Series comparison

-[PULL 0/3] tcg patch queue
+[PULL 0/9] tcg patch queue
-The following changes since commit e18e5501d8ac692d32657a3e1ef545b14e72b730:
+Note that I've extended the expiration date of my gpg key
 and have uploaded it to keyserver.ubuntu.com.
-  Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20200210' into staging (2020-02-10 18:09:14 +0000)
 r~
 The following changes since commit 99c44988d5ba1866a411450c877ed818b1b70081:
   Merge remote-tracking branch 'remotes/bsdimp/tags/pull-bsd-user-20210910' into staging (2021-09-11 14:00:39 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20200212
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210912
-for you to fetch changes up to 2445971604c1cfd3ec484457159f4ac300fb04d2:
+for you to fetch changes up to 267a3ec3e2a8fb3e06a9d46d09fcfc57dfefd118:
-  tcg: Add tcg_gen_gvec_5_ptr (2020-02-12 14:58:36 -0800)
+  tcg/arm: Fix tcg_out_vec_op function signature (2021-09-12 05:07:36 -0700)
 ----------------------------------------------------------------
-Fix breakpoint invalidation.
+Fix translation race condition for user-only.
-Add support for tcg helpers with 7 arguments.
+Fix tcg/i386 encoding for VPSLLVQ, VPSRLVQ.
-Add support for gvec helpers with 5 arguments.
+Fix tcg/arm tcg_out_vec_op signature.
 Fix tcg/ppc (32bit) build with clang.
 Remove dupluate TCG_KICK_PERIOD definition.
 Remove unused tcg_global_reg_new.
 Use __builtin_bswap*.
 ----------------------------------------------------------------
-Max Filippov (1):
+Bin Meng (1):
-      exec: flush CPU TB cache in breakpoint_invalidate
+      tcg: Remove tcg_global_reg_new defines
-Richard Henderson (1):
+Ilya Leoshkevich (2):
-      tcg: Add tcg_gen_gvec_5_ptr
+      accel/tcg: Add DisasContextBase argument to translator_ld*
       accel/tcg: Clear PAGE_WRITE before translation
-Taylor Simpson (1):
+Jose R. Ziviani (1):
-      tcg: Add support for a helper with 7 arguments
+      tcg/arm: Fix tcg_out_vec_op function signature
- include/exec/helper-gen.h   | 13 +++++++++++++
+Luc Michel (1):
- include/exec/helper-head.h  |  2 ++
+      accel/tcg: remove redundant TCG_KICK_PERIOD define
  include/exec/helper-proto.h |  6 ++++++
  include/exec/helper-tcg.h   |  7 +++++++
  include/tcg/tcg-op-gvec.h   |  7 +++++++
  exec.c                      | 15 +++++++--------
  tcg/tcg-op-gvec.c           | 32 ++++++++++++++++++++++++++++++++
 files changed, 74 insertions(+), 8 deletions(-)
+Richard Henderson (4):
+      tcg/i386: Split P_VEXW from P_REXW
+      include/qemu: Use builtins for bswap
+      tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
+      tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF
+ meson.build                               |  6 ----
+ include/exec/translate-all.h              |  1 +
+ include/exec/translator.h                 | 44 +++++++++++++----------
+ include/qemu/bswap.h                      | 53 ++-------------------------
+ include/tcg/tcg-op.h                      |  2 --
+ target/arm/arm_ldst.h                     | 12 +++----
+ accel/tcg/tcg-accel-ops-rr.c              |  2 --
+ accel/tcg/translate-all.c                 | 59 ++++++++++++++++++-------------
+ accel/tcg/translator.c                    | 39 ++++++++++++++++++++
+ target/alpha/translate.c                  |  2 +-
+ target/arm/translate-a64.c                |  2 +-
+ target/arm/translate.c                    |  9 ++---
+ target/hexagon/translate.c                |  3 +-
+ target/hppa/translate.c                   |  5 +--
+ target/i386/tcg/translate.c               | 10 +++---
+ target/m68k/translate.c                   |  2 +-
+ target/mips/tcg/translate.c               |  8 ++---
+ target/openrisc/translate.c               |  2 +-
+ target/ppc/translate.c                    |  5 +--
+ target/riscv/translate.c                  |  5 +--
+ target/s390x/tcg/translate.c              | 16 +++++----
+ target/sh4/translate.c                    |  4 +--
+ target/sparc/translate.c                  |  2 +-
+ target/xtensa/translate.c                 |  5 +--
+ target/mips/tcg/micromips_translate.c.inc |  2 +-
+ target/mips/tcg/mips16e_translate.c.inc   |  4 +--
+ target/mips/tcg/nanomips_translate.c.inc  |  4 +--
+ tcg/arm/tcg-target.c.inc                  |  3 +-
+ tcg/i386/tcg-target.c.inc                 | 13 +++----
+ tcg/ppc/tcg-target.c.inc                  | 25 ++++++++++---
+files changed, 185 insertions(+), 164 deletions(-)

-New patch
+[PULL 1/9] accel/tcg: Add DisasContextBase argument to translator_ld*
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+[rth: Split out of a larger patch.]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/translator.h                 |  9 +++++----
+ target/arm/arm_ldst.h                     | 12 ++++++------
+ target/alpha/translate.c                  |  2 +-
+ target/arm/translate-a64.c                |  2 +-
+ target/arm/translate.c                    |  9 +++++----
+ target/hexagon/translate.c                |  3 ++-
+ target/hppa/translate.c                   |  2 +-
+ target/i386/tcg/translate.c               | 10 +++++-----
+ target/m68k/translate.c                   |  2 +-
+ target/mips/tcg/translate.c               |  8 ++++----
+ target/openrisc/translate.c               |  2 +-
+ target/ppc/translate.c                    |  5 +++--
+ target/riscv/translate.c                  |  5 +++--
+ target/s390x/tcg/translate.c              | 16 +++++++++-------
+ target/sh4/translate.c                    |  4 ++--
+ target/sparc/translate.c                  |  2 +-
+ target/xtensa/translate.c                 |  5 +++--
+ target/mips/tcg/micromips_translate.c.inc |  2 +-
+ target/mips/tcg/mips16e_translate.c.inc   |  4 ++--
+ target/mips/tcg/nanomips_translate.c.inc  |  4 ++--
+files changed, 58 insertions(+), 50 deletions(-)
+diff --git a/include/exec/translator.h b/include/exec/translator.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/translator.h
++++ b/include/exec/translator.h
+@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
+ #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
+     static inline type                                                  \
+-    fullname ## _swap(CPUArchState *env, abi_ptr pc, bool do_swap)      \
++    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
++                      abi_ptr pc, bool do_swap)                         \
+     {                                                                   \
+         type ret = load_fn(env, pc);                                    \
+         if (do_swap) {                                                  \
+@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
+         plugin_insn_append(&ret, sizeof(ret));                          \
+         return ret;                                                     \
+     }                                                                   \
+-                                                                        \
+-    static inline type fullname(CPUArchState *env, abi_ptr pc)          \
++    static inline type fullname(CPUArchState *env,                      \
++                                DisasContextBase *dcbase, abi_ptr pc)   \
+     {                                                                   \
+-        return fullname ## _swap(env, pc, false);                       \
++        return fullname ## _swap(env, dcbase, pc, false);               \
+     }
+ GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
+diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arm_ldst.h
++++ b/target/arm/arm_ldst.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
+ /* Load an instruction and return it in the standard little-endian order */
+-static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
+-                                    bool sctlr_b)
++static inline uint32_t arm_ldl_code(CPUARMState *env, DisasContextBase *s,
++                                    target_ulong addr, bool sctlr_b)
+ {
+-    return translator_ldl_swap(env, addr, bswap_code(sctlr_b));
++    return translator_ldl_swap(env, s, addr, bswap_code(sctlr_b));
+ }
+ /* Ditto, for a halfword (Thumb) instruction */
+-static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
+-                                     bool sctlr_b)
++static inline uint16_t arm_lduw_code(CPUARMState *env, DisasContextBase* s,
++                                     target_ulong addr, bool sctlr_b)
+ {
+ #ifndef CONFIG_USER_ONLY
+     /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
+@@ -XXX,XX +XXX,XX @@ static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
+         addr ^= 2;
+     }
+ #endif
+-    return translator_lduw_swap(env, addr, bswap_code(sctlr_b));
++    return translator_lduw_swap(env, s, addr, bswap_code(sctlr_b));
+ }
+ #endif
+diff --git a/target/alpha/translate.c b/target/alpha/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/translate.c
++++ b/target/alpha/translate.c
+@@ -XXX,XX +XXX,XX @@ static void alpha_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+ {
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
+     CPUAlphaState *env = cpu->env_ptr;
+-    uint32_t insn = translator_ldl(env, ctx->base.pc_next);
++    uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
+     ctx->base.pc_next += 4;
+     ctx->base.is_jmp = translate_one(ctx, insn);
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
+     uint32_t insn;
+     s->pc_curr = s->base.pc_next;
+-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
++    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
+     s->insn = insn;
+     s->base.pc_next += 4;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
+      * boundary, so we cross the page if the first 16 bits indicate
+      * that this is a 32 bit insn.
+      */
+-    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
++    uint16_t insn = arm_lduw_code(env, &s->base, s->base.pc_next, s->sctlr_b);
+     return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
+ }
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+     }
+     dc->pc_curr = dc->base.pc_next;
+-    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
++    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
+     dc->insn = insn;
+     dc->base.pc_next += 4;
+     disas_arm_insn(dc, insn);
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+     }
+     dc->pc_curr = dc->base.pc_next;
+-    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
++    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
+     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
+     dc->base.pc_next += 2;
+     if (!is_16bit) {
+-        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
++        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
++                                       dc->sctlr_b);
+         insn = insn << 16 | insn2;
+         dc->base.pc_next += 2;
+diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/translate.c
++++ b/target/hexagon/translate.c
+@@ -XXX,XX +XXX,XX @@ static int read_packet_words(CPUHexagonState *env, DisasContext *ctx,
+     memset(words, 0, PACKET_WORDS_MAX * sizeof(uint32_t));
+     for (nwords = 0; !found_end && nwords < PACKET_WORDS_MAX; nwords++) {
+         words[nwords] =
+-            translator_ldl(env, ctx->base.pc_next + nwords * sizeof(uint32_t));
++            translator_ldl(env, &ctx->base,
++                           ctx->base.pc_next + nwords * sizeof(uint32_t));
+         found_end = is_packet_end(words[nwords]);
+     }
+     if (!found_end) {
+diff --git a/target/hppa/translate.c b/target/hppa/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/translate.c
++++ b/target/hppa/translate.c
+@@ -XXX,XX +XXX,XX @@ static void hppa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+     {
+         /* Always fetch the insn, even if nullified, so that we check
+            the page permissions for execute.  */
+-        uint32_t insn = translator_ldl(env, ctx->base.pc_next);
++        uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
+         /* Set up the IA queue for the next insn.
+            This will be overwritten by a branch.  */
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
+ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_ldub(env, advance_pc(env, s, 1));
++    return translator_ldub(env, &s->base, advance_pc(env, s, 1));
+ }
+ static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_ldsw(env, advance_pc(env, s, 2));
++    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+ }
+ static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_lduw(env, advance_pc(env, s, 2));
++    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
+ }
+ static inline uint32_t x86_ldl_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_ldl(env, advance_pc(env, s, 4));
++    return translator_ldl(env, &s->base, advance_pc(env, s, 4));
+ }
+ #ifdef TARGET_X86_64
+ static inline uint64_t x86_ldq_code(CPUX86State *env, DisasContext *s)
+ {
+-    return translator_ldq(env, advance_pc(env, s, 8));
++    return translator_ldq(env, &s->base, advance_pc(env, s, 8));
+ }
+ #endif
+diff --git a/target/m68k/translate.c b/target/m68k/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/translate.c
++++ b/target/m68k/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
+ static inline uint16_t read_im16(CPUM68KState *env, DisasContext *s)
+ {
+     uint16_t im;
+-    im = translator_lduw(env, s->pc);
++    im = translator_lduw(env, &s->base, s->pc);
+     s->pc += 2;
+     return im;
+ }
+diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/translate.c
++++ b/target/mips/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+     is_slot = ctx->hflags & MIPS_HFLAG_BMASK;
+     if (ctx->insn_flags & ISA_NANOMIPS32) {
+-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
++        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+         insn_bytes = decode_isa_nanomips(env, ctx);
+     } else if (!(ctx->hflags & MIPS_HFLAG_M16)) {
+-        ctx->opcode = translator_ldl(env, ctx->base.pc_next);
++        ctx->opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
+         insn_bytes = 4;
+         decode_opc(env, ctx);
+     } else if (ctx->insn_flags & ASE_MICROMIPS) {
+-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
++        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+         insn_bytes = decode_isa_micromips(env, ctx);
+     } else if (ctx->insn_flags & ASE_MIPS16) {
+-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
++        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+         insn_bytes = decode_ase_mips16e(env, ctx);
+     } else {
+         gen_reserved_instruction(ctx);
+diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/openrisc/translate.c
++++ b/target/openrisc/translate.c
+@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+ {
+     DisasContext *dc = container_of(dcbase, DisasContext, base);
+     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+-    uint32_t insn = translator_ldl(&cpu->env, dc->base.pc_next);
++    uint32_t insn = translator_ldl(&cpu->env, &dc->base, dc->base.pc_next);
+     if (!decode(dc, insn)) {
+         gen_illegal_exception(dc);
+diff --git a/target/ppc/translate.c b/target/ppc/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/translate.c
++++ b/target/ppc/translate.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+               ctx->base.pc_next, ctx->mem_idx, (int)msr_ir);
+     ctx->cia = pc = ctx->base.pc_next;
+-    insn = translator_ldl_swap(env, pc, need_byteswap(ctx));
++    insn = translator_ldl_swap(env, dcbase, pc, need_byteswap(ctx));
+     ctx->base.pc_next = pc += 4;
+     if (!is_prefix_insn(ctx, insn)) {
+@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+         gen_exception_err(ctx, POWERPC_EXCP_ALIGN, POWERPC_EXCP_ALIGN_INSN);
+         ok = true;
+     } else {
+-        uint32_t insn2 = translator_ldl_swap(env, pc, need_byteswap(ctx));
++        uint32_t insn2 = translator_ldl_swap(env, dcbase, pc,
++                                             need_byteswap(ctx));
+         ctx->base.pc_next = pc += 4;
+         ok = decode_insn64(ctx, deposit64(insn2, 32, 32, insn));
+     }
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+     } else {
+         uint32_t opcode32 = opcode;
+         opcode32 = deposit32(opcode32, 16, 16,
+-                             translator_lduw(env, ctx->base.pc_next + 2));
++                             translator_lduw(env, &ctx->base,
++                                             ctx->base.pc_next + 2));
+         ctx->pc_succ_insn = ctx->base.pc_next + 4;
+         if (!decode_insn32(ctx, opcode32)) {
+             gen_exception_illegal(ctx);
+@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+ {
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
+     CPURISCVState *env = cpu->env_ptr;
+-    uint16_t opcode16 = translator_lduw(env, ctx->base.pc_next);
++    uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+     decode_opc(env, ctx, opcode16);
+     ctx->base.pc_next = ctx->pc_succ_insn;
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/tcg/translate.c
++++ b/target/s390x/tcg/translate.c
+@@ -XXX,XX +XXX,XX @@ static void update_cc_op(DisasContext *s)
+     }
+ }
+-static inline uint64_t ld_code2(CPUS390XState *env, uint64_t pc)
++static inline uint64_t ld_code2(CPUS390XState *env, DisasContext *s,
++                                uint64_t pc)
+ {
+-    return (uint64_t)cpu_lduw_code(env, pc);
++    return (uint64_t)translator_lduw(env, &s->base, pc);
+ }
+-static inline uint64_t ld_code4(CPUS390XState *env, uint64_t pc)
++static inline uint64_t ld_code4(CPUS390XState *env, DisasContext *s,
++                                uint64_t pc)
+ {
+-    return (uint64_t)(uint32_t)cpu_ldl_code(env, pc);
++    return (uint64_t)(uint32_t)translator_ldl(env, &s->base, pc);
+ }
+ static int get_mem_index(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
+         ilen = s->ex_value & 0xf;
+         op = insn >> 56;
+     } else {
+-        insn = ld_code2(env, pc);
++        insn = ld_code2(env, s, pc);
+         op = (insn >> 8) & 0xff;
+         ilen = get_ilen(op);
+         switch (ilen) {
+@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
+             insn = insn << 48;
+             break;
+         case 4:
+-            insn = ld_code4(env, pc) << 32;
++            insn = ld_code4(env, s, pc) << 32;
+             break;
+         case 6:
+-            insn = (insn << 48) | (ld_code4(env, pc + 2) << 16);
++            insn = (insn << 48) | (ld_code4(env, s, pc + 2) << 16);
+             break;
+         default:
+             g_assert_not_reached();
+diff --git a/target/sh4/translate.c b/target/sh4/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/translate.c
++++ b/target/sh4/translate.c
+@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
+     /* Read all of the insns for the region.  */
+     for (i = 0; i < max_insns; ++i) {
+-        insns[i] = translator_lduw(env, pc + i * 2);
++        insns[i] = translator_lduw(env, &ctx->base, pc + i * 2);
+     }
+     ld_adr = ld_dst = ld_mop = -1;
+@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+     }
+ #endif
+-    ctx->opcode = translator_lduw(env, ctx->base.pc_next);
++    ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+     decode_opc(ctx);
+     ctx->base.pc_next += 2;
+ }
+diff --git a/target/sparc/translate.c b/target/sparc/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/translate.c
++++ b/target/sparc/translate.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
+     CPUSPARCState *env = cs->env_ptr;
+     unsigned int insn;
+-    insn = translator_ldl(env, dc->pc);
++    insn = translator_ldl(env, &dc->base, dc->pc);
+     dc->base.pc_next += 4;
+     disas_sparc_insn(dc, insn);
+diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/translate.c
++++ b/target/xtensa/translate.c
+@@ -XXX,XX +XXX,XX @@ static int arg_copy_compare(const void *a, const void *b)
+ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
+ {
+     xtensa_isa isa = dc->config->isa;
+-    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, dc->pc)};
++    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, &dc->base,
++                                                        dc->pc)};
+     unsigned len = xtensa_op0_insn_len(dc, b[0]);
+     xtensa_format fmt;
+     int slot, slots;
+@@ -XXX,XX +XXX,XX @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
+     dc->base.pc_next = dc->pc + len;
+     for (i = 1; i < len; ++i) {
+-        b[i] = translator_ldub(env, dc->pc + i);
++        b[i] = translator_ldub(env, &dc->base, dc->pc + i);
+     }
+     xtensa_insnbuf_from_chars(isa, dc->insnbuf, b, len);
+     fmt = xtensa_format_decode(isa, dc->insnbuf);
+diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/micromips_translate.c.inc
++++ b/target/mips/tcg/micromips_translate.c.inc
+@@ -XXX,XX +XXX,XX @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
+     uint32_t op, minor, minor2, mips32_op;
+     uint32_t cond, fmt, cc;
+-    insn = translator_lduw(env, ctx->base.pc_next + 2);
++    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+     ctx->opcode = (ctx->opcode << 16) | insn;
+     rt = (ctx->opcode >> 21) & 0x1f;
+diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/mips16e_translate.c.inc
++++ b/target/mips/tcg/mips16e_translate.c.inc
+@@ -XXX,XX +XXX,XX @@ static void decode_i64_mips16(DisasContext *ctx,
+ static int decode_extended_mips16_opc(CPUMIPSState *env, DisasContext *ctx)
+ {
+-    int extend = translator_lduw(env, ctx->base.pc_next + 2);
++    int extend = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+     int op, rx, ry, funct, sa;
+     int16_t imm, offset;
+@@ -XXX,XX +XXX,XX @@ static int decode_ase_mips16e(CPUMIPSState *env, DisasContext *ctx)
+         /* No delay slot, so just process as a normal instruction */
+         break;
+     case M16_OPC_JAL:
+-        offset = translator_lduw(env, ctx->base.pc_next + 2);
++        offset = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+         offset = (((ctx->opcode & 0x1f) << 21)
+                   | ((ctx->opcode >> 5) & 0x1f) << 16
+                   | offset) << 2;
+diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/nanomips_translate.c.inc
++++ b/target/mips/tcg/nanomips_translate.c.inc
+@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
+     int offset;
+     int imm;
+-    insn = translator_lduw(env, ctx->base.pc_next + 2);
++    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
+     ctx->opcode = (ctx->opcode << 16) | insn;
+     rt = extract32(ctx->opcode, 21, 5);
+@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
+         break;
+     case NM_P48I:
+         {
+-            insn = translator_lduw(env, ctx->base.pc_next + 4);
++            insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 4);
+             target_long addr_off = extract32(ctx->opcode, 0, 16) | insn << 16;
+             switch (extract32(ctx->opcode, 16, 5)) {
+             case NM_LI48:
+--
+.25.1

-New patch
+[PULL 2/9] accel/tcg: Clear PAGE_WRITE before translation
+From: Ilya Leoshkevich <iii@linux.ibm.com>
 translate_insn() implementations fetch instruction bytes piecemeal,
 which can cause qemu-user to generate inconsistent translations if
 another thread modifies them concurrently [1].
 Fix by making pages containing translated instruction non-writable
 right before loading instruction bytes from them.
 [1] https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg00644.html
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Message-Id: <20210805204835.158918-1-iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  include/exec/translate-all.h |  1 +
  include/exec/translator.h    | 39 ++++++++++++++----------
  accel/tcg/translate-all.c    | 59 +++++++++++++++++++++---------------
  accel/tcg/translator.c       | 39 ++++++++++++++++++++++++
 files changed, 97 insertions(+), 41 deletions(-)
 diff --git a/include/exec/translate-all.h b/include/exec/translate-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/translate-all.h
 +++ b/include/exec/translate-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
  void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
  #ifdef CONFIG_USER_ONLY
 +void page_protect(tb_page_addr_t page_addr);
  int page_unprotect(target_ulong address, uintptr_t pc);
  #endif
 diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/translator.h
 +++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "exec/cpu_ldst.h"
  #include "exec/plugin-gen.h"
 +#include "exec/translate-all.h"
  #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContextBase {
      int num_insns;
      int max_insns;
      bool singlestep_enabled;
 +#ifdef CONFIG_USER_ONLY
 +    /*
 +     * Guest address of the last byte of the last protected page.
 +     *
 +     * Pages containing the translated instructions are made non-writable in
 +     * order to achieve consistency in case another thread is modifying the
 +     * code while translate_insn() fetches the instruction bytes piecemeal.
 +     * Such writer threads are blocked on mmap_lock() in page_unprotect().
 +     */
 +    target_ulong page_protect_end;
 +#endif
  } DisasContextBase;
  /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
   */
  #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 -    static inline type                                                  \
 -    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
 -                      abi_ptr pc, bool do_swap)                         \
 -    {                                                                   \
 -        type ret = load_fn(env, pc);                                    \
 -        if (do_swap) {                                                  \
 -            ret = swap_fn(ret);                                         \
 -        }                                                               \
 -        plugin_insn_append(&ret, sizeof(ret));                          \
 -        return ret;                                                     \
 -    }                                                                   \
 +    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 +                           abi_ptr pc, bool do_swap);                   \
      static inline type fullname(CPUArchState *env,                      \
                                  DisasContextBase *dcbase, abi_ptr pc)   \
      {                                                                   \
          return fullname ## _swap(env, dcbase, pc, false);               \
      }
 -GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
 -GEN_TRANSLATOR_LD(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)
 -GEN_TRANSLATOR_LD(translator_lduw, uint16_t, cpu_lduw_code, bswap16)
 -GEN_TRANSLATOR_LD(translator_ldl, uint32_t, cpu_ldl_code, bswap32)
 -GEN_TRANSLATOR_LD(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +#define FOR_EACH_TRANSLATOR_LD(F)                                       \
 +    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 +    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
 +    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
 +    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
 +    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +
 +FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 +
  #undef GEN_TRANSLATOR_LD
  #endif  /* EXEC__TRANSLATOR_H */
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
      invalidate_page_bitmap(p);
  #if defined(CONFIG_USER_ONLY)
 -    if (p->flags & PAGE_WRITE) {
 -        target_ulong addr;
 -        PageDesc *p2;
 -        int prot;
 -
 -        /* force the host page as non writable (writes will have a
 -           page fault + mprotect overhead) */
 -        page_addr &= qemu_host_page_mask;
 -        prot = 0;
 -        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
 -            addr += TARGET_PAGE_SIZE) {
 -
 -            p2 = page_find(addr >> TARGET_PAGE_BITS);
 -            if (!p2) {
 -                continue;
 -            }
 -            prot |= p2->flags;
 -            p2->flags &= ~PAGE_WRITE;
 -          }
 -        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
 -                 (prot & PAGE_BITS) & ~PAGE_WRITE);
 -        if (DEBUG_TB_INVALIDATE_GATE) {
 -            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
 -        }
 -    }
 +    /* translator_loop() must have made all TB pages non-writable */
 +    assert(!(p->flags & PAGE_WRITE));
  #else
      /* if some code is already present, then the pages are already
         protected. So we handle the case where only the first TB is
@@ -XXX,XX +XXX,XX @@ int page_check_range(target_ulong start, target_ulong len, int flags)
      return 0;
  }
 +void page_protect(tb_page_addr_t page_addr)
 +{
 +    target_ulong addr;
 +    PageDesc *p;
 +    int prot;
 +
 +    p = page_find(page_addr >> TARGET_PAGE_BITS);
 +    if (p && (p->flags & PAGE_WRITE)) {
 +        /*
 +         * Force the host page as non writable (writes will have a page fault +
 +         * mprotect overhead).
 +         */
 +        page_addr &= qemu_host_page_mask;
 +        prot = 0;
 +        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
 +             addr += TARGET_PAGE_SIZE) {
 +
 +            p = page_find(addr >> TARGET_PAGE_BITS);
 +            if (!p) {
 +                continue;
 +            }
 +            prot |= p->flags;
 +            p->flags &= ~PAGE_WRITE;
 +        }
 +        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
 +                 (prot & PAGE_BITS) & ~PAGE_WRITE);
 +        if (DEBUG_TB_INVALIDATE_GATE) {
 +            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
 +        }
 +    }
 +}
 +
  /* called from signal handler: invalidate the code and unprotect the
   * page. Return 0 if the fault was not handled, 1 if it was handled,
   * and 2 if it was handled but the caller must cause the TB to be
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
      return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
  }
 +static inline void translator_page_protect(DisasContextBase *dcbase,
 +                                           target_ulong pc)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
 +    page_protect(pc);
 +#endif
 +}
 +
  void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
                       CPUState *cpu, TranslationBlock *tb, int max_insns)
  {
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
      db->num_insns = 0;
      db->max_insns = max_insns;
      db->singlestep_enabled = cflags & CF_SINGLE_STEP;
 +    translator_page_protect(db, db->pc_next);
      ops->init_disas_context(db, cpu);
      tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
      }
  #endif
  }
 +
 +static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
 +                                                 target_ulong pc, size_t len)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    target_ulong end = pc + len - 1;
 +
 +    if (end > dcbase->page_protect_end) {
 +        translator_page_protect(dcbase, end);
 +    }
 +#endif
 +}
 +
 +#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
 +    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
 +                           abi_ptr pc, bool do_swap)                    \
 +    {                                                                   \
 +        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
 +        type ret = load_fn(env, pc);                                    \
 +        if (do_swap) {                                                  \
 +            ret = swap_fn(ret);                                         \
 +        }                                                               \
 +        plugin_insn_append(&ret, sizeof(ret));                          \
 +        return ret;                                                     \
 +    }
 +
 +FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 +
 +#undef GEN_TRANSLATOR_LD
 --
 .25.1

-New patch
+[PULL 3/9] tcg/i386: Split P_VEXW from P_REXW
+We need to be able to represent VEX.W on a 32-bit host, where REX.W
+will always be zero.  Fixes the encoding for VPSLLVQ and VPSRLVQ.
+Fixes: a2ce146a068 ("tcg/i386: Support vector variable shift opcodes")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/385
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 13 +++++++------
+file changed, 7 insertions(+), 6 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define P_EXT        0x100        /* 0x0f opcode prefix */
+ #define P_EXT38         0x200           /* 0x0f 0x38 opcode prefix */
+ #define P_DATA16        0x400           /* 0x66 opcode prefix */
++#define P_VEXW          0x1000          /* Set VEX.W = 1 */
+ #if TCG_TARGET_REG_BITS == 64
+-# define P_REXW         0x1000          /* Set REX.W = 1 */
++# define P_REXW         P_VEXW          /* Set REX.W = 1; match VEXW */
+ # define P_REXB_R       0x2000          /* REG field as byte register */
+ # define P_REXB_RM      0x4000          /* R/M field as byte register */
+ # define P_GS           0x8000          /* gs segment override */
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_VPBROADCASTW (0x79 | P_EXT38 | P_DATA16)
+ #define OPC_VPBROADCASTD (0x58 | P_EXT38 | P_DATA16)
+ #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
+-#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_REXW)
++#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
+ #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
+ #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
+-#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_REXW)
++#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
+ #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
+ #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
+-#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_REXW)
++#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
+ #define OPC_VZEROUPPER  (0x77 | P_EXT)
+ #define OPC_XCHG_ax_r32    (0x90)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
+     /* Use the two byte form if possible, which cannot encode
+        VEX.W, VEX.B, VEX.X, or an m-mmmm field other than P_EXT.  */
+-    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_REXW)) == P_EXT
++    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_VEXW)) == P_EXT
+         && ((rm | index) & 8) == 0) {
+         /* Two byte VEX prefix.  */
+         tcg_out8(s, 0xc5);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
+         tmp |= (rm & 8 ? 0 : 0x20);            /* VEX.B */
+         tcg_out8(s, tmp);
+-        tmp = (opc & P_REXW ? 0x80 : 0);       /* VEX.W */
++        tmp = (opc & P_VEXW ? 0x80 : 0);       /* VEX.W */
+     }
+     tmp |= (opc & P_VEXL ? 0x04 : 0);      /* VEX.L */
+--
+.25.1

-New patch
+[PULL 4/9] accel/tcg: remove redundant TCG_KICK_PERIOD define
+From: Luc Michel <lmichel@kalray.eu>
+The TCG_KICK_PERIOD macro is already defined in tcg-accel-ops-rr.h.
+Remove it from tcg-accel-ops-rr.c.
+Signed-off-by: Luc Michel <lmichel@kalray.eu>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210811141229.12470-1-lmichel@kalray.eu>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/tcg-accel-ops-rr.c | 2 --
+file changed, 2 deletions(-)
+diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-accel-ops-rr.c
++++ b/accel/tcg/tcg-accel-ops-rr.c
+@@ -XXX,XX +XXX,XX @@ void rr_kick_vcpu_thread(CPUState *unused)
+ static QEMUTimer *rr_kick_vcpu_timer;
+ static CPUState *rr_current_cpu;
+-#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
+-
+ static inline int64_t rr_next_kick_time(void)
+ {
+     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + TCG_KICK_PERIOD;
+--
+.25.1

-New patch
+[PULL 5/9] tcg: Remove tcg_global_reg_new defines
+From: Bin Meng <bmeng.cn@gmail.com>
+Since commit 1c2adb958fc0 ("tcg: Initialize cpu_env generically"),
+these tcg_global_reg_new_ macros are not used anywhere.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20210816143507.11200-1-bmeng.cn@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/tcg/tcg-op.h    | 2 --
+ target/hppa/translate.c | 3 ---
+files changed, 5 deletions(-)
+diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/tcg/tcg-op.h
++++ b/include/tcg/tcg-op.h
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
+ #if TARGET_LONG_BITS == 32
+ #define tcg_temp_new() tcg_temp_new_i32()
+-#define tcg_global_reg_new tcg_global_reg_new_i32
+ #define tcg_global_mem_new tcg_global_mem_new_i32
+ #define tcg_temp_local_new() tcg_temp_local_new_i32()
+ #define tcg_temp_free tcg_temp_free_i32
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
+ #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i32
+ #else
+ #define tcg_temp_new() tcg_temp_new_i64()
+-#define tcg_global_reg_new tcg_global_reg_new_i64
+ #define tcg_global_mem_new tcg_global_mem_new_i64
+ #define tcg_temp_local_new() tcg_temp_local_new_i64()
+ #define tcg_temp_free tcg_temp_free_i64
+diff --git a/target/hppa/translate.c b/target/hppa/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/translate.c
++++ b/target/hppa/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #undef TCGv
+ #undef tcg_temp_new
+-#undef tcg_global_reg_new
+ #undef tcg_global_mem_new
+ #undef tcg_temp_local_new
+ #undef tcg_temp_free
+@@ -XXX,XX +XXX,XX @@
+ #define TCGv_reg             TCGv_i64
+ #define tcg_temp_new         tcg_temp_new_i64
+-#define tcg_global_reg_new   tcg_global_reg_new_i64
+ #define tcg_global_mem_new   tcg_global_mem_new_i64
+ #define tcg_temp_local_new   tcg_temp_local_new_i64
+ #define tcg_temp_free        tcg_temp_free_i64
+@@ -XXX,XX +XXX,XX @@
+ #else
+ #define TCGv_reg             TCGv_i32
+ #define tcg_temp_new         tcg_temp_new_i32
+-#define tcg_global_reg_new   tcg_global_reg_new_i32
+ #define tcg_global_mem_new   tcg_global_mem_new_i32
+ #define tcg_temp_local_new   tcg_temp_local_new_i32
+ #define tcg_temp_free        tcg_temp_free_i32
+--
+.25.1

-[PULL 3/3] tcg: Add tcg_gen_gvec_5_ptr
+[PULL 6/9] include/qemu: Use builtins for bswap
-Extend the vector generator infrastructure to handle
+All supported compilers have builtins for this.
-vector arguments.
+Drop all of the complicated system detection stuff.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-Id: <20210708181743.750220-1-richard.henderson@linaro.org>
 Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-op-gvec.h |  7 +++++++
+ meson.build          |  6 -----
- tcg/tcg-op-gvec.c         | 32 ++++++++++++++++++++++++++++++++
+ include/qemu/bswap.h | 53 +++-----------------------------------------
-files changed, 39 insertions(+)
+files changed, 3 insertions(+), 56 deletions(-)
-diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-op-gvec.h
+--- a/meson.build
-+++ b/include/tcg/tcg-op-gvec.h
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul'))
-                         uint32_t maxsz, int32_t data,
+ config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
-                         gen_helper_gvec_4_ptr *fn);
+ # has_header_symbol
-+typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
+-config_host_data.set('CONFIG_BYTESWAP_H',
-+                                   TCGv_ptr, TCGv_ptr, TCGv_i32);
+-                     cc.has_header_symbol('byteswap.h', 'bswap_32'))
-+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+ config_host_data.set('CONFIG_EPOLL_CREATE1',
-+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+                      cc.has_header_symbol('sys/epoll.h', 'epoll_create1'))
-+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+ config_host_data.set('CONFIG_HAS_ENVIRON',
-+                        gen_helper_gvec_5_ptr *fn);
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_INOTIFY',
-+
+                      cc.has_header_symbol('sys/inotify.h', 'inotify_init'))
- /* Expand a gvec operation.  Either inline or out-of-line depending on
+ config_host_data.set('CONFIG_INOTIFY1',
-    the actual vector size and the operations supported by the host.  */
+                      cc.has_header_symbol('sys/inotify.h', 'inotify_init1'))
- typedef struct {
+-config_host_data.set('CONFIG_MACHINE_BSWAP_H',
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
+-                     cc.has_header_symbol('machine/bswap.h', 'bswap32',
 -                                          prefix: '''#include <sys/endian.h>
 -                                                     #include <sys/types.h>'''))
  config_host_data.set('CONFIG_PRCTL_PR_SET_TIMERSLACK',
                       cc.has_header_symbol('sys/prctl.h', 'PR_SET_TIMERSLACK'))
  config_host_data.set('CONFIG_RTNETLINK',
 diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
+--- a/include/qemu/bswap.h
-+++ b/tcg/tcg-op-gvec.c
++++ b/include/qemu/bswap.h
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+@@ -XXX,XX +XXX,XX @@
-     tcg_temp_free_i32(desc);
+ #ifndef BSWAP_H
  #define BSWAP_H
 -#ifdef CONFIG_MACHINE_BSWAP_H
 -# include <sys/endian.h>
 -# include <machine/bswap.h>
 -#elif defined(__FreeBSD__)
 -# include <sys/endian.h>
 -#elif defined(__HAIKU__)
 -# include <endian.h>
 -#elif defined(CONFIG_BYTESWAP_H)
 -# include <byteswap.h>
 -#define BSWAP_FROM_BYTESWAP
 -# else
 -#define BSWAP_FROM_FALLBACKS
 -#endif /* ! CONFIG_MACHINE_BSWAP_H */
 -
  #ifdef __cplusplus
  extern "C" {
  #endif
  #include "fpu/softfloat-types.h"
 -#ifdef BSWAP_FROM_BYTESWAP
  static inline uint16_t bswap16(uint16_t x)
  {
 -    return bswap_16(x);
 +    return __builtin_bswap16(x);
  }
-+/* Generate a call to a gvec-style helper with five vector operands
+ static inline uint32_t bswap32(uint32_t x)
-+   and an extra pointer operand.  */
+ {
-+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+-    return bswap_32(x);
-+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
++    return __builtin_bswap32(x);
-+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+ }
-+                        gen_helper_gvec_5_ptr *fn)
-+{
+ static inline uint64_t bswap64(uint64_t x)
-+    TCGv_ptr a0, a1, a2, a3, a4;
+ {
-+    TCGv_i32 desc = tcg_const_i32(simd_desc(oprsz, maxsz, data));
+-    return bswap_64(x);
-+
++    return __builtin_bswap64(x);
-+    a0 = tcg_temp_new_ptr();
+ }
-+    a1 = tcg_temp_new_ptr();
+-#endif
-+    a2 = tcg_temp_new_ptr();
+-
-+    a3 = tcg_temp_new_ptr();
+-#ifdef BSWAP_FROM_FALLBACKS
-+    a4 = tcg_temp_new_ptr();
+-static inline uint16_t bswap16(uint16_t x)
-+
+-{
-+    tcg_gen_addi_ptr(a0, cpu_env, dofs);
+-    return (((x & 0x00ff) << 8) |
-+    tcg_gen_addi_ptr(a1, cpu_env, aofs);
+-            ((x & 0xff00) >> 8));
-+    tcg_gen_addi_ptr(a2, cpu_env, bofs);
+-}
-+    tcg_gen_addi_ptr(a3, cpu_env, cofs);
+-
-+    tcg_gen_addi_ptr(a4, cpu_env, eofs);
+-static inline uint32_t bswap32(uint32_t x)
-+
+-{
-+    fn(a0, a1, a2, a3, a4, ptr, desc);
+-    return (((x & 0x000000ffU) << 24) |
-+
+-            ((x & 0x0000ff00U) <<  8) |
-+    tcg_temp_free_ptr(a0);
+-            ((x & 0x00ff0000U) >>  8) |
-+    tcg_temp_free_ptr(a1);
+-            ((x & 0xff000000U) >> 24));
-+    tcg_temp_free_ptr(a2);
+-}
-+    tcg_temp_free_ptr(a3);
+-
-+    tcg_temp_free_ptr(a4);
+-static inline uint64_t bswap64(uint64_t x)
-+    tcg_temp_free_i32(desc);
+-{
-+}
+-    return (((x & 0x00000000000000ffULL) << 56) |
-+
+-            ((x & 0x000000000000ff00ULL) << 40) |
- /* Return true if we want to implement something of OPRSZ bytes
+-            ((x & 0x0000000000ff0000ULL) << 24) |
-    in units of LNSZ.  This limits the expansion of inline code.  */
+-            ((x & 0x00000000ff000000ULL) <<  8) |
- static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
+-            ((x & 0x000000ff00000000ULL) >>  8) |
 -            ((x & 0x0000ff0000000000ULL) >> 24) |
 -            ((x & 0x00ff000000000000ULL) >> 40) |
 -            ((x & 0xff00000000000000ULL) >> 56));
 -}
 -#endif
 -
 -#undef BSWAP_FROM_BYTESWAP
 -#undef BSWAP_FROM_FALLBACKS
  static inline void bswap16s(uint16_t *s)
  {
 --
-.20.1
+.25.1

-New patch
+[PULL 7/9] tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
+If __APPLE__, ensure that _CALL_DARWIN is set, then remove
+our local TCG_TARGET_CALL_DARWIN.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/ppc/tcg-target.c.inc | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+ #include "elf.h"
+ #include "../tcg-pool.c.inc"
+-#if defined _CALL_DARWIN || defined __APPLE__
+-#define TCG_TARGET_CALL_DARWIN
++#if !defined _CALL_DARWIN && defined __APPLE__
++#define _CALL_DARWIN 1
+ #endif
+ #ifdef _CALL_SYSV
+ # define TCG_TARGET_CALL_ALIGN_ARGS   1
+@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
+ };
+ static const int tcg_target_callee_save_regs[] = {
+-#ifdef TCG_TARGET_CALL_DARWIN
++#ifdef _CALL_DARWIN
+     TCG_REG_R11,
+ #endif
+     TCG_REG_R14,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
+ # define LINK_AREA_SIZE                (6 * SZR)
+ # define LR_OFFSET                     (1 * SZR)
+ # define TCG_TARGET_CALL_STACK_OFFSET  (LINK_AREA_SIZE + 8 * SZR)
+-#elif defined(TCG_TARGET_CALL_DARWIN)
++#elif defined(_CALL_DARWIN)
+ # define LINK_AREA_SIZE                (6 * SZR)
+ # define LR_OFFSET                     (2 * SZR)
+ #elif TCG_TARGET_REG_BITS == 64
+--
+.25.1

-[PULL 2/3] tcg: Add support for a helper with 7 arguments
+[PULL 8/9] tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF
-From: Taylor Simpson <tsimpson@quicinc.com>
+Clang only sets _CALL_ELF for ppc64, and nothing at all to specify
 the ABI for ppc32.  Make a good guess based on other symbols.
-Currently, helpers can only take up to 6 arguments.  This patch adds the
+Reported-by: Brad Smith <brad@comstyle.com>
 capability for up to 7 arguments.  I have tested it with the Hexagon port
 that I am preparing for submission.
 Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
 Message-Id: <1580942510-2820-1-git-send-email-tsimpson@quicinc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/helper-gen.h   | 13 +++++++++++++
+ tcg/ppc/tcg-target.c.inc | 21 ++++++++++++++++++---
- include/exec/helper-head.h  |  2 ++
+file changed, 18 insertions(+), 3 deletions(-)
  include/exec/helper-proto.h |  6 ++++++
  include/exec/helper-tcg.h   |  7 +++++++
 files changed, 28 insertions(+)
-diff --git a/include/exec/helper-gen.h b/include/exec/helper-gen.h
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/helper-gen.h
+--- a/tcg/ppc/tcg-target.c.inc
-+++ b/include/exec/helper-gen.h
++++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+@@ -XXX,XX +XXX,XX @@
-   tcg_gen_callN(HELPER(name), dh_retvar(ret), 6, args);                 \
+ #include "elf.h"
- }
+ #include "../tcg-pool.c.inc"
-+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7)\
+-#if !defined _CALL_DARWIN && defined __APPLE__
-+static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+-#define _CALL_DARWIN 1
-+    dh_arg_decl(t1, 1),  dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),        \
+-#endif
-+    dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
++/*
-+    dh_arg_decl(t7, 7))                                                 \
++ * Standardize on the _CALL_FOO symbols used by GCC:
-+{                                                                       \
++ * Apple XCode does not define _CALL_DARWIN.
-+  TCGTemp *args[7] = { dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),     \
++ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
-+                     dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),       \
++ */
-+                     dh_arg(t7, 7) };                                   \
++#if !defined(_CALL_SYSV) && \
-+  tcg_gen_callN(HELPER(name), dh_retvar(ret), 7, args);                 \
++    !defined(_CALL_DARWIN) && \
-+}
++    !defined(_CALL_AIX) && \
 +    !defined(_CALL_ELF)
 +# if defined(__APPLE__)
 +#  define _CALL_DARWIN
 +# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
 +#  define _CALL_SYSV
 +# else
 +#  error "Unknown ABI"
 +# endif
 +#endif
 +
- #include "helper.h"
+ #ifdef _CALL_SYSV
- #include "trace/generated-helpers.h"
+ # define TCG_TARGET_CALL_ALIGN_ARGS   1
- #include "trace/generated-helpers-wrappers.h"
+ #endif
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
  #undef DEF_HELPER_FLAGS_4
  #undef DEF_HELPER_FLAGS_5
  #undef DEF_HELPER_FLAGS_6
 +#undef DEF_HELPER_FLAGS_7
  #undef GEN_HELPER
  #endif /* HELPER_GEN_H */
 diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-head.h
 +++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
      DEF_HELPER_FLAGS_5(name, 0, ret, t1, t2, t3, t4, t5)
  #define DEF_HELPER_6(name, ret, t1, t2, t3, t4, t5, t6) \
      DEF_HELPER_FLAGS_6(name, 0, ret, t1, t2, t3, t4, t5, t6)
 +#define DEF_HELPER_7(name, ret, t1, t2, t3, t4, t5, t6, t7) \
 +    DEF_HELPER_FLAGS_7(name, 0, ret, t1, t2, t3, t4, t5, t6, t7)
  /* MAX_OPC_PARAM_IARGS must be set to n if last entry is DEF_HELPER_FLAGS_n. */
 diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-proto.h
 +++ b/include/exec/helper-proto.h
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
  dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
                              dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
 +#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
 +dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 +                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
 +                            dh_ctype(t7));
 +
  #include "helper.h"
  #include "trace/generated-helpers.h"
  #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
  #undef DEF_HELPER_FLAGS_4
  #undef DEF_HELPER_FLAGS_5
  #undef DEF_HELPER_FLAGS_6
 +#undef DEF_HELPER_FLAGS_7
  #endif /* HELPER_PROTO_H */
 diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-tcg.h
 +++ b/include/exec/helper-tcg.h
@@ -XXX,XX +XXX,XX @@
      | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
      | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
 +#define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
 +  { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
 +    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
 +    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
 +    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
 +
  #include "helper.h"
  #include "trace/generated-helpers.h"
  #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@
  #undef DEF_HELPER_FLAGS_4
  #undef DEF_HELPER_FLAGS_5
  #undef DEF_HELPER_FLAGS_6
 +#undef DEF_HELPER_FLAGS_7
  #endif /* HELPER_TCG_H */
 --
-.20.1
+.25.1

-[PULL 1/3] exec: flush CPU TB cache in breakpoint_invalidate
+[PULL 9/9] tcg/arm: Fix tcg_out_vec_op function signature
-From: Max Filippov <jcmvbkbc@gmail.com>
+From: "Jose R. Ziviani" <jziviani@suse.de>
-When a breakpoint is inserted at location for which there's currently no
+Commit 5e8892db93 fixed several function signatures but tcg_out_vec_op
-virtual to physical translation no action is taken on CPU TB cache. If a
+for arm is missing. It causes a build error on armv6 and armv7:
 TB for that virtual address already exists but is not visible ATM the
 breakpoint won't be hit next time an instruction at that address will be
 executed.
-Flush entire CPU TB cache in breakpoint_invalidate to force
+tcg-target.c.inc:2718:42: error: argument 5 of type 'const TCGArg *'
-re-translation of all TBs for the breakpoint address.
+{aka 'const unsigned int *'} declared as a pointer [-Werror=array-parameter=]
    const TCGArg *args, const int *const_args)
   ~~~~~~~~~~~~~~^~~~
 ../tcg/tcg.c:120:41: note: previously declared as an array 'const TCGArg[16]'
 {aka 'const unsigned int[16]'}
    const TCGArg args[TCG_MAX_OP_ARGS],
   ~~~~~~~~~~~~~~^~~~
-This change fixes the following scenario:
+Signed-off-by: Jose R. Ziviani <jziviani@suse.de>
-- linux user application is running
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-- a breakpoint is inserted from QEMU gdbstub for a user address that is
+Message-Id: <20210908185338.7927-1-jziviani@suse.de>
   not currently present in the target CPU TLB
 - an instruction at that address is executed, but the external debugger
   doesn't get control.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
 Message-Id: <20191127220602.10827-2-jcmvbkbc@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- exec.c | 15 +++++++--------
+ tcg/arm/tcg-target.c.inc | 3 ++-
-file changed, 7 insertions(+), 8 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/exec.c b/exec.c
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/exec.c
+--- a/tcg/arm/tcg-target.c.inc
-+++ b/exec.c
++++ b/tcg/arm/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static const ARMInsn vec_cmp0_insn[16] = {
- static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
+ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                             unsigned vecl, unsigned vece,
 -                           const TCGArg *args, const int *const_args)
 +                           const TCGArg args[TCG_MAX_OP_ARGS],
 +                           const int const_args[TCG_MAX_OP_ARGS])
  {
--    MemTxAttrs attrs;
+     TCGType type = vecl + TCG_TYPE_V64;
--    hwaddr phys = cpu_get_phys_page_attrs_debug(cpu, pc, &attrs);
+     unsigned q = vecl;
 -    int asidx = cpu_asidx_from_attrs(cpu, attrs);
 -    if (phys != -1) {
 -        /* Locks grabbed by tb_invalidate_phys_addr */
 -        tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
 -                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
 -    }
 +    /*
 +     * There may not be a virtual to physical translation for the pc
 +     * right now, but there may exist cached TB for this pc.
 +     * Flush the whole TