Series comparison

-[PULL 0/3] tcg patch queue
+[PULL v2 00/34] tcg patch queue
-The following changes since commit e18e5501d8ac692d32657a3e1ef545b14e72b730:
+V2 fixes an error in patch 22 wrt MacOS.
 It's a shame we don't have public CI for that.
-  Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20200210' into staging (2020-02-10 18:09:14 +0000)
 r~
 The following changes since commit 894fc4fd670aaf04a67dc7507739f914ff4bacf2:
   Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging (2021-06-11 09:21:48 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20200212
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210613
-for you to fetch changes up to 2445971604c1cfd3ec484457159f4ac300fb04d2:
+for you to fetch changes up to a5a8b84772e13066c6c45f480cc5b5312bbde08e:
-  tcg: Add tcg_gen_gvec_5_ptr (2020-02-12 14:58:36 -0800)
+  docs/devel: Explain in more detail the TB chaining mechanisms (2021-06-13 17:42:40 -0700)
 ----------------------------------------------------------------
-Fix breakpoint invalidation.
+Clean up code_gen_buffer allocation.
-Add support for tcg helpers with 7 arguments.
+Add tcg_remove_ops_after.
-Add support for gvec helpers with 5 arguments.
+Fix tcg_constant_* documentation.
 Improve TB chaining documentation.
 Fix float32_exp2.
 Fix arm tcg_out_op function signature.
 ----------------------------------------------------------------
-Max Filippov (1):
+Jose R. Ziviani (1):
-      exec: flush CPU TB cache in breakpoint_invalidate
+      tcg/arm: Fix tcg_out_op function signature
-Richard Henderson (1):
+Luis Pires (1):
-      tcg: Add tcg_gen_gvec_5_ptr
+      docs/devel: Explain in more detail the TB chaining mechanisms
-Taylor Simpson (1):
+Richard Henderson (32):
-      tcg: Add support for a helper with 7 arguments
+      meson: Split out tcg/meson.build
       meson: Split out fpu/meson.build
       tcg: Re-order tcg_region_init vs tcg_prologue_init
       tcg: Remove error return from tcg_region_initial_alloc__locked
       tcg: Split out tcg_region_initial_alloc
       tcg: Split out tcg_region_prologue_set
       tcg: Split out region.c
       accel/tcg: Inline cpu_gen_init
       accel/tcg: Move alloc_code_gen_buffer to tcg/region.c
       accel/tcg: Rename tcg_init to tcg_init_machine
       tcg: Create tcg_init
       accel/tcg: Merge tcg_exec_init into tcg_init_machine
       accel/tcg: Use MiB in tcg_init_machine
       accel/tcg: Pass down max_cpus to tcg_init
       tcg: Introduce tcg_max_ctxs
       tcg: Move MAX_CODE_GEN_BUFFER_SIZE to tcg-target.h
       tcg: Replace region.end with region.total_size
       tcg: Rename region.start to region.after_prologue
       tcg: Tidy tcg_n_regions
       tcg: Tidy split_cross_256mb
       tcg: Move in_code_gen_buffer and tests to region.c
       tcg: Allocate code_gen_buffer into struct tcg_region_state
       tcg: Return the map protection from alloc_code_gen_buffer
       tcg: Sink qemu_madvise call to common code
       util/osdep: Add qemu_mprotect_rw
       tcg: Round the tb_size default from qemu_get_host_physmem
       tcg: Merge buffer protection and guard page protection
       tcg: When allocating for !splitwx, begin with PROT_NONE
       tcg: Move tcg_init_ctx and tcg_ctx from accel/tcg/
       tcg: Introduce tcg_remove_ops_after
       tcg: Fix documentation for tcg_constant_* vs tcg_temp_free_*
       softfloat: Fix tp init in float32_exp2
- include/exec/helper-gen.h   | 13 +++++++++++++
+ docs/devel/tcg.rst        | 101 ++++-
- include/exec/helper-head.h  |  2 ++
+ meson.build               |  12 +-
- include/exec/helper-proto.h |  6 ++++++
+ accel/tcg/internal.h      |   2 +
- include/exec/helper-tcg.h   |  7 +++++++
+ include/qemu/osdep.h      |   1 +
- include/tcg/tcg-op-gvec.h   |  7 +++++++
+ include/sysemu/tcg.h      |   2 -
- exec.c                      | 15 +++++++--------
+ include/tcg/tcg.h         |  28 +-
- tcg/tcg-op-gvec.c           | 32 ++++++++++++++++++++++++++++++++
+ tcg/aarch64/tcg-target.h  |   1 +
-files changed, 74 insertions(+), 8 deletions(-)
+ tcg/arm/tcg-target.h      |   1 +
  tcg/i386/tcg-target.h     |   2 +
  tcg/mips/tcg-target.h     |   6 +
  tcg/ppc/tcg-target.h      |   2 +
  tcg/riscv/tcg-target.h    |   1 +
  tcg/s390/tcg-target.h     |   3 +
  tcg/sparc/tcg-target.h    |   1 +
  tcg/tcg-internal.h        |  40 ++
  tcg/tci/tcg-target.h      |   1 +
  accel/tcg/tcg-all.c       |  32 +-
  accel/tcg/translate-all.c | 439 +-------------------
  bsd-user/main.c           |   3 +-
  fpu/softfloat.c           |   2 +-
  linux-user/main.c         |   1 -
  tcg/region.c              | 999 ++++++++++++++++++++++++++++++++++++++++++++++
  tcg/tcg.c                 | 649 +++---------------------------
  util/osdep.c              |   9 +
  tcg/arm/tcg-target.c.inc  |   3 +-
  fpu/meson.build           |   1 +
  tcg/meson.build           |  14 +
 files changed, 1266 insertions(+), 1090 deletions(-)
  create mode 100644 tcg/tcg-internal.h
  create mode 100644 tcg/region.c
  create mode 100644 fpu/meson.build
  create mode 100644 tcg/meson.build

-[PULL 1/3] exec: flush CPU TB cache in breakpoint_invalidate
+Deleted patch
-From: Max Filippov <jcmvbkbc@gmail.com>
-When a breakpoint is inserted at location for which there's currently no
-virtual to physical translation no action is taken on CPU TB cache. If a
-TB for that virtual address already exists but is not visible ATM the
-breakpoint won't be hit next time an instruction at that address will be
-executed.
-Flush entire CPU TB cache in breakpoint_invalidate to force
-re-translation of all TBs for the breakpoint address.
-This change fixes the following scenario:
-- linux user application is running
-- a breakpoint is inserted from QEMU gdbstub for a user address that is
-  not currently present in the target CPU TLB
-- an instruction at that address is executed, but the external debugger
-  doesn't get control.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
-Message-Id: <20191127220602.10827-2-jcmvbkbc@gmail.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- exec.c | 15 +++++++--------
-file changed, 7 insertions(+), 8 deletions(-)
-diff --git a/exec.c b/exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/exec.c
-+++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
- static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
- {
--    MemTxAttrs attrs;
--    hwaddr phys = cpu_get_phys_page_attrs_debug(cpu, pc, &attrs);
--    int asidx = cpu_asidx_from_attrs(cpu, attrs);
--    if (phys != -1) {
--        /* Locks grabbed by tb_invalidate_phys_addr */
--        tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
--                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
--    }
-+    /*
-+     * There may not be a virtual to physical translation for the pc
-+     * right now, but there may exist cached TB for this pc.
-+     * Flush the whole TB cache to force re-translation of such TBs.
-+     * This is heavyweight, but we're debugging anyway.
-+     */
-+    tb_flush(cpu);
- }
- #endif
---
-.20.1

-[PULL 2/3] tcg: Add support for a helper with 7 arguments
+[PULL v2 22/34] tcg: Allocate code_gen_buffer into struct tcg_region_state
-From: Taylor Simpson <tsimpson@quicinc.com>
+Do not mess around with setting values within tcg_init_ctx.
 Put the values into 'region' directly, which is where they
 will live for the lifetime of the program.
-Currently, helpers can only take up to 6 arguments.  This patch adds the
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-capability for up to 7 arguments.  I have tested it with the Hexagon port
+Reviewed-by: Luis Pires <luis.pires@eldorado.org.br>
 that I am preparing for submission.
 Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
 Message-Id: <1580942510-2820-1-git-send-email-tsimpson@quicinc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/helper-gen.h   | 13 +++++++++++++
+ tcg/region.c | 64 ++++++++++++++++++++++------------------------------
- include/exec/helper-head.h  |  2 ++
+file changed, 27 insertions(+), 37 deletions(-)
  include/exec/helper-proto.h |  6 ++++++
  include/exec/helper-tcg.h   |  7 +++++++
 files changed, 28 insertions(+)
-diff --git a/include/exec/helper-gen.h b/include/exec/helper-gen.h
+diff --git a/tcg/region.c b/tcg/region.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/helper-gen.h
+--- a/tcg/region.c
-+++ b/include/exec/helper-gen.h
++++ b/tcg/region.c
-@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+@@ -XXX,XX +XXX,XX @@ static size_t tree_size;
-   tcg_gen_callN(HELPER(name), dh_retvar(ret), 6, args);                 \
  bool in_code_gen_buffer(const void *p)
  {
 -    const TCGContext *s = &tcg_init_ctx;
      /*
       * Much like it is valid to have a pointer to the byte past the
       * end of an array (so long as you don't dereference it), allow
       * a pointer to the byte past the end of the code gen buffer.
       */
 -    return (size_t)(p - s->code_gen_buffer) <= s->code_gen_buffer_size;
 +    return (size_t)(p - region.start_aligned) <= region.total_size;
  }
-+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7)\
+ #ifdef CONFIG_DEBUG_TCG
-+static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
-+    dh_arg_decl(t1, 1),  dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),        \
+     }
-+    dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
+     qemu_madvise(buf, size, QEMU_MADV_HUGEPAGE);
-+    dh_arg_decl(t7, 7))                                                 \
-+{                                                                       \
+-    tcg_ctx->code_gen_buffer = buf;
-+  TCGTemp *args[7] = { dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),     \
+-    tcg_ctx->code_gen_buffer_size = size;
-+                     dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),       \
++    region.start_aligned = buf;
-+                     dh_arg(t7, 7) };                                   \
++    region.total_size = size;
-+  tcg_gen_callN(HELPER(name), dh_retvar(ret), 7, args);                 \
+     return true;
-+}
+ }
  #elif defined(_WIN32)
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
          return false;
      }
 -    tcg_ctx->code_gen_buffer = buf;
 -    tcg_ctx->code_gen_buffer_size = size;
 +    region.start_aligned = buf;
 +    region.total_size = size;
      return true;
  }
  #else
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_anon(size_t size, int prot,
      /* Request large pages for the buffer.  */
      qemu_madvise(buf, size, QEMU_MADV_HUGEPAGE);
 -    tcg_ctx->code_gen_buffer = buf;
 -    tcg_ctx->code_gen_buffer_size = size;
 +    region.start_aligned = buf;
 +    region.total_size = size;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
          return false;
      }
      /* The size of the mapping may have been adjusted. */
 -    size = tcg_ctx->code_gen_buffer_size;
 -    buf_rx = tcg_ctx->code_gen_buffer;
 +    buf_rx = region.start_aligned;
 +    size = region.total_size;
  #endif
      buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
  #endif
      close(fd);
 -    tcg_ctx->code_gen_buffer = buf_rw;
 -    tcg_ctx->code_gen_buffer_size = size;
 +    region.start_aligned = buf_rw;
 +    region.total_size = size;
      tcg_splitwx_diff = buf_rx - buf_rw;
      /* Request large pages for the buffer and the splitwx.  */
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_vmremap(size_t size, Error **errp)
          return false;
      }
 -    buf_rw = (mach_vm_address_t)tcg_ctx->code_gen_buffer;
 +    buf_rw = (mach_vm_address_t)region.start_aligned;
      buf_rx = 0;
      ret = mach_vm_remap(mach_task_self(),
                          &buf_rx,
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
   */
  void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
  {
 -    void *buf, *aligned, *end;
 -    size_t total_size;
      size_t page_size;
      size_t region_size;
 -    size_t n_regions;
      size_t i;
      bool ok;
@@ -XXX,XX +XXX,XX @@ void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
                                 splitwx, &error_fatal);
      assert(ok);
 -    buf = tcg_init_ctx.code_gen_buffer;
 -    total_size = tcg_init_ctx.code_gen_buffer_size;
 -    page_size = qemu_real_host_page_size;
 -    n_regions = tcg_n_regions(total_size, max_cpus);
 -
 -    /* The first region will be 'aligned - buf' bytes larger than the others */
 -    aligned = QEMU_ALIGN_PTR_UP(buf, page_size);
 -    g_assert(aligned < tcg_init_ctx.code_gen_buffer + total_size);
 -
      /*
       * Make region_size a multiple of page_size, using aligned as the start.
       * As a result of this we might end up with a few extra pages at the end of
       * the buffer; we will assign those to the last region.
       */
 -    region_size = (total_size - (aligned - buf)) / n_regions;
 +    region.n = tcg_n_regions(region.total_size, max_cpus);
 +    page_size = qemu_real_host_page_size;
 +    region_size = region.total_size / region.n;
      region_size = QEMU_ALIGN_DOWN(region_size, page_size);
      /* A region must have at least 2 pages; one code, one guard */
      g_assert(region_size >= 2 * page_size);
 +    region.stride = region_size;
 +
- #include "helper.h"
++    /* Reserve space for guard pages. */
- #include "trace/generated-helpers.h"
++    region.size = region_size - page_size;
- #include "trace/generated-helpers-wrappers.h"
++    region.total_size -= page_size;
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
  #undef DEF_HELPER_FLAGS_4
  #undef DEF_HELPER_FLAGS_5
  #undef DEF_HELPER_FLAGS_6
 +#undef DEF_HELPER_FLAGS_7
  #undef GEN_HELPER
  #endif /* HELPER_GEN_H */
 diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-head.h
 +++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
      DEF_HELPER_FLAGS_5(name, 0, ret, t1, t2, t3, t4, t5)
  #define DEF_HELPER_6(name, ret, t1, t2, t3, t4, t5, t6) \
      DEF_HELPER_FLAGS_6(name, 0, ret, t1, t2, t3, t4, t5, t6)
 +#define DEF_HELPER_7(name, ret, t1, t2, t3, t4, t5, t6, t7) \
 +    DEF_HELPER_FLAGS_7(name, 0, ret, t1, t2, t3, t4, t5, t6, t7)
  /* MAX_OPC_PARAM_IARGS must be set to n if last entry is DEF_HELPER_FLAGS_n. */
 diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-proto.h
 +++ b/include/exec/helper-proto.h
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
  dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
                              dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
 +#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
 +dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 +                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
 +                            dh_ctype(t7));
 +
- #include "helper.h"
++    /*
- #include "trace/generated-helpers.h"
++     * The first region will be smaller than the others, via the prologue,
- #include "tcg-runtime.h"
++     * which has yet to be allocated.  For now, the first region begins at
-@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
++     * the page boundary.
- #undef DEF_HELPER_FLAGS_4
++     */
- #undef DEF_HELPER_FLAGS_5
++    region.after_prologue = region.start_aligned;
- #undef DEF_HELPER_FLAGS_6
-+#undef DEF_HELPER_FLAGS_7
+     /* init the region struct */
+     qemu_mutex_init(&region.lock);
- #endif /* HELPER_PROTO_H */
+-    region.n = n_regions;
-diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
+-    region.size = region_size - page_size;
-index XXXXXXX..XXXXXXX 100644
+-    region.stride = region_size;
---- a/include/exec/helper-tcg.h
+-    region.after_prologue = buf;
-+++ b/include/exec/helper-tcg.h
+-    region.start_aligned = aligned;
-@@ -XXX,XX +XXX,XX @@
+-    /* page-align the end, since its last page will be a guard page */
-     | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
+-    end = QEMU_ALIGN_PTR_DOWN(buf + total_size, page_size);
-     | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
+-    /* account for that last guard page */
+-    end -= page_size;
-+#define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
+-    total_size = end - aligned;
-+  { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
+-    region.total_size = total_size;
-+    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
-+    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
+     /*
-+    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
+      * Set guard pages in the rw buffer, as that's the one into which
 +
  #include "helper.h"
  #include "trace/generated-helpers.h"
  #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@
  #undef DEF_HELPER_FLAGS_4
  #undef DEF_HELPER_FLAGS_5
  #undef DEF_HELPER_FLAGS_6
 +#undef DEF_HELPER_FLAGS_7
  #endif /* HELPER_TCG_H */
 --
-.20.1
+.25.1

-[PULL 3/3] tcg: Add tcg_gen_gvec_5_ptr
+Deleted patch
-Extend the vector generator infrastructure to handle
-vector arguments.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg-op-gvec.h |  7 +++++++
- tcg/tcg-op-gvec.c         | 32 ++++++++++++++++++++++++++++++++
-files changed, 39 insertions(+)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
-+++ b/include/tcg/tcg-op-gvec.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-                         uint32_t maxsz, int32_t data,
-                         gen_helper_gvec_4_ptr *fn);
-+typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
-+                                   TCGv_ptr, TCGv_ptr, TCGv_i32);
-+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
-+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
-+                        gen_helper_gvec_5_ptr *fn);
-+
- /* Expand a gvec operation.  Either inline or out-of-line depending on
-    the actual vector size and the operations supported by the host.  */
- typedef struct {
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-     tcg_temp_free_i32(desc);
- }
-+/* Generate a call to a gvec-style helper with five vector operands
-+   and an extra pointer operand.  */
-+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
-+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
-+                        gen_helper_gvec_5_ptr *fn)
-+{
-+    TCGv_ptr a0, a1, a2, a3, a4;
-+    TCGv_i32 desc = tcg_const_i32(simd_desc(oprsz, maxsz, data));
-+
-+    a0 = tcg_temp_new_ptr();
-+    a1 = tcg_temp_new_ptr();
-+    a2 = tcg_temp_new_ptr();
-+    a3 = tcg_temp_new_ptr();
-+    a4 = tcg_temp_new_ptr();
-+
-+    tcg_gen_addi_ptr(a0, cpu_env, dofs);
-+    tcg_gen_addi_ptr(a1, cpu_env, aofs);
-+    tcg_gen_addi_ptr(a2, cpu_env, bofs);
-+    tcg_gen_addi_ptr(a3, cpu_env, cofs);
-+    tcg_gen_addi_ptr(a4, cpu_env, eofs);
-+
-+    fn(a0, a1, a2, a3, a4, ptr, desc);
-+
-+    tcg_temp_free_ptr(a0);
-+    tcg_temp_free_ptr(a1);
-+    tcg_temp_free_ptr(a2);
-+    tcg_temp_free_ptr(a3);
-+    tcg_temp_free_ptr(a4);
-+    tcg_temp_free_i32(desc);
-+}
-+
- /* Return true if we want to implement something of OPRSZ bytes
-    in units of LNSZ.  This limits the expansion of inline code.  */
- static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
---
-.20.1

The following changes since commit e18e5501d8ac692d32657a3e1ef545b14e72b730:

Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20200210' into staging (2020-02-10 18:09:14 +0000)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20200212

for you to fetch changes up to 2445971604c1cfd3ec484457159f4ac300fb04d2:

tcg: Add tcg_gen_gvec_5_ptr (2020-02-12 14:58:36 -0800)

----------------------------------------------------------------
Fix breakpoint invalidation.
Add support for tcg helpers with 7 arguments.
Add support for gvec helpers with 5 arguments.

----------------------------------------------------------------
Max Filippov (1):
      exec: flush CPU TB cache in breakpoint_invalidate

Richard Henderson (1):
      tcg: Add tcg_gen_gvec_5_ptr

Taylor Simpson (1):
      tcg: Add support for a helper with 7 arguments

From: Max Filippov <jcmvbkbc@gmail.com>

When a breakpoint is inserted at location for which there's currently no
virtual to physical translation no action is taken on CPU TB cache. If a
TB for that virtual address already exists but is not visible ATM the
breakpoint won't be hit next time an instruction at that address will be
executed.

Flush entire CPU TB cache in breakpoint_invalidate to force
re-translation of all TBs for the breakpoint address.

This change fixes the following scenario:
- linux user application is running
- a breakpoint is inserted from QEMU gdbstub for a user address that is
  not currently present in the target CPU TLB
- an instruction at that address is executed, but the external debugger
  doesn't get control.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Message-Id: <20191127220602.10827-2-jcmvbkbc@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 exec.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
 
 static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
-    MemTxAttrs attrs;
-    hwaddr phys = cpu_get_phys_page_attrs_debug(cpu, pc, &attrs);
-    int asidx = cpu_asidx_from_attrs(cpu, attrs);
-    if (phys != -1) {
-        /* Locks grabbed by tb_invalidate_phys_addr */
-        tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
-                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
-    }
+    /*
+     * There may not be a virtual to physical translation for the pc
+     * right now, but there may exist cached TB for this pc.
+     * Flush the whole TB cache to force re-translation of such TBs.
+     * This is heavyweight, but we're debugging anyway.
+     */
+    tb_flush(cpu);
 }
 #endif
 
-- 
2.20.1

From: Taylor Simpson <tsimpson@quicinc.com>

Currently, helpers can only take up to 6 arguments.  This patch adds the
capability for up to 7 arguments.  I have tested it with the Hexagon port
that I am preparing for submission.

Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <1580942510-2820-1-git-send-email-tsimpson@quicinc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-gen.h   | 13 +++++++++++++
 include/exec/helper-head.h  |  2 ++
 include/exec/helper-proto.h |  6 ++++++
 include/exec/helper-tcg.h   |  7 +++++++
 4 files changed, 28 insertions(+)

diff --git a/include/exec/helper-gen.h b/include/exec/helper-gen.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-gen.h
+++ b/include/exec/helper-gen.h
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
   tcg_gen_callN(HELPER(name), dh_retvar(ret), 6, args);                 \
 }
 
+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7)\
+static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+    dh_arg_decl(t1, 1),  dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),        \
+    dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
+    dh_arg_decl(t7, 7))                                                 \
+{                                                                       \
+  TCGTemp *args[7] = { dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),     \
+                     dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),       \
+                     dh_arg(t7, 7) };                                   \
+  tcg_gen_callN(HELPER(name), dh_retvar(ret), 7, args);                 \
+}
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "trace/generated-helpers-wrappers.h"
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 #undef GEN_HELPER
 
 #endif /* HELPER_GEN_H */
diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
     DEF_HELPER_FLAGS_5(name, 0, ret, t1, t2, t3, t4, t5)
 #define DEF_HELPER_6(name, ret, t1, t2, t3, t4, t5, t6) \
     DEF_HELPER_FLAGS_6(name, 0, ret, t1, t2, t3, t4, t5, t6)
+#define DEF_HELPER_7(name, ret, t1, t2, t3, t4, t5, t6, t7) \
+    DEF_HELPER_FLAGS_7(name, 0, ret, t1, t2, t3, t4, t5, t6, t7)
 
 /* MAX_OPC_PARAM_IARGS must be set to n if last entry is DEF_HELPER_FLAGS_n. */
 
diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-proto.h
+++ b/include/exec/helper-proto.h
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
                             dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
 
+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
+dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
+                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
+                            dh_ctype(t7));
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 
 #endif /* HELPER_PROTO_H */
diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-tcg.h
+++ b/include/exec/helper-tcg.h
@@ -XXX,XX +XXX,XX @@
     | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
     | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
 
+#define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
+  { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
+    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
+    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
+    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 
 #endif /* HELPER_TCG_H */
-- 
2.20.1

Extend the vector generator infrastructure to handle
5 vector arguments.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h |  7 +++++++
 tcg/tcg-op-gvec.c         | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                         uint32_t maxsz, int32_t data,
                         gen_helper_gvec_4_ptr *fn);
 
+typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
+                                   TCGv_ptr, TCGv_ptr, TCGv_i32);
+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_5_ptr *fn);
+
 /* Expand a gvec operation.  Either inline or out-of-line depending on
    the actual vector size and the operations supported by the host.  */
 typedef struct {
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_temp_free_i32(desc);
 }
 
+/* Generate a call to a gvec-style helper with five vector operands
+   and an extra pointer operand.  */
+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_5_ptr *fn)
+{
+    TCGv_ptr a0, a1, a2, a3, a4;
+    TCGv_i32 desc = tcg_const_i32(simd_desc(oprsz, maxsz, data));
+
+    a0 = tcg_temp_new_ptr();
+    a1 = tcg_temp_new_ptr();
+    a2 = tcg_temp_new_ptr();
+    a3 = tcg_temp_new_ptr();
+    a4 = tcg_temp_new_ptr();
+
+    tcg_gen_addi_ptr(a0, cpu_env, dofs);
+    tcg_gen_addi_ptr(a1, cpu_env, aofs);
+    tcg_gen_addi_ptr(a2, cpu_env, bofs);
+    tcg_gen_addi_ptr(a3, cpu_env, cofs);
+    tcg_gen_addi_ptr(a4, cpu_env, eofs);
+
+    fn(a0, a1, a2, a3, a4, ptr, desc);
+
+    tcg_temp_free_ptr(a0);
+    tcg_temp_free_ptr(a1);
+    tcg_temp_free_ptr(a2);
+    tcg_temp_free_ptr(a3);
+    tcg_temp_free_ptr(a4);
+    tcg_temp_free_i32(desc);
+}
+
 /* Return true if we want to implement something of OPRSZ bytes
    in units of LNSZ.  This limits the expansion of inline code.  */
 static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
-- 
2.20.1

V2 fixes an error in patch 22 wrt MacOS.
It's a shame we don't have public CI for that.

The following changes since commit 894fc4fd670aaf04a67dc7507739f914ff4bacf2:

Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging (2021-06-11 09:21:48 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210613

for you to fetch changes up to a5a8b84772e13066c6c45f480cc5b5312bbde08e:

docs/devel: Explain in more detail the TB chaining mechanisms (2021-06-13 17:42:40 -0700)

----------------------------------------------------------------
Clean up code_gen_buffer allocation.
Add tcg_remove_ops_after.
Fix tcg_constant_* documentation.
Improve TB chaining documentation.
Fix float32_exp2.
Fix arm tcg_out_op function signature.

----------------------------------------------------------------
Jose R. Ziviani (1):
      tcg/arm: Fix tcg_out_op function signature

Luis Pires (1):
      docs/devel: Explain in more detail the TB chaining mechanisms

Richard Henderson (32):
      meson: Split out tcg/meson.build
      meson: Split out fpu/meson.build
      tcg: Re-order tcg_region_init vs tcg_prologue_init
      tcg: Remove error return from tcg_region_initial_alloc__locked
      tcg: Split out tcg_region_initial_alloc
      tcg: Split out tcg_region_prologue_set
      tcg: Split out region.c
      accel/tcg: Inline cpu_gen_init
      accel/tcg: Move alloc_code_gen_buffer to tcg/region.c
      accel/tcg: Rename tcg_init to tcg_init_machine
      tcg: Create tcg_init
      accel/tcg: Merge tcg_exec_init into tcg_init_machine
      accel/tcg: Use MiB in tcg_init_machine
      accel/tcg: Pass down max_cpus to tcg_init
      tcg: Introduce tcg_max_ctxs
      tcg: Move MAX_CODE_GEN_BUFFER_SIZE to tcg-target.h
      tcg: Replace region.end with region.total_size
      tcg: Rename region.start to region.after_prologue
      tcg: Tidy tcg_n_regions
      tcg: Tidy split_cross_256mb
      tcg: Move in_code_gen_buffer and tests to region.c
      tcg: Allocate code_gen_buffer into struct tcg_region_state
      tcg: Return the map protection from alloc_code_gen_buffer
      tcg: Sink qemu_madvise call to common code
      util/osdep: Add qemu_mprotect_rw
      tcg: Round the tb_size default from qemu_get_host_physmem
      tcg: Merge buffer protection and guard page protection
      tcg: When allocating for !splitwx, begin with PROT_NONE
      tcg: Move tcg_init_ctx and tcg_ctx from accel/tcg/
      tcg: Introduce tcg_remove_ops_after
      tcg: Fix documentation for tcg_constant_* vs tcg_temp_free_*
      softfloat: Fix tp init in float32_exp2

Do not mess around with setting values within tcg_init_ctx.
Put the values into 'region' directly, which is where they
will live for the lifetime of the program.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Luis Pires <luis.pires@eldorado.org.br>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/region.c | 64 ++++++++++++++++++++++------------------------------
 1 file changed, 27 insertions(+), 37 deletions(-)

diff --git a/tcg/region.c b/tcg/region.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -XXX,XX +XXX,XX @@ static size_t tree_size;
 
 bool in_code_gen_buffer(const void *p)
 {
-    const TCGContext *s = &tcg_init_ctx;
     /*
      * Much like it is valid to have a pointer to the byte past the
      * end of an array (so long as you don't dereference it), allow
      * a pointer to the byte past the end of the code gen buffer.
      */
-    return (size_t)(p - s->code_gen_buffer) <= s->code_gen_buffer_size;
+    return (size_t)(p - region.start_aligned) <= region.total_size;
 }
 
 #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
     }
     qemu_madvise(buf, size, QEMU_MADV_HUGEPAGE);
 
-    tcg_ctx->code_gen_buffer = buf;
-    tcg_ctx->code_gen_buffer_size = size;
+    region.start_aligned = buf;
+    region.total_size = size;
     return true;
 }
 #elif defined(_WIN32)
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
         return false;
     }
 
-    tcg_ctx->code_gen_buffer = buf;
-    tcg_ctx->code_gen_buffer_size = size;
+    region.start_aligned = buf;
+    region.total_size = size;
     return true;
 }
 #else
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_anon(size_t size, int prot,
     /* Request large pages for the buffer.  */
     qemu_madvise(buf, size, QEMU_MADV_HUGEPAGE);
 
-    tcg_ctx->code_gen_buffer = buf;
-    tcg_ctx->code_gen_buffer_size = size;
+    region.start_aligned = buf;
+    region.total_size = size;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
         return false;
     }
     /* The size of the mapping may have been adjusted. */
-    size = tcg_ctx->code_gen_buffer_size;
-    buf_rx = tcg_ctx->code_gen_buffer;
+    buf_rx = region.start_aligned;
+    size = region.total_size;
 #endif
 
     buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
 #endif
 
     close(fd);
-    tcg_ctx->code_gen_buffer = buf_rw;
-    tcg_ctx->code_gen_buffer_size = size;
+    region.start_aligned = buf_rw;
+    region.total_size = size;
     tcg_splitwx_diff = buf_rx - buf_rw;
 
     /* Request large pages for the buffer and the splitwx.  */
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_vmremap(size_t size, Error **errp)
         return false;
     }
 
-    buf_rw = (mach_vm_address_t)tcg_ctx->code_gen_buffer;
+    buf_rw = (mach_vm_address_t)region.start_aligned;
     buf_rx = 0;
     ret = mach_vm_remap(mach_task_self(),
                         &buf_rx,
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
  */
 void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
 {
-    void *buf, *aligned, *end;
-    size_t total_size;
     size_t page_size;
     size_t region_size;
-    size_t n_regions;
     size_t i;
     bool ok;
 
@@ -XXX,XX +XXX,XX @@ void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
                                splitwx, &error_fatal);
     assert(ok);
 
-    buf = tcg_init_ctx.code_gen_buffer;
-    total_size = tcg_init_ctx.code_gen_buffer_size;
-    page_size = qemu_real_host_page_size;
-    n_regions = tcg_n_regions(total_size, max_cpus);
-
-    /* The first region will be 'aligned - buf' bytes larger than the others */
-    aligned = QEMU_ALIGN_PTR_UP(buf, page_size);
-    g_assert(aligned < tcg_init_ctx.code_gen_buffer + total_size);
-
     /*
      * Make region_size a multiple of page_size, using aligned as the start.
      * As a result of this we might end up with a few extra pages at the end of
      * the buffer; we will assign those to the last region.
      */
-    region_size = (total_size - (aligned - buf)) / n_regions;
+    region.n = tcg_n_regions(region.total_size, max_cpus);
+    page_size = qemu_real_host_page_size;
+    region_size = region.total_size / region.n;
     region_size = QEMU_ALIGN_DOWN(region_size, page_size);
 
     /* A region must have at least 2 pages; one code, one guard */
     g_assert(region_size >= 2 * page_size);
+    region.stride = region_size;
+
+    /* Reserve space for guard pages. */
+    region.size = region_size - page_size;
+    region.total_size -= page_size;
+
+    /*
+     * The first region will be smaller than the others, via the prologue,
+     * which has yet to be allocated.  For now, the first region begins at
+     * the page boundary.
+     */
+    region.after_prologue = region.start_aligned;
 
     /* init the region struct */
     qemu_mutex_init(&region.lock);
-    region.n = n_regions;
-    region.size = region_size - page_size;
-    region.stride = region_size;
-    region.after_prologue = buf;
-    region.start_aligned = aligned;
-    /* page-align the end, since its last page will be a guard page */
-    end = QEMU_ALIGN_PTR_DOWN(buf + total_size, page_size);
-    /* account for that last guard page */
-    end -= page_size;
-    total_size = end - aligned;
-    region.total_size = total_size;
 
     /*
      * Set guard pages in the rw buffer, as that's the one into which
-- 
2.25.1