 +         */
 +        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
      } else {
 -        tlb_flush_page_by_mmuidx_async_work(
 -            cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +        TLBFlushPageByMMUIdxData *d = g_new(TLBFlushPageByMMUIdxData, 1);
 +
 +        /* Otherwise allocate a structure, freed by the worker.  */
 +        d->addr = addr;
 +        d->idxmap = idxmap;
 +        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_2,
 +                         RUN_ON_CPU_HOST_PTR(d));
      }
  }
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page(CPUState *cpu, target_ulong addr)
  void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
                                         uint16_t idxmap)
  {
 -    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
 -    target_ulong addr_and_mmu_idx;
 -
      tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 -    fn(src_cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    /*
 +     * Allocate memory to hold addr+idxmap only when needed.
 +     * See tlb_flush_page_by_mmuidx for details.
 +     */
 +    if (idxmap < TARGET_PAGE_SIZE) {
 +        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +    } else {
 +        CPUState *dst_cpu;
 +
 +        /* Allocate a separate data block for each destination cpu.  */
 +        CPU_FOREACH(dst_cpu) {
 +            if (dst_cpu != src_cpu) {
 +                TLBFlushPageByMMUIdxData *d
 +                    = g_new(TLBFlushPageByMMUIdxData, 1);
 +
 +                d->addr = addr;
 +                d->idxmap = idxmap;
 +                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                                 RUN_ON_CPU_HOST_PTR(d));
 +            }
 +        }
 +    }
 +
-+    tlb_flush_page_by_mmuidx_async_0(src_cpu, addr, idxmap);
+     qemu_mutex_lock(&qemu_cpu_list_lock);
      exclusive_idle();
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
       */
      qemu_mutex_unlock(&qemu_cpu_list_lock);
 -    current_cpu->in_exclusive_context = true;
 +    current_cpu->exclusive_context_count = 1;
  }
- void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
+ /* Finish an exclusive operation.  */
-@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
+ void end_exclusive(void)
                                                target_ulong addr,
                                                uint16_t idxmap)
  {
--    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
+-    current_cpu->in_exclusive_context = false;
--    target_ulong addr_and_mmu_idx;
++    current_cpu->exclusive_context_count--;
--
++    if (current_cpu->exclusive_context_count) {
-     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
++        return;
      /* This should already be page aligned */
 -    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
 -    addr_and_mmu_idx |= idxmap;
 +    addr &= TARGET_PAGE_MASK;
 -    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 -    async_safe_run_on_cpu(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
 +    /*
 +     * Allocate memory to hold addr+idxmap only when needed.
 +     * See tlb_flush_page_by_mmuidx for details.
 +     */
 +    if (idxmap < TARGET_PAGE_SIZE) {
 +        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_1,
 +                              RUN_ON_CPU_TARGET_PTR(addr | idxmap));
 +    } else {
 +        CPUState *dst_cpu;
 +        TLBFlushPageByMMUIdxData *d;
 +
 +        /* Allocate a separate data block for each destination cpu.  */
 +        CPU_FOREACH(dst_cpu) {
 +            if (dst_cpu != src_cpu) {
 +                d = g_new(TLBFlushPageByMMUIdxData, 1);
 +                d->addr = addr;
 +                d->idxmap = idxmap;
 +                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                                 RUN_ON_CPU_HOST_PTR(d));
 +            }
 +        }
 +
 +        d = g_new(TLBFlushPageByMMUIdxData, 1);
 +        d->addr = addr;
 +        d->idxmap = idxmap;
 +        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_2,
 +                              RUN_ON_CPU_HOST_PTR(d));
 +    }
- }
+     qemu_mutex_lock(&qemu_cpu_list_lock);
- void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr)
+     qatomic_set(&pending_cpus, 0);
 --
-.20.1
+.34.1

-[PULL 02/16] util/cacheinfo: fix crash when compiling with uClibc
+[PULL v2 5/8] linux-user/microblaze: Handle privileged exception
-From: Carlos Santos <casantos@redhat.com>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-uClibc defines _SC_LEVEL1_ICACHE_LINESIZE and _SC_LEVEL1_DCACHE_LINESIZE
+Follow what kernel's full_exception() is doing.
 but the corresponding sysconf calls returns -1, which is a valid result,
 meaning that the limit is indeterminate.
-Handle this situation using the fallback values instead of crashing due
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-to an assertion failure.
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
 Signed-off-by: Carlos Santos <casantos@redhat.com>
 Message-Id: <20191017123713.30192-1-casantos@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- util/cacheinfo.c | 10 ++++++++--
+ linux-user/microblaze/cpu_loop.c | 10 ++++++++--
 file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/util/cacheinfo.c b/util/cacheinfo.c
+diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/cacheinfo.c
+--- a/linux-user/microblaze/cpu_loop.c
-+++ b/util/cacheinfo.c
++++ b/linux-user/microblaze/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
+@@ -XXX,XX +XXX,XX @@
- static void sys_cache_info(int *isize, int *dsize)
  void cpu_loop(CPUMBState *env)
  {
- # ifdef _SC_LEVEL1_ICACHE_LINESIZE
++    int trapnr, ret, si_code, sig;
--    *isize = sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+     CPUState *cs = env_cpu(env);
-+    int tmp_isize = (int) sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+-    int trapnr, ret, si_code;
-+    if (tmp_isize > 0) {
-+        *isize = tmp_isize;
+     while (1) {
-+    }
+         cpu_exec_start(cs);
- # endif
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
- # ifdef _SC_LEVEL1_DCACHE_LINESIZE
+             env->iflags &= ~(IMM_FLAG | D_FLAG);
--    *dsize = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+             switch (env->esr & 31) {
-+    int tmp_dsize = (int) sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+             case ESR_EC_DIVZERO:
-+    if (tmp_dsize > 0) {
++                sig = TARGET_SIGFPE;
-+        *dsize = tmp_dsize;
+                 si_code = TARGET_FPE_INTDIV;
-+    }
+                 break;
- # endif
+             case ESR_EC_FPU:
- }
+@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
- #endif /* sys_cache_info */
+                  * if there's no recognized bit set.  Possibly this
                   * implies that si_code is 0, but follow the structure.
                   */
 +                sig = TARGET_SIGFPE;
                  si_code = env->fsr;
                  if (si_code & FSR_IO) {
                      si_code = TARGET_FPE_FLTINV;
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                      si_code = TARGET_FPE_FLTRES;
                  }
                  break;
 +            case ESR_EC_PRIVINSN:
 +                sig = SIGILL;
 +                si_code = ILL_PRVOPC;
 +                break;
              default:
                  fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
                          env->esr & ESR_EC_MASK);
                  cpu_dump_state(cs, stderr, 0);
                  exit(EXIT_FAILURE);
              }
 -            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
 +            force_sig_fault(sig, si_code, env->pc);
              break;
          case EXCP_DEBUG:
 --
-.20.1
+.34.1

-[PULL 03/16] vl: Remove unused variable in configure_accelerators
+Deleted patch
-The accel_initialised variable no longer has any setters.
-Fixes: 6f6e1698a68c
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
- {
-     const char *accel;
-     char **accel_list, **tmp;
--    bool accel_initialised = false;
-     bool init_failed = false;
-     qemu_opts_foreach(qemu_find_opts("icount"),
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-         accel_list = g_strsplit(accel, ":", 0);
--        for (tmp = accel_list; !accel_initialised && tmp && *tmp; tmp++) {
-+        for (tmp = accel_list; tmp && *tmp; tmp++) {
-             /*
-              * Filter invalid accelerators here, to prevent obscenities
-              * such as "-machine accel=tcg,,thread=single".
---
-.20.1

-[PULL 04/16] vl: Reduce scope of variables in configure_accelerators
+Deleted patch
-The accel_list and tmp variables are only used when manufacturing
--machine accel, options based on -accel.
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
- static void configure_accelerators(const char *progname)
- {
-     const char *accel;
--    char **accel_list, **tmp;
-     bool init_failed = false;
-     qemu_opts_foreach(qemu_find_opts("icount"),
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-     accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
-     if (QTAILQ_EMPTY(&qemu_accel_opts.head)) {
-+        char **accel_list, **tmp;
-+
-         if (accel == NULL) {
-             /* Select the default accelerator */
-             if (!accel_find("tcg") && !accel_find("kvm")) {
---
-.20.1

-[PULL 05/16] vl: Remove useless test in configure_accelerators
+Deleted patch
-The result of g_strsplit is never NULL.
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-         accel_list = g_strsplit(accel, ":", 0);
--        for (tmp = accel_list; tmp && *tmp; tmp++) {
-+        for (tmp = accel_list; *tmp; tmp++) {
-             /*
-              * Filter invalid accelerators here, to prevent obscenities
-              * such as "-machine accel=tcg,,thread=single".
---
-.20.1

-[PULL 06/16] vl: Only choose enabled accelerators in configure_accelerators
+Deleted patch
-By choosing "tcg:kvm" when kvm is not enabled, we generate
-an incorrect warning: "invalid accelerator kvm".
-At the same time, use g_str_has_suffix rather than open-coding
-the same operation.
-Presumably the inverse is also true with --disable-tcg.
-Fixes: 28a0961757fc
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- vl.c | 21 +++++++++++++--------
-file changed, 13 insertions(+), 8 deletions(-)
-diff --git a/vl.c b/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/vl.c
-+++ b/vl.c
-@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
-         if (accel == NULL) {
-             /* Select the default accelerator */
--            if (!accel_find("tcg") && !accel_find("kvm")) {
--                error_report("No accelerator selected and"
--                             " no default accelerator available");
--                exit(1);
--            } else {
--                int pnlen = strlen(progname);
--                if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
-+            bool have_tcg = accel_find("tcg");
-+            bool have_kvm = accel_find("kvm");
-+
-+            if (have_tcg && have_kvm) {
-+                if (g_str_has_suffix(progname, "kvm")) {
-                     /* If the program name ends with "kvm", we prefer KVM */
-                     accel = "kvm:tcg";
-                 } else {
-                     accel = "tcg:kvm";
-                 }
-+            } else if (have_kvm) {
-+                accel = "kvm";
-+            } else if (have_tcg) {
-+                accel = "tcg";
-+            } else {
-+                error_report("No accelerator selected and"
-+                             " no default accelerator available");
-+                exit(1);
-             }
-         }
--
-         accel_list = g_strsplit(accel, ":", 0);
-         for (tmp = accel_list; *tmp; tmp++) {
---
-.20.1

-[PULL 07/16] cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
+Deleted patch
-There is only one caller for tlb_table_flush_by_mmuidx.  Place
-the result at the earlier line number, due to an expected user
-in the near future.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 19 +++++++------------
-file changed, 7 insertions(+), 12 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-     }
- }
--static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
-+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
- {
-     tlb_mmu_resize_locked(env, mmu_idx);
--    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
-+    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-+    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-+    env_tlb(env)->d[mmu_idx].vindex = 0;
-+    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-+    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-+           sizeof(env_tlb(env)->d[0].vtable));
- }
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-@@ -XXX,XX +XXX,XX @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
-     *pelide = elide;
- }
--static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
--{
--    tlb_table_flush_by_mmuidx(env, mmu_idx);
--    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
--    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
--    env_tlb(env)->d[mmu_idx].vindex = 0;
--    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
--           sizeof(env_tlb(env)->d[0].vtable));
--}
--
- static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
- {
-     CPUArchState *env = cpu->env_ptr;
---
-.20.1

-[PULL 08/16] cputlb: Make tlb_n_entries private to cputlb.c
+[PULL v2 6/8] target/microblaze: Add gdbstub xml
-There are no users of this function outside cputlb.c,
+Mirroring the upstream gdb xml files, the two stack boundary
-and its interface will change in the next patch.
+registers are separated out.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu_ldst.h | 5 -----
+ target/microblaze/cpu.h                     |  2 +
- accel/tcg/cputlb.c      | 5 +++++
+ target/microblaze/cpu.c                     |  7 ++-
-files changed, 5 insertions(+), 5 deletions(-)
+ target/microblaze/gdbstub.c                 | 51 +++++++++++-----
  configs/targets/microblaze-linux-user.mak   |  1 +
  configs/targets/microblaze-softmmu.mak      |  1 +
  configs/targets/microblazeel-linux-user.mak |  1 +
  configs/targets/microblazeel-softmmu.mak    |  1 +
  gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
  gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 files changed, 128 insertions(+), 15 deletions(-)
  create mode 100644 gdb-xml/microblaze-core.xml
  create mode 100644 gdb-xml/microblaze-stack-protect.xml
-diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
+diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu_ldst.h
+--- a/target/microblaze/cpu.h
-+++ b/include/exec/cpu_ldst.h
++++ b/target/microblaze/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
+@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
-     return (addr >> TARGET_PAGE_BITS) & size_mask;
+                                         MemTxAttrs *attrs);
  int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 +int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
 +int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
  static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
  {
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "hw/qdev-properties.h"
  #include "exec/exec-all.h"
 +#include "exec/gdbstub.h"
  #include "fpu/softfloat-helpers.h"
  static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
      CPUMBState *env = &cpu->env;
      cpu_set_cpustate_pointers(cpu);
 +    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
 +                             mb_cpu_gdb_write_stack_protect, 2,
 +                             "microblaze-stack-protect.xml", 0);
      set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->sysemu_ops = &mb_sysemu_ops;
  #endif
      device_class_set_props(dc, mb_properties);
 -    cc->gdb_num_core_regs = 32 + 27;
 +    cc->gdb_num_core_regs = 32 + 25;
 +    cc->gdb_core_xml_file = "microblaze-core.xml";
      cc->disas_set_info = mb_disas_set_info;
      cc->tcg_ops = &mb_tcg_ops;
 diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/gdbstub.c
 +++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
      GDB_PVR0  = 32 + 6,
      GDB_PVR11 = 32 + 17,
      GDB_EDR   = 32 + 18,
 -    GDB_SLR   = 32 + 25,
 -    GDB_SHR   = 32 + 26,
 +};
 +
 +enum {
 +    GDB_SP_SHL,
 +    GDB_SP_SHR,
  };
  int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      case GDB_EDR:
          val = env->edr;
          break;
 -    case GDB_SLR:
 -        val = env->slr;
 -        break;
 -    case GDB_SHR:
 -        val = env->shr;
 -        break;
      default:
          /* Other SRegs aren't modeled, so report a value of 0 */
          val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
      return gdb_get_reg32(mem_buf, val);
  }
--static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
++int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
 -{
 -    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
 -}
 -
  /* Find the TLB entry corresponding to the mmu_idx + address pair.  */
  static inline CPUTLBEntry *tlb_entry(CPUArchState *env, uintptr_t mmu_idx,
                                       target_ulong addr)
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
  QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
  #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 +static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
 +{
-+    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
++    uint32_t val;
 +
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        val = env->slr;
 +        break;
 +    case GDB_SP_SHR:
 +        val = env->shr;
 +        break;
 +    default:
 +        return 0;
 +    }
 +    return gdb_get_reg32(mem_buf, val);
 +}
 +
- static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
+ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
  {
-     return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
+     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
      case GDB_EDR:
          env->edr = tmp;
          break;
 -    case GDB_SLR:
 -        env->slr = tmp;
 -        break;
 -    case GDB_SHR:
 -        env->shr = tmp;
 -        break;
 +    }
 +    return 4;
 +}
 +
 +int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
 +{
 +    switch (n) {
 +    case GDB_SP_SHL:
 +        env->slr = ldl_p(mem_buf);
 +        break;
 +    case GDB_SP_SHR:
 +        env->shr = ldl_p(mem_buf);
 +        break;
 +    default:
 +        return 0;
      }
      return 4;
  }
 diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblaze-linux-user.mak
 +++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
  TARGET_SYSTBL=syscall.tbl
  TARGET_BIG_ENDIAN=y
  TARGET_HAS_BFLT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblaze-softmmu.mak
 +++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
  TARGET_BIG_ENDIAN=y
  TARGET_SUPPORTS_MTTCG=y
  TARGET_NEED_FDT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblazeel-linux-user.mak
 +++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
  TARGET_SYSTBL_ABI=common
  TARGET_SYSTBL=syscall.tbl
  TARGET_HAS_BFLT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/microblazeel-softmmu.mak
 +++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=microblaze
  TARGET_SUPPORTS_MTTCG=y
  TARGET_NEED_FDT=y
 +TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
 diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/gdb-xml/microblaze-core.xml
@@ -XXX,XX +XXX,XX @@
 +<?xml version="1.0"?>
 +<!-- Copyright (C) 2008 Free Software Foundation, Inc.
 +
 +     Copying and distribution of this file, with or without modification,
 +     are permitted in any medium without royalty provided the copyright
 +     notice and this notice are preserved.  -->
 +
 +<!DOCTYPE feature SYSTEM "gdb-target.dtd">
 +<feature name="org.gnu.gdb.microblaze.core">
 +  <reg name="r0" bitsize="32" regnum="0"/>
 +  <reg name="r1" bitsize="32" type="data_ptr"/>
 +  <reg name="r2" bitsize="32"/>
 +  <reg name="r3" bitsize="32"/>
 +  <reg name="r4" bitsize="32"/>
 +  <reg name="r5" bitsize="32"/>
 +  <reg name="r6" bitsize="32"/>
 +  <reg name="r7" bitsize="32"/>
 +  <reg name="r8" bitsize="32"/>
 +  <reg name="r9" bitsize="32"/>
 +  <reg name="r10" bitsize="32"/>
 +  <reg name="r11" bitsize="32"/>
 +  <reg name="r12" bitsize="32"/>
 +  <reg name="r13" bitsize="32"/>
 +  <reg name="r14" bitsize="32"/>
 +  <reg name="r15" bitsize="32"/>
 +  <reg name="r16" bitsize="32"/>
 +  <reg name="r17" bitsize="32"/>
 +  <reg name="r18" bitsize="32"/>
 +  <reg name="r19" bitsize="32"/>
 +  <reg name="r20" bitsize="32"/>
 +  <reg name="r21" bitsize="32"/>
 +  <reg name="r22" bitsize="32"/>
 +  <reg name="r23" bitsize="32"/>
 +  <reg name="r24" bitsize="32"/>
 +  <reg name="r25" bitsize="32"/>
 +  <reg name="r26" bitsize="32"/>
 +  <reg name="r27" bitsize="32"/>
 +  <reg name="r28" bitsize="32"/>
 +  <reg name="r29" bitsize="32"/>
 +  <reg name="r30" bitsize="32"/>
 +  <reg name="r31" bitsize="32"/>
 +  <reg name="rpc" bitsize="32" type="code_ptr"/>
 +  <reg name="rmsr" bitsize="32"/>
 +  <reg name="rear" bitsize="32"/>
 +  <reg name="resr" bitsize="32"/>
 +  <reg name="rfsr" bitsize="32"/>
 +  <reg name="rbtr" bitsize="32"/>
 +  <reg name="rpvr0" bitsize="32"/>
 +  <reg name="rpvr1" bitsize="32"/>
 +  <reg name="rpvr2" bitsize="32"/>
 +  <reg name="rpvr3" bitsize="32"/>
 +  <reg name="rpvr4" bitsize="32"/>
 +  <reg name="rpvr5" bitsize="32"/>
 +  <reg name="rpvr6" bitsize="32"/>
 +  <reg name="rpvr7" bitsize="32"/>
 +  <reg name="rpvr8" bitsize="32"/>
 +  <reg name="rpvr9" bitsize="32"/>
 +  <reg name="rpvr10" bitsize="32"/>
 +  <reg name="rpvr11" bitsize="32"/>
 +  <reg name="redr" bitsize="32"/>
 +  <reg name="rpid" bitsize="32"/>
 +  <reg name="rzpr" bitsize="32"/>
 +  <reg name="rtlbx" bitsize="32"/>
 +  <reg name="rtlbsx" bitsize="32"/>
 +  <reg name="rtlblo" bitsize="32"/>
 +  <reg name="rtlbhi" bitsize="32"/>
 +</feature>
 diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/gdb-xml/microblaze-stack-protect.xml
@@ -XXX,XX +XXX,XX @@
 +<?xml version="1.0"?>
 +<!-- Copyright (C) 2008 Free Software Foundation, Inc.
 +
 +     Copying and distribution of this file, with or without modification,
 +     are permitted in any medium without royalty provided the copyright
 +     notice and this notice are preserved.  -->
 +
 +<!DOCTYPE feature SYSTEM "gdb-target.dtd">
 +<feature name="org.gnu.gdb.microblaze.stack-protect">
 +  <reg name="rslr" bitsize="32"/>
 +  <reg name="rshr" bitsize="32"/>
 +</feature>
 --
-.20.1
+.34.1

-[PULL 09/16] cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
+Deleted patch
-We do not need the entire CPUArchState to compute these values.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 15 ++++++++-------
-file changed, 8 insertions(+), 7 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
- QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
- #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
--static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
-+static inline size_t tlb_n_entries(CPUTLBDescFast *fast)
- {
--    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
-+    return (fast->mask >> CPU_TLB_ENTRY_BITS) + 1;
- }
--static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
-+static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
- {
--    return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
-+    return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
- }
- static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
- static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
- {
-     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
--    size_t old_size = tlb_n_entries(env, mmu_idx);
-+    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
-     size_t rate;
-     size_t new_size = old_size;
-     int64_t now = get_clock_realtime();
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
-     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-     env_tlb(env)->d[mmu_idx].vindex = 0;
--    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
-+    memset(env_tlb(env)->f[mmu_idx].table, -1,
-+           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
-     memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-            sizeof(env_tlb(env)->d[0].vtable));
- }
-@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
-     qemu_spin_lock(&env_tlb(env)->c.lock);
-     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-         unsigned int i;
--        unsigned int n = tlb_n_entries(env, mmu_idx);
-+        unsigned int n = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
-         for (i = 0; i < n; i++) {
-             tlb_reset_dirty_range_locked(&env_tlb(env)->f[mmu_idx].table[i],
---
-.20.1

-[PULL 10/16] cputlb: Hoist tlb portions in tlb_mmu_resize_locked
+Deleted patch
-No functional change, but the smaller expressions make
-the code easier to read.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 35 +++++++++++++++++------------------
-file changed, 17 insertions(+), 18 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
- /**
-  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
-- * @env: CPU that owns the TLB
-- * @mmu_idx: MMU index of the TLB
-+ * @desc: The CPUTLBDesc portion of the TLB
-+ * @fast: The CPUTLBDescFast portion of the same TLB
-  *
-  * Called with tlb_lock_held.
-  *
-@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
-  * high), since otherwise we are likely to have a significant amount of
-  * conflict misses.
-  */
--static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
- {
--    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
--    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
-+    size_t old_size = tlb_n_entries(fast);
-     size_t rate;
-     size_t new_size = old_size;
-     int64_t now = get_clock_realtime();
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-         return;
-     }
--    g_free(env_tlb(env)->f[mmu_idx].table);
--    g_free(env_tlb(env)->d[mmu_idx].iotlb);
-+    g_free(fast->table);
-+    g_free(desc->iotlb);
-     tlb_window_reset(desc, now, 0);
-     /* desc->n_used_entries is cleared by the caller */
--    env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
--    env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
--    env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
-+    fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-+    fast->table = g_try_new(CPUTLBEntry, new_size);
-+    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
-+
-     /*
-      * If the allocations fail, try smaller sizes. We just freed some
-      * memory, so going back to half of new_size has a good chance of working.
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-      * allocations to fail though, so we progressively reduce the allocation
-      * size, aborting if we cannot even allocate the smallest TLB we support.
-      */
--    while (env_tlb(env)->f[mmu_idx].table == NULL ||
--           env_tlb(env)->d[mmu_idx].iotlb == NULL) {
-+    while (fast->table == NULL || desc->iotlb == NULL) {
-         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
-             error_report("%s: %s", __func__, strerror(errno));
-             abort();
-         }
-         new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
--        env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-+        fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
--        g_free(env_tlb(env)->f[mmu_idx].table);
--        g_free(env_tlb(env)->d[mmu_idx].iotlb);
--        env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
--        env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
-+        g_free(fast->table);
-+        g_free(desc->iotlb);
-+        fast->table = g_try_new(CPUTLBEntry, new_size);
-+        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
-     }
- }
- static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
- {
--    tlb_mmu_resize_locked(env, mmu_idx);
-+    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
-     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
-     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
---
-.20.1

-[PULL 11/16] cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
+Deleted patch
-No functional change, but the smaller expressions make
-the code easier to read.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cputlb.c | 19 ++++++++++---------
-file changed, 10 insertions(+), 9 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
- static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
- {
--    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
--    env_tlb(env)->d[mmu_idx].n_used_entries = 0;
--    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
--    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
--    env_tlb(env)->d[mmu_idx].vindex = 0;
--    memset(env_tlb(env)->f[mmu_idx].table, -1,
--           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
--    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
--           sizeof(env_tlb(env)->d[0].vtable));
-+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
-+
-+    tlb_mmu_resize_locked(desc, fast);
-+    desc->n_used_entries = 0;
-+    desc->large_page_addr = -1;
-+    desc->large_page_mask = -1;
-+    desc->vindex = 0;
-+    memset(fast->table, -1, sizeof_tlb(fast));
-+    memset(desc->vtable, -1, sizeof(desc->vtable));
- }
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
---
-.20.1

-[PULL 13/16] cputlb: Partially merge tlb_dyn_init into tlb_init
+[PULL v2 7/8] util/cacheflush: fix cache on windows-arm64
-Merge into the only caller, but at the same time split
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 out tlb_mmu_init to initialize a single tlb entry.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+ctr_el0 access is privileged on this platform and fails as an illegal
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+instruction.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Windows does not offer a way to flush data cache from userspace, and
 only FlushInstructionCache is available in Windows API.
 The generic implementation of flush_idcache_range uses,
 __builtin___clear_cache, which already use the FlushInstructionCache
 function. So we rely on that.
 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 33 ++++++++++++++++-----------------
+ util/cacheflush.c | 14 +++++++++++---
-file changed, 16 insertions(+), 17 deletions(-)
+file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/util/cacheflush.c b/util/cacheflush.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/util/cacheflush.c
-+++ b/accel/tcg/cputlb.c
++++ b/util/cacheflush.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
+@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
-     desc->window_max_entries = max_entries;
+ static bool have_coherent_icache;
- }
+ #endif
--static void tlb_dyn_init(CPUArchState *env)
+-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
--{
+-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
--    int i;
++#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
--
++/*
--    for (i = 0; i < NB_MMU_MODES; i++) {
++ * Apple does not expose CTR_EL0, so we must use system interfaces.
--        CPUTLBDesc *desc = &env_tlb(env)->d[i];
++ * Windows neither, but we use a generic implementation of flush_idcache_range
--        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
++ * in this case.
--
++ */
--        tlb_window_reset(desc, get_clock_realtime(), 0);
+ static uint64_t save_ctr_el0;
--        desc->n_used_entries = 0;
+ static void arch_cache_info(int *isize, int *dsize)
 -        env_tlb(env)->f[i].mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
 -        env_tlb(env)->f[i].table = g_new(CPUTLBEntry, n_entries);
 -        env_tlb(env)->d[i].iotlb = g_new(CPUIOTLBEntry, n_entries);
 -    }
 -}
 -
  /**
   * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
   * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
      tlb_mmu_flush_locked(desc, fast);
  }
 +static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
 +{
 +    size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
 +
 +    tlb_window_reset(desc, now, 0);
 +    desc->n_used_entries = 0;
 +    fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
 +    fast->table = g_new(CPUTLBEntry, n_entries);
 +    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
 +}
 +
  static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
  {
-     env_tlb(env)->d[mmu_idx].n_used_entries++;
+@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
-@@ -XXX,XX +XXX,XX @@ static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
- void tlb_init(CPUState *cpu)
+ /* Caches are coherent and do not require flushing; symbol inline. */
- {
-     CPUArchState *env = cpu->env_ptr;
+-#elif defined(__aarch64__)
-+    int64_t now = get_clock_realtime();
++#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
-+    int i;
++/*
++ * For Windows, we use generic implementation of flush_idcache_range, that
-     qemu_spin_init(&env_tlb(env)->c.lock);
++ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
++ */
-     /* Ensure that cpu_reset performs a full flush.  */
-     env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
+ #ifdef CONFIG_DARWIN
+ /* Apple does not expose CTR_EL0, so we must use system interfaces. */
 -    tlb_dyn_init(env);
 +    for (i = 0; i < NB_MMU_MODES; i++) {
 +        tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
 +    }
  }
  /* flush_all_helper: run fn across all cpus
 --
-.20.1
+.34.1

-[PULL 12/16] cputlb: Split out tlb_mmu_flush_locked
+[PULL v2 8/8] sysemu/os-win32: fix setjmp/longjmp on windows-arm64
-We will want to be able to flush a tlb without resizing.
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Windows implementation of setjmp/longjmp is done in
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+perform stack unwinding, which crashes from generated code.
 By using alternative implementation built in mingw, we avoid doing stack
 unwinding and this fixes crash when calling longjmp.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cputlb.c | 15 ++++++++++-----
+ include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
-file changed, 10 insertions(+), 5 deletions(-)
+ meson.build               | 21 +++++++++++++++++++++
 files changed, 45 insertions(+), 4 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/include/sysemu/os-win32.h
-+++ b/accel/tcg/cputlb.c
++++ b/include/sysemu/os-win32.h
-@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
-     }
+ extern "C" {
- }
+ #endif
--static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+-#if defined(_WIN64)
-+static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
- {
++#if defined(__aarch64__)
--    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
++/*
--    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
++ * On windows-arm64, setjmp is available in only one variant, and longjmp always
--
++ * does stack unwinding. This crash with generated code.
--    tlb_mmu_resize_locked(desc, fast);
++ * Thus, we use another implementation of setjmp (not windows one), coming from
-     desc->n_used_entries = 0;
++ * mingw, which never performs stack unwinding.
-     desc->large_page_addr = -1;
++ */
-     desc->large_page_mask = -1;
++#undef setjmp
-@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++#undef longjmp
-     memset(desc->vtable, -1, sizeof(desc->vtable));
++/*
- }
++ * These functions are not declared in setjmp.h because __aarch64__ defines
++ * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
-+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
++ * which gets linked automatically.
-+{
++ */
-+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
++extern int __mingw_setjmp(jmp_buf);
-+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
++extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
 +#define setjmp(env) __mingw_setjmp(env)
 +#define longjmp(env, val) __mingw_longjmp(env, val)
 +#elif defined(_WIN64)
 +/*
 + * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
   * If this parameter is NULL, longjump does no stack unwinding.
   * That is what we need for QEMU. Passing the value of register rsp (default)
 - * lets longjmp try a stack unwinding which will crash with generated code. */
 + * lets longjmp try a stack unwinding which will crash with generated code.
 + */
  # undef setjmp
  # define setjmp(env) _setjmp(env, NULL)
 -#endif
 +#endif /* __aarch64__ */
  /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
   * "longjmp and don't touch the signal masks". Since we know that the
   * savemask parameter will always be zero we can safely define these
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
      }''', name: '_lock_file and _unlock_file'))
  endif
 +if targetos == 'windows'
 +  mingw_has_setjmp_longjmp = cc.links('''
 +    #include <setjmp.h>
 +    int main(void) {
 +      /*
 +       * These functions are not available in setjmp header, but may be
 +       * available at link time, from libmingwex.a.
 +       */
 +      extern int __mingw_setjmp(jmp_buf);
 +      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
 +      jmp_buf env;
 +      __mingw_setjmp(env);
 +      __mingw_longjmp(env, 0);
 +    }
 +  ''', name: 'mingw setjmp and longjmp')
 +
-+    tlb_mmu_resize_locked(desc, fast);
++  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
-+    tlb_mmu_flush_locked(desc, fast);
++    error('mingw must provide setjmp/longjmp for windows-arm64')
-+}
++  endif
 +endif
 +
- static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
+ ########################
- {
+ # Target configuration #
-     env_tlb(env)->d[mmu_idx].n_used_entries++;
+ ########################
 --
-.20.1
+.34.1

The following changes since commit 3e08b2b9cb64bff2b73fa9128c0e49bfcde0dd40:

Merge remote-tracking branch 'remotes/philmd-gitlab/tags/edk2-next-20200121' into staging (2020-01-21 15:29:25 +0000)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20200121

for you to fetch changes up to 75fa376cdab5e5db2c7fdd107358e16f95503ac6:

scripts/git.orderfile: Display decodetree before C source (2020-01-21 15:26:09 -1000)

----------------------------------------------------------------
Remove another limit to NB_MMU_MODES.
Fix compilation using uclibc.
Fix defaulting of -accel parameters.
Tidy cputlb basic routines.
Adjust git.orderfile for decodetree.

----------------------------------------------------------------
Carlos Santos (1):
      util/cacheinfo: fix crash when compiling with uClibc

Philippe Mathieu-Daudé (1):
      scripts/git.orderfile: Display decodetree before C source

Richard Henderson (14):
      cputlb: Handle NB_MMU_MODES > TARGET_PAGE_BITS_MIN
      vl: Remove unused variable in configure_accelerators
      vl: Reduce scope of variables in configure_accelerators
      vl: Remove useless test in configure_accelerators
      vl: Only choose enabled accelerators in configure_accelerators
      cputlb: Merge tlb_table_flush_by_mmuidx into tlb_flush_one_mmuidx_locked
      cputlb: Make tlb_n_entries private to cputlb.c
      cputlb: Pass CPUTLBDescFast to tlb_n_entries and sizeof_tlb
      cputlb: Hoist tlb portions in tlb_mmu_resize_locked
      cputlb: Hoist tlb portions in tlb_flush_one_mmuidx_locked
      cputlb: Split out tlb_mmu_flush_locked
      cputlb: Partially merge tlb_dyn_init into tlb_init
      cputlb: Initialize tlbs as flushed
      cputlb: Hoist timestamp outside of loops over tlbs

In target/arm we will shortly have "too many" mmu_idx.
The current minimum barrier is caused by the way in which
tlb_flush_page_by_mmuidx is coded.

We can remove this limitation by allocating memory for
consumption by the worker.  Let us assume that this is
the unlikely case, as will be the case for the majority
of targets which have so far satisfied the BUILD_BUG_ON,
and only allocate memory when necessary.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 167 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 132 insertions(+), 35 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
     }
 }
 
-/* As we are going to hijack the bottom bits of the page address for a
- * mmuidx bit mask we need to fail to build if we can't do that
+/**
+ * tlb_flush_page_by_mmuidx_async_0:
+ * @cpu: cpu on which to flush
+ * @addr: page of virtual address to flush
+ * @idxmap: set of mmu_idx to flush
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, flush one page
+ * at @addr from the tlbs indicated by @idxmap from @cpu.
  */
-QEMU_BUILD_BUG_ON(NB_MMU_MODES > TARGET_PAGE_BITS_MIN);
-
-static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
-                                                run_on_cpu_data data)
+static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
+                                             target_ulong addr,
+                                             uint16_t idxmap)
 {
     CPUArchState *env = cpu->env_ptr;
-    target_ulong addr_and_mmuidx = (target_ulong) data.target_ptr;
-    target_ulong addr = addr_and_mmuidx & TARGET_PAGE_MASK;
-    unsigned long mmu_idx_bitmap = addr_and_mmuidx & ALL_MMUIDX_BITS;
     int mmu_idx;
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%lx\n",
-              addr, mmu_idx_bitmap);
+    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%x\n", addr, idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        if (test_bit(mmu_idx, &mmu_idx_bitmap)) {
+        if ((idxmap >> mmu_idx) & 1) {
             tlb_flush_page_locked(env, mmu_idx, addr);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_work(CPUState *cpu,
     tb_flush_jmp_cache(cpu, addr);
 }
 
+/**
+ * tlb_flush_page_by_mmuidx_async_1:
+ * @cpu: cpu on which to flush
+ * @data: encoded addr + idxmap
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, called through
+ * async_run_on_cpu.  The idxmap parameter is encoded in the page
+ * offset of the target_ptr field.  This limits the set of mmu_idx
+ * that can be passed via this method.
+ */
+static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
+                                             run_on_cpu_data data)
+{
+    target_ulong addr_and_idxmap = (target_ulong) data.target_ptr;
+    target_ulong addr = addr_and_idxmap & TARGET_PAGE_MASK;
+    uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
+
+    tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
+}
+
+typedef struct {
+    target_ulong addr;
+    uint16_t idxmap;
+} TLBFlushPageByMMUIdxData;
+
+/**
+ * tlb_flush_page_by_mmuidx_async_2:
+ * @cpu: cpu on which to flush
+ * @data: allocated addr + idxmap
+ *
+ * Helper for tlb_flush_page_by_mmuidx and friends, called through
+ * async_run_on_cpu.  The addr+idxmap parameters are stored in a
+ * TLBFlushPageByMMUIdxData structure that has been allocated
+ * specifically for this helper.  Free the structure when done.
+ */
+static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
+                                             run_on_cpu_data data)
+{
+    TLBFlushPageByMMUIdxData *d = data.host_ptr;
+
+    tlb_flush_page_by_mmuidx_async_0(cpu, d->addr, d->idxmap);
+    g_free(d);
+}
+
 void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
 {
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%" PRIx16 "\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    if (!qemu_cpu_is_self(cpu)) {
-        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_work,
-                         RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    if (qemu_cpu_is_self(cpu)) {
+        tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
+    } else if (idxmap < TARGET_PAGE_SIZE) {
+        /*
+         * Most targets have only a few mmu_idx.  In the case where
+         * we can stuff idxmap into the low TARGET_PAGE_BITS, avoid
+         * allocating memory for this operation.
+         */
+        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
     } else {
-        tlb_flush_page_by_mmuidx_async_work(
-            cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+        TLBFlushPageByMMUIdxData *d = g_new(TLBFlushPageByMMUIdxData, 1);
+
+        /* Otherwise allocate a structure, freed by the worker.  */
+        d->addr = addr;
+        d->idxmap = idxmap;
+        async_run_on_cpu(cpu, tlb_flush_page_by_mmuidx_async_2,
+                         RUN_ON_CPU_HOST_PTR(d));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page(CPUState *cpu, target_ulong addr)
 void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
                                        uint16_t idxmap)
 {
-    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
-    fn(src_cpu, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    /*
+     * Allocate memory to hold addr+idxmap only when needed.
+     * See tlb_flush_page_by_mmuidx for details.
+     */
+    if (idxmap < TARGET_PAGE_SIZE) {
+        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+    } else {
+        CPUState *dst_cpu;
+
+        /* Allocate a separate data block for each destination cpu.  */
+        CPU_FOREACH(dst_cpu) {
+            if (dst_cpu != src_cpu) {
+                TLBFlushPageByMMUIdxData *d
+                    = g_new(TLBFlushPageByMMUIdxData, 1);
+
+                d->addr = addr;
+                d->idxmap = idxmap;
+                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
+                                 RUN_ON_CPU_HOST_PTR(d));
+            }
+        }
+    }
+
+    tlb_flush_page_by_mmuidx_async_0(src_cpu, addr, idxmap);
 }
 
 void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                               target_ulong addr,
                                               uint16_t idxmap)
 {
-    const run_on_cpu_func fn = tlb_flush_page_by_mmuidx_async_work;
-    target_ulong addr_and_mmu_idx;
-
     tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
-    addr_and_mmu_idx = addr & TARGET_PAGE_MASK;
-    addr_and_mmu_idx |= idxmap;
+    addr &= TARGET_PAGE_MASK;
 
-    flush_all_helper(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
-    async_safe_run_on_cpu(src_cpu, fn, RUN_ON_CPU_TARGET_PTR(addr_and_mmu_idx));
+    /*
+     * Allocate memory to hold addr+idxmap only when needed.
+     * See tlb_flush_page_by_mmuidx for details.
+     */
+    if (idxmap < TARGET_PAGE_SIZE) {
+        flush_all_helper(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                         RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_1,
+                              RUN_ON_CPU_TARGET_PTR(addr | idxmap));
+    } else {
+        CPUState *dst_cpu;
+        TLBFlushPageByMMUIdxData *d;
+
+        /* Allocate a separate data block for each destination cpu.  */
+        CPU_FOREACH(dst_cpu) {
+            if (dst_cpu != src_cpu) {
+                d = g_new(TLBFlushPageByMMUIdxData, 1);
+                d->addr = addr;
+                d->idxmap = idxmap;
+                async_run_on_cpu(dst_cpu, tlb_flush_page_by_mmuidx_async_2,
+                                 RUN_ON_CPU_HOST_PTR(d));
+            }
+        }
+
+        d = g_new(TLBFlushPageByMMUIdxData, 1);
+        d->addr = addr;
+        d->idxmap = idxmap;
+        async_safe_run_on_cpu(src_cpu, tlb_flush_page_by_mmuidx_async_2,
+                              RUN_ON_CPU_HOST_PTR(d));
+    }
 }
 
 void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr)
-- 
2.20.1

From: Carlos Santos <casantos@redhat.com>

uClibc defines _SC_LEVEL1_ICACHE_LINESIZE and _SC_LEVEL1_DCACHE_LINESIZE
but the corresponding sysconf calls returns -1, which is a valid result,
meaning that the limit is indeterminate.

Handle this situation using the fallback values instead of crashing due
to an assertion failure.

Signed-off-by: Carlos Santos <casantos@redhat.com>
Message-Id: <20191017123713.30192-1-casantos@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/cacheinfo.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/util/cacheinfo.c b/util/cacheinfo.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheinfo.c
+++ b/util/cacheinfo.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static void sys_cache_info(int *isize, int *dsize)
 {
 # ifdef _SC_LEVEL1_ICACHE_LINESIZE
-    *isize = sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+    int tmp_isize = (int) sysconf(_SC_LEVEL1_ICACHE_LINESIZE);
+    if (tmp_isize > 0) {
+        *isize = tmp_isize;
+    }
 # endif
 # ifdef _SC_LEVEL1_DCACHE_LINESIZE
-    *dsize = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+    int tmp_dsize = (int) sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+    if (tmp_dsize > 0) {
+        *dsize = tmp_dsize;
+    }
 # endif
 }
 #endif /* sys_cache_info */
-- 
2.20.1

The accel_initialised variable no longer has any setters.

Fixes: 6f6e1698a68c
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 {
     const char *accel;
     char **accel_list, **tmp;
-    bool accel_initialised = false;
     bool init_failed = false;
 
     qemu_opts_foreach(qemu_find_opts("icount"),
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
         accel_list = g_strsplit(accel, ":", 0);
 
-        for (tmp = accel_list; !accel_initialised && tmp && *tmp; tmp++) {
+        for (tmp = accel_list; tmp && *tmp; tmp++) {
             /*
              * Filter invalid accelerators here, to prevent obscenities
              * such as "-machine accel=tcg,,thread=single".
-- 
2.20.1

The accel_list and tmp variables are only used when manufacturing
-machine accel, options based on -accel.

Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
 static void configure_accelerators(const char *progname)
 {
     const char *accel;
-    char **accel_list, **tmp;
     bool init_failed = false;
 
     qemu_opts_foreach(qemu_find_opts("icount"),
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
     accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
     if (QTAILQ_EMPTY(&qemu_accel_opts.head)) {
+        char **accel_list, **tmp;
+
         if (accel == NULL) {
             /* Select the default accelerator */
             if (!accel_find("tcg") && !accel_find("kvm")) {
-- 
2.20.1

By choosing "tcg:kvm" when kvm is not enabled, we generate
an incorrect warning: "invalid accelerator kvm".

At the same time, use g_str_has_suffix rather than open-coding
the same operation.

Presumably the inverse is also true with --disable-tcg.

Fixes: 28a0961757fc
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 vl.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
 
         if (accel == NULL) {
             /* Select the default accelerator */
-            if (!accel_find("tcg") && !accel_find("kvm")) {
-                error_report("No accelerator selected and"
-                             " no default accelerator available");
-                exit(1);
-            } else {
-                int pnlen = strlen(progname);
-                if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
+            bool have_tcg = accel_find("tcg");
+            bool have_kvm = accel_find("kvm");
+
+            if (have_tcg && have_kvm) {
+                if (g_str_has_suffix(progname, "kvm")) {
                     /* If the program name ends with "kvm", we prefer KVM */
                     accel = "kvm:tcg";
                 } else {
                     accel = "tcg:kvm";
                 }
+            } else if (have_kvm) {
+                accel = "kvm";
+            } else if (have_tcg) {
+                accel = "tcg";
+            } else {
+                error_report("No accelerator selected and"
+                             " no default accelerator available");
+                exit(1);
             }
         }
-
         accel_list = g_strsplit(accel, ":", 0);
 
         for (tmp = accel_list; *tmp; tmp++) {
-- 
2.20.1

There is only one caller for tlb_table_flush_by_mmuidx.  Place
the result at the earlier line number, due to an expected user
in the near future.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
     }
 }
 
-static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
     tlb_mmu_resize_locked(env, mmu_idx);
-    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
+    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
+    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
+    env_tlb(env)->d[mmu_idx].vindex = 0;
+    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
+    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
+           sizeof(env_tlb(env)->d[0].vtable));
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
@@ -XXX,XX +XXX,XX @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
-{
-    tlb_table_flush_by_mmuidx(env, mmu_idx);
-    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-    env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-           sizeof(env_tlb(env)->d[0].vtable));
-}
-
 static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 {
     CPUArchState *env = cpu->env_ptr;
-- 
2.20.1

There are no users of this function outside cputlb.c,
and its interface will change in the next patch.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu_ldst.h | 5 -----
 accel/tcg/cputlb.c      | 5 +++++
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -XXX,XX +XXX,XX @@ static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
     return (addr >> TARGET_PAGE_BITS) & size_mask;
 }
 
-static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
-{
-    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
-}
-
 /* Find the TLB entry corresponding to the mmu_idx + address pair.  */
 static inline CPUTLBEntry *tlb_entry(CPUArchState *env, uintptr_t mmu_idx,
                                      target_ulong addr)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
+static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
+{
+    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
+}
+
 static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
 {
     return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
-- 
2.20.1

We do not need the entire CPUArchState to compute these values.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
-static inline size_t tlb_n_entries(CPUArchState *env, uintptr_t mmu_idx)
+static inline size_t tlb_n_entries(CPUTLBDescFast *fast)
 {
-    return (env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS) + 1;
+    return (fast->mask >> CPU_TLB_ENTRY_BITS) + 1;
 }
 
-static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
+static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
 {
-    return env_tlb(env)->f[mmu_idx].mask + (1 << CPU_TLB_ENTRY_BITS);
+    return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
 }
 
 static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
 static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
 {
     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    size_t old_size = tlb_n_entries(env, mmu_idx);
+    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
     size_t rate;
     size_t new_size = old_size;
     int64_t now = get_clock_realtime();
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
     env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->f[mmu_idx].table, -1, sizeof_tlb(env, mmu_idx));
+    memset(env_tlb(env)->f[mmu_idx].table, -1,
+           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
     memset(env_tlb(env)->d[mmu_idx].vtable, -1,
            sizeof(env_tlb(env)->d[0].vtable));
 }
@@ -XXX,XX +XXX,XX @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         unsigned int i;
-        unsigned int n = tlb_n_entries(env, mmu_idx);
+        unsigned int n = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
 
         for (i = 0; i < n; i++) {
             tlb_reset_dirty_range_locked(&env_tlb(env)->f[mmu_idx].table[i],
-- 
2.20.1

No functional change, but the smaller expressions make
the code easier to read.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
 
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
- * @env: CPU that owns the TLB
- * @mmu_idx: MMU index of the TLB
+ * @desc: The CPUTLBDesc portion of the TLB
+ * @fast: The CPUTLBDescFast portion of the same TLB
  *
  * Called with tlb_lock_held.
  *
@@ -XXX,XX +XXX,XX @@ static void tlb_dyn_init(CPUArchState *env)
  * high), since otherwise we are likely to have a significant amount of
  * conflict misses.
  */
-static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 {
-    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    size_t old_size = tlb_n_entries(&env_tlb(env)->f[mmu_idx]);
+    size_t old_size = tlb_n_entries(fast);
     size_t rate;
     size_t new_size = old_size;
     int64_t now = get_clock_realtime();
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
         return;
     }
 
-    g_free(env_tlb(env)->f[mmu_idx].table);
-    g_free(env_tlb(env)->d[mmu_idx].iotlb);
+    g_free(fast->table);
+    g_free(desc->iotlb);
 
     tlb_window_reset(desc, now, 0);
     /* desc->n_used_entries is cleared by the caller */
-    env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-    env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
-    env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
+    fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+    fast->table = g_try_new(CPUTLBEntry, new_size);
+    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+
     /*
      * If the allocations fail, try smaller sizes. We just freed some
      * memory, so going back to half of new_size has a good chance of working.
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
      * allocations to fail though, so we progressively reduce the allocation
      * size, aborting if we cannot even allocate the smallest TLB we support.
      */
-    while (env_tlb(env)->f[mmu_idx].table == NULL ||
-           env_tlb(env)->d[mmu_idx].iotlb == NULL) {
+    while (fast->table == NULL || desc->iotlb == NULL) {
         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
             error_report("%s: %s", __func__, strerror(errno));
             abort();
         }
         new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
-        env_tlb(env)->f[mmu_idx].mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
+        fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
 
-        g_free(env_tlb(env)->f[mmu_idx].table);
-        g_free(env_tlb(env)->d[mmu_idx].iotlb);
-        env_tlb(env)->f[mmu_idx].table = g_try_new(CPUTLBEntry, new_size);
-        env_tlb(env)->d[mmu_idx].iotlb = g_try_new(CPUIOTLBEntry, new_size);
+        g_free(fast->table);
+        g_free(desc->iotlb);
+        fast->table = g_try_new(CPUTLBEntry, new_size);
+        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
     }
 }
 
 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_mmu_resize_locked(env, mmu_idx);
+    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
     env_tlb(env)->d[mmu_idx].n_used_entries = 0;
     env_tlb(env)->d[mmu_idx].large_page_addr = -1;
     env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-- 
2.20.1

No functional change, but the smaller expressions make
the code easier to read.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 
 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_mmu_resize_locked(&env_tlb(env)->d[mmu_idx], &env_tlb(env)->f[mmu_idx]);
-    env_tlb(env)->d[mmu_idx].n_used_entries = 0;
-    env_tlb(env)->d[mmu_idx].large_page_addr = -1;
-    env_tlb(env)->d[mmu_idx].large_page_mask = -1;
-    env_tlb(env)->d[mmu_idx].vindex = 0;
-    memset(env_tlb(env)->f[mmu_idx].table, -1,
-           sizeof_tlb(&env_tlb(env)->f[mmu_idx]));
-    memset(env_tlb(env)->d[mmu_idx].vtable, -1,
-           sizeof(env_tlb(env)->d[0].vtable));
+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+
+    tlb_mmu_resize_locked(desc, fast);
+    desc->n_used_entries = 0;
+    desc->large_page_addr = -1;
+    desc->large_page_mask = -1;
+    desc->vindex = 0;
+    memset(fast->table, -1, sizeof_tlb(fast));
+    memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-- 
2.20.1

We will want to be able to flush a tlb without resizing.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
     }
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
 {
-    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
-    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
-
-    tlb_mmu_resize_locked(desc, fast);
     desc->n_used_entries = 0;
     desc->large_page_addr = -1;
     desc->large_page_mask = -1;
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+{
+    CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
+    CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
+
+    tlb_mmu_resize_locked(desc, fast);
+    tlb_mmu_flush_locked(desc, fast);
+}
+
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
 {
     env_tlb(env)->d[mmu_idx].n_used_entries++;
-- 
2.20.1

Merge into the only caller, but at the same time split
out tlb_mmu_init to initialize a single tlb entry.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
     desc->window_max_entries = max_entries;
 }
 
-static void tlb_dyn_init(CPUArchState *env)
-{
-    int i;
-
-    for (i = 0; i < NB_MMU_MODES; i++) {
-        CPUTLBDesc *desc = &env_tlb(env)->d[i];
-        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
-
-        tlb_window_reset(desc, get_clock_realtime(), 0);
-        desc->n_used_entries = 0;
-        env_tlb(env)->f[i].mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
-        env_tlb(env)->f[i].table = g_new(CPUTLBEntry, n_entries);
-        env_tlb(env)->d[i].iotlb = g_new(CPUIOTLBEntry, n_entries);
-    }
-}
-
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
  * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
     tlb_mmu_flush_locked(desc, fast);
 }
 
+static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
+{
+    size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
+
+    tlb_window_reset(desc, now, 0);
+    desc->n_used_entries = 0;
+    fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
+    fast->table = g_new(CPUTLBEntry, n_entries);
+    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+}
+
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
 {
     env_tlb(env)->d[mmu_idx].n_used_entries++;
@@ -XXX,XX +XXX,XX @@ static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
 void tlb_init(CPUState *cpu)
 {
     CPUArchState *env = cpu->env_ptr;
+    int64_t now = get_clock_realtime();
+    int i;
 
     qemu_spin_init(&env_tlb(env)->c.lock);
 
     /* Ensure that cpu_reset performs a full flush.  */
     env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
 
-    tlb_dyn_init(env);
+    for (i = 0; i < NB_MMU_MODES; i++) {
+        tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
+    }
 }
 
 /* flush_all_helper: run fn across all cpus
-- 
2.20.1

There's little point in leaving these data structures half initialized,
and relying on a flush to be done during reset.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_new(CPUTLBEntry, n_entries);
     desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+    tlb_mmu_flush_locked(desc, fast);
 }
 
 static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
@@ -XXX,XX +XXX,XX @@ void tlb_init(CPUState *cpu)
 
     qemu_spin_init(&env_tlb(env)->c.lock);
 
-    /* Ensure that cpu_reset performs a full flush.  */
-    env_tlb(env)->c.dirty = ALL_MMUIDX_BITS;
+    /* All tlbs are initialized flushed. */
+    env_tlb(env)->c.dirty = 0;
 
     for (i = 0; i < NB_MMU_MODES; i++) {
         tlb_mmu_init(&env_tlb(env)->d[i], &env_tlb(env)->f[i], now);
-- 
2.20.1

Do not call get_clock_realtime() in tlb_mmu_resize_locked,
but hoist outside of any loop over a set of tlbs.  This is
only two (indirect) callers, tlb_flush_by_mmuidx_async_work
and tlb_flush_page_locked, so not onerous.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
  * high), since otherwise we are likely to have a significant amount of
  * conflict misses.
  */
-static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
+static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
+                                  int64_t now)
 {
     size_t old_size = tlb_n_entries(fast);
     size_t rate;
     size_t new_size = old_size;
-    int64_t now = get_clock_realtime();
     int64_t window_len_ms = 100;
     int64_t window_len_ns = window_len_ms * 1000 * 1000;
     bool window_expired = now > desc->window_begin_ns + window_len_ns;
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_flush_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast)
     memset(desc->vtable, -1, sizeof(desc->vtable));
 }
 
-static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
+static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx,
+                                        int64_t now)
 {
     CPUTLBDesc *desc = &env_tlb(env)->d[mmu_idx];
     CPUTLBDescFast *fast = &env_tlb(env)->f[mmu_idx];
 
-    tlb_mmu_resize_locked(desc, fast);
+    tlb_mmu_resize_locked(desc, fast, now);
     tlb_mmu_flush_locked(desc, fast);
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
     CPUArchState *env = cpu->env_ptr;
     uint16_t asked = data.host_int;
     uint16_t all_dirty, work, to_clean;
+    int64_t now = get_clock_realtime();
 
     assert_cpu_is_self(cpu);
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 
     for (work = to_clean; work != 0; work &= work - 1) {
         int mmu_idx = ctz32(work);
-        tlb_flush_one_mmuidx_locked(env, mmu_idx);
+        tlb_flush_one_mmuidx_locked(env, mmu_idx, now);
     }
 
     qemu_spin_unlock(&env_tlb(env)->c.lock);
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
         tlb_debug("forcing full flush midx %d ("
                   TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
                   midx, lp_addr, lp_mask);
-        tlb_flush_one_mmuidx_locked(env, midx);
+        tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
     } else {
         if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
             tlb_n_used_entries_dec(env, midx);
-- 
2.20.1

The following changes since commit 79b677d658d3d35e1e776826ac4abb28cdce69b8:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2023-02-21 11:28:31 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230221

for you to fetch changes up to dbd672c87f19949bb62bfb1fb3a97b9729fd7560:

sysemu/os-win32: fix setjmp/longjmp on windows-arm64 (2023-02-21 13:45:48 -1000)

----------------------------------------------------------------
tcg: Allow first half of insn in ram, and second half in mmio
linux-user/sparc: SIGILL for unknown trap vectors
linux-user/microblaze: SIGILL for privileged insns
linux-user: Fix deadlock while exiting due to signal
target/microblaze: Add gdbstub xml
util: Adjust cacheflush for windows-arm64
include/sysemu/os-win32: Adjust setjmp/longjmp for windows-arm64

----------------------------------------------------------------
Ilya Leoshkevich (3):
      linux-user: Always exit from exclusive state in fork_end()
      cpus: Make {start,end}_exclusive() recursive
      linux-user/microblaze: Handle privileged exception

Pierrick Bouvier (2):
      util/cacheflush: fix cache on windows-arm64
      sysemu/os-win32: fix setjmp/longjmp on windows-arm64

Richard Henderson (3):
      accel/tcg: Allow the second page of an instruction to be MMIO
      linux-user/sparc: Raise SIGILL for all unhandled software traps
      target/microblaze: Add gdbstub xml

include/hw/core/cpu.h                       |  4 +-
 include/sysemu/os-win32.h                   | 28 ++++++++++--
 target/microblaze/cpu.h                     |  2 +
 accel/tcg/translator.c                      | 12 +++++-
 cpus-common.c                               | 12 +++++-
 linux-user/main.c                           | 10 +++--
 linux-user/microblaze/cpu_loop.c            | 10 ++++-
 linux-user/sparc/cpu_loop.c                 |  8 ++++
 linux-user/syscall.c                        |  1 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 ++++++++++++++++------
 util/cacheflush.c                           | 14 ++++--
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++++
 meson.build                                 | 21 +++++++++
 19 files changed, 229 insertions(+), 34 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

If an instruction straddles a page boundary, and the first page
was ram, but the second page was MMIO, we would abort.  Handle
this as if both pages are MMIO, by setting the ram_addr_t for
the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>
Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
         if (host == NULL) {
             tb_page_addr_t phys_page =
                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-            /* We cannot handle MMIO as second page. */
-            assert(phys_page != -1);
+
+            /*
+             * If the second page is MMIO, treat as if the first page
+             * was MMIO as well, so that we do not cache the TB.
+             */
+            if (unlikely(phys_page == -1)) {
+                tb_set_page_addr0(tb, -1);
+                return NULL;
+            }
+
             tb_set_page_addr1(tb, phys_page);
 #ifdef CONFIG_USER_ONLY
             page_protect(end);
-- 
2.34.1

The linux kernel's trap tables vector all unassigned trap
numbers to BAD_TRAP, which then raises SIGILL.

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sparc/cpu_loop.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)
             cpu_exec_step_atomic(cs);
             break;
         default:
+            /*
+             * Most software trap numbers vector to BAD_TRAP.
+             * Handle anything not explicitly matched above.
+             */
+            if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {
+                force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);
+                break;
+            }
             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
             cpu_dump_state(cs, stderr, 0);
             exit(EXIT_FAILURE);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

fork()ed processes currently start with
current_cpu->in_exclusive_context set, which is, strictly speaking, not
correct, but does not cause problems (even assertion failures).

With one of the next patches, the code begins to rely on this value, so
fix it by always calling end_exclusive() in fork_end().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-2-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c    | 10 ++++++----
 linux-user/syscall.c |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ void fork_end(int child)
         }
         qemu_init_cpu_list();
         gdbserver_fork(thread_cpu);
-        /* qemu_init_cpu_list() takes care of reinitializing the
-         * exclusive state, so we don't need to end_exclusive() here.
-         */
     } else {
         cpu_list_unlock();
-        end_exclusive();
     }
+    /*
+     * qemu_init_cpu_list() reinitialized the child exclusive state, but we
+     * also need to keep current_cpu consistent, so call end_exclusive() for
+     * both child and parent.
+     */
+    end_exclusive();
 }
 
 __thread CPUState *thread_cpu;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
             cpu_clone_regs_parent(env, flags);
             fork_end(0);
         }
+        g_assert(!cpu_in_exclusive_context(cpu));
     }
     return ret;
 }
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently dying to one of the core_dump_signal()s deadlocks, because
dump_core_and_abort() calls start_exclusive() two times: first via
stop_all_tasks(), and then via preexit_cleanup() ->
qemu_plugin_user_exit().

There are a number of ways to solve this: resume after dumping core;
check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make
{start,end}_exclusive() recursive. Pick the last option, since it's
the most straightforward one.

Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h |  4 ++--
 cpus-common.c         | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     bool unplug;
     bool crash_occurred;
     bool exit_request;
-    bool in_exclusive_context;
+    int exclusive_context_count;
     uint32_t cflags_next_tb;
     /* updates protected by BQL */
     uint32_t interrupt_request;
@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data
  */
 static inline bool cpu_in_exclusive_context(const CPUState *cpu)
 {
-    return cpu->in_exclusive_context;
+    return cpu->exclusive_context_count;
 }
 
 /**
diff --git a/cpus-common.c b/cpus-common.c
index XXXXXXX..XXXXXXX 100644
--- a/cpus-common.c
+++ b/cpus-common.c
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
     CPUState *other_cpu;
     int running_cpus;
 
+    if (current_cpu->exclusive_context_count) {
+        current_cpu->exclusive_context_count++;
+        return;
+    }
+
     qemu_mutex_lock(&qemu_cpu_list_lock);
     exclusive_idle();
 
@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)
      */
     qemu_mutex_unlock(&qemu_cpu_list_lock);
 
-    current_cpu->in_exclusive_context = true;
+    current_cpu->exclusive_context_count = 1;
 }
 
 /* Finish an exclusive operation.  */
 void end_exclusive(void)
 {
-    current_cpu->in_exclusive_context = false;
+    current_cpu->exclusive_context_count--;
+    if (current_cpu->exclusive_context_count) {
+        return;
+    }
 
     qemu_mutex_lock(&qemu_cpu_list_lock);
     qatomic_set(&pending_cpus, 0);
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Follow what kernel's full_exception() is doing.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230214140829.45392-4-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/cpu_loop.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 
 void cpu_loop(CPUMBState *env)
 {
+    int trapnr, ret, si_code, sig;
     CPUState *cs = env_cpu(env);
-    int trapnr, ret, si_code;
 
     while (1) {
         cpu_exec_start(cs);
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             switch (env->esr & 31) {
             case ESR_EC_DIVZERO:
+                sig = TARGET_SIGFPE;
                 si_code = TARGET_FPE_INTDIV;
                 break;
             case ESR_EC_FPU:
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                  * if there's no recognized bit set.  Possibly this
                  * implies that si_code is 0, but follow the structure.
                  */
+                sig = TARGET_SIGFPE;
                 si_code = env->fsr;
                 if (si_code & FSR_IO) {
                     si_code = TARGET_FPE_FLTINV;
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUMBState *env)
                     si_code = TARGET_FPE_FLTRES;
                 }
                 break;
+            case ESR_EC_PRIVINSN:
+                sig = SIGILL;
+                si_code = ILL_PRVOPC;
+                break;
             default:
                 fprintf(stderr, "Unhandled hw-exception: 0x%x\n",
                         env->esr & ESR_EC_MASK);
                 cpu_dump_state(cs, stderr, 0);
                 exit(EXIT_FAILURE);
             }
-            force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
+            force_sig_fault(sig, si_code, env->pc);
             break;
 
         case EXCP_DEBUG:
-- 
2.34.1

Mirroring the upstream gdb xml files, the two stack boundary
registers are separated out.

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h                     |  2 +
 target/microblaze/cpu.c                     |  7 ++-
 target/microblaze/gdbstub.c                 | 51 +++++++++++-----
 configs/targets/microblaze-linux-user.mak   |  1 +
 configs/targets/microblaze-softmmu.mak      |  1 +
 configs/targets/microblazeel-linux-user.mak |  1 +
 configs/targets/microblazeel-softmmu.mak    |  1 +
 gdb-xml/microblaze-core.xml                 | 67 +++++++++++++++++++++
 gdb-xml/microblaze-stack-protect.xml        | 12 ++++
 9 files changed, 128 insertions(+), 15 deletions(-)
 create mode 100644 gdb-xml/microblaze-core.xml
 create mode 100644 gdb-xml/microblaze-stack-protect.xml

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
 int mb_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_read_stack_protect(CPUArchState *cpu, GByteArray *buf, int reg);
+int mb_cpu_gdb_write_stack_protect(CPUArchState *cpu, uint8_t *buf, int reg);
 
 static inline uint32_t mb_cpu_read_msr(const CPUMBState *env)
 {
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
 #include "exec/exec-all.h"
+#include "exec/gdbstub.h"
 #include "fpu/softfloat-helpers.h"
 
 static const struct {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_initfn(Object *obj)
     CPUMBState *env = &cpu->env;
 
     cpu_set_cpustate_pointers(cpu);
+    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
+                             mb_cpu_gdb_write_stack_protect, 2,
+                             "microblaze-stack-protect.xml", 0);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
 
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->sysemu_ops = &mb_sysemu_ops;
 #endif
     device_class_set_props(dc, mb_properties);
-    cc->gdb_num_core_regs = 32 + 27;
+    cc->gdb_num_core_regs = 32 + 25;
+    cc->gdb_core_xml_file = "microblaze-core.xml";
 
     cc->disas_set_info = mb_disas_set_info;
     cc->tcg_ops = &mb_tcg_ops;
diff --git a/target/microblaze/gdbstub.c b/target/microblaze/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/gdbstub.c
+++ b/target/microblaze/gdbstub.c
@@ -XXX,XX +XXX,XX @@ enum {
     GDB_PVR0  = 32 + 6,
     GDB_PVR11 = 32 + 17,
     GDB_EDR   = 32 + 18,
-    GDB_SLR   = 32 + 25,
-    GDB_SHR   = 32 + 26,
+};
+
+enum {
+    GDB_SP_SHL,
+    GDB_SP_SHR,
 };
 
 int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     case GDB_EDR:
         val = env->edr;
         break;
-    case GDB_SLR:
-        val = env->slr;
-        break;
-    case GDB_SHR:
-        val = env->shr;
-        break;
     default:
         /* Other SRegs aren't modeled, so report a value of 0 */
         val = 0;
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     return gdb_get_reg32(mem_buf, val);
 }
 
+int mb_cpu_gdb_read_stack_protect(CPUMBState *env, GByteArray *mem_buf, int n)
+{
+    uint32_t val;
+
+    switch (n) {
+    case GDB_SP_SHL:
+        val = env->slr;
+        break;
+    case GDB_SP_SHR:
+        val = env->shr;
+        break;
+    default:
+        return 0;
+    }
+    return gdb_get_reg32(mem_buf, val);
+}
+
 int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     case GDB_EDR:
         env->edr = tmp;
         break;
-    case GDB_SLR:
-        env->slr = tmp;
-        break;
-    case GDB_SHR:
-        env->shr = tmp;
-        break;
+    }
+    return 4;
+}
+
+int mb_cpu_gdb_write_stack_protect(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case GDB_SP_SHL:
+        env->slr = ldl_p(mem_buf);
+        break;
+    case GDB_SP_SHR:
+        env->shr = ldl_p(mem_buf);
+        break;
+    default:
+        return 0;
     }
     return 4;
 }
diff --git a/configs/targets/microblaze-linux-user.mak b/configs/targets/microblaze-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-linux-user.mak
+++ b/configs/targets/microblaze-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_BIG_ENDIAN=y
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_BIG_ENDIAN=y
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-linux-user.mak b/configs/targets/microblazeel-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-linux-user.mak
+++ b/configs/targets/microblazeel-linux-user.mak
@@ -XXX,XX +XXX,XX @@ TARGET_ARCH=microblaze
 TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_HAS_BFLT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=microblaze
 TARGET_SUPPORTS_MTTCG=y
 TARGET_NEED_FDT=y
+TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/gdb-xml/microblaze-core.xml b/gdb-xml/microblaze-core.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-core.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.core">
+  <reg name="r0" bitsize="32" regnum="0"/>
+  <reg name="r1" bitsize="32" type="data_ptr"/>
+  <reg name="r2" bitsize="32"/>
+  <reg name="r3" bitsize="32"/>
+  <reg name="r4" bitsize="32"/>
+  <reg name="r5" bitsize="32"/>
+  <reg name="r6" bitsize="32"/>
+  <reg name="r7" bitsize="32"/>
+  <reg name="r8" bitsize="32"/>
+  <reg name="r9" bitsize="32"/>
+  <reg name="r10" bitsize="32"/>
+  <reg name="r11" bitsize="32"/>
+  <reg name="r12" bitsize="32"/>
+  <reg name="r13" bitsize="32"/>
+  <reg name="r14" bitsize="32"/>
+  <reg name="r15" bitsize="32"/>
+  <reg name="r16" bitsize="32"/>
+  <reg name="r17" bitsize="32"/>
+  <reg name="r18" bitsize="32"/>
+  <reg name="r19" bitsize="32"/>
+  <reg name="r20" bitsize="32"/>
+  <reg name="r21" bitsize="32"/>
+  <reg name="r22" bitsize="32"/>
+  <reg name="r23" bitsize="32"/>
+  <reg name="r24" bitsize="32"/>
+  <reg name="r25" bitsize="32"/>
+  <reg name="r26" bitsize="32"/>
+  <reg name="r27" bitsize="32"/>
+  <reg name="r28" bitsize="32"/>
+  <reg name="r29" bitsize="32"/>
+  <reg name="r30" bitsize="32"/>
+  <reg name="r31" bitsize="32"/>
+  <reg name="rpc" bitsize="32" type="code_ptr"/>
+  <reg name="rmsr" bitsize="32"/>
+  <reg name="rear" bitsize="32"/>
+  <reg name="resr" bitsize="32"/>
+  <reg name="rfsr" bitsize="32"/>
+  <reg name="rbtr" bitsize="32"/>
+  <reg name="rpvr0" bitsize="32"/>
+  <reg name="rpvr1" bitsize="32"/>
+  <reg name="rpvr2" bitsize="32"/>
+  <reg name="rpvr3" bitsize="32"/>
+  <reg name="rpvr4" bitsize="32"/>
+  <reg name="rpvr5" bitsize="32"/>
+  <reg name="rpvr6" bitsize="32"/>
+  <reg name="rpvr7" bitsize="32"/>
+  <reg name="rpvr8" bitsize="32"/>
+  <reg name="rpvr9" bitsize="32"/>
+  <reg name="rpvr10" bitsize="32"/>
+  <reg name="rpvr11" bitsize="32"/>
+  <reg name="redr" bitsize="32"/>
+  <reg name="rpid" bitsize="32"/>
+  <reg name="rzpr" bitsize="32"/>
+  <reg name="rtlbx" bitsize="32"/>
+  <reg name="rtlbsx" bitsize="32"/>
+  <reg name="rtlblo" bitsize="32"/>
+  <reg name="rtlbhi" bitsize="32"/>
+</feature>
diff --git a/gdb-xml/microblaze-stack-protect.xml b/gdb-xml/microblaze-stack-protect.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/microblaze-stack-protect.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.microblaze.stack-protect">
+  <reg name="rslr" bitsize="32"/>
+  <reg name="rshr" bitsize="32"/>
+</feature>
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

ctr_el0 access is privileged on this platform and fails as an illegal
instruction.

Windows does not offer a way to flush data cache from userspace, and
only FlushInstructionCache is available in Windows API.

The generic implementation of flush_idcache_range uses,
__builtin___clear_cache, which already use the FlushInstructionCache
function. So we rely on that.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-2-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/cacheflush.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/util/cacheflush.c b/util/cacheflush.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static bool have_coherent_icache;
 #endif
 
-#if defined(__aarch64__) && !defined(CONFIG_DARWIN)
-/* Apple does not expose CTR_EL0, so we must use system interfaces. */
+#if defined(__aarch64__) && !defined(CONFIG_DARWIN) && !defined(CONFIG_WIN32)
+/*
+ * Apple does not expose CTR_EL0, so we must use system interfaces.
+ * Windows neither, but we use a generic implementation of flush_idcache_range
+ * in this case.
+ */
 static uint64_t save_ctr_el0;
 static void arch_cache_info(int *isize, int *dsize)
 {
@@ -XXX,XX +XXX,XX @@ static void __attribute__((constructor)) init_cache_info(void)
 
 /* Caches are coherent and do not require flushing; symbol inline. */
 
-#elif defined(__aarch64__)
+#elif defined(__aarch64__) && !defined(CONFIG_WIN32)
+/*
+ * For Windows, we use generic implementation of flush_idcache_range, that
+ * performs a call to FlushInstructionCache, through __builtin___clear_cache.
+ */
 
 #ifdef CONFIG_DARWIN
 /* Apple does not expose CTR_EL0, so we must use system interfaces. */
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Windows implementation of setjmp/longjmp is done in
C:/WINDOWS/system32/ucrtbase.dll. Alas, on arm64, it seems to *always*
perform stack unwinding, which crashes from generated code.

By using alternative implementation built in mingw, we avoid doing stack
unwinding and this fixes crash when calling longjmp.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230221153006.20300-3-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/os-win32.h | 28 ++++++++++++++++++++++++----
 meson.build               | 21 +++++++++++++++++++++
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -XXX,XX +XXX,XX @@ typedef struct sockaddr_un {
 extern "C" {
 #endif
 
-#if defined(_WIN64)
-/* On w64, setjmp is implemented by _setjmp which needs a second parameter.
+#if defined(__aarch64__)
+/*
+ * On windows-arm64, setjmp is available in only one variant, and longjmp always
+ * does stack unwinding. This crash with generated code.
+ * Thus, we use another implementation of setjmp (not windows one), coming from
+ * mingw, which never performs stack unwinding.
+ */
+#undef setjmp
+#undef longjmp
+/*
+ * These functions are not declared in setjmp.h because __aarch64__ defines
+ * setjmp to _setjmpex instead. However, they are still defined in libmingwex.a,
+ * which gets linked automatically.
+ */
+extern int __mingw_setjmp(jmp_buf);
+extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+#define setjmp(env) __mingw_setjmp(env)
+#define longjmp(env, val) __mingw_longjmp(env, val)
+#elif defined(_WIN64)
+/*
+ * On windows-x64, setjmp is implemented by _setjmp which needs a second parameter.
  * If this parameter is NULL, longjump does no stack unwinding.
  * That is what we need for QEMU. Passing the value of register rsp (default)
- * lets longjmp try a stack unwinding which will crash with generated code. */
+ * lets longjmp try a stack unwinding which will crash with generated code.
+ */
 # undef setjmp
 # define setjmp(env) _setjmp(env, NULL)
-#endif
+#endif /* __aarch64__ */
 /* QEMU uses sigsetjmp()/siglongjmp() as the portable way to specify
  * "longjmp and don't touch the signal masks". Since we know that the
  * savemask parameter will always be zero we can safely define these
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if targetos == 'windows'
     }''', name: '_lock_file and _unlock_file'))
 endif
 
+if targetos == 'windows'
+  mingw_has_setjmp_longjmp = cc.links('''
+    #include <setjmp.h>
+    int main(void) {
+      /*
+       * These functions are not available in setjmp header, but may be
+       * available at link time, from libmingwex.a.
+       */
+      extern int __mingw_setjmp(jmp_buf);
+      extern void __attribute__((noreturn)) __mingw_longjmp(jmp_buf, int);
+      jmp_buf env;
+      __mingw_setjmp(env);
+      __mingw_longjmp(env, 0);
+    }
+  ''', name: 'mingw setjmp and longjmp')
+
+  if cpu == 'aarch64' and not mingw_has_setjmp_longjmp
+    error('mingw must provide setjmp/longjmp for windows-arm64')
+  endif
+endif
+
 ########################
 # Target configuration #
 ########################
-- 
2.34.1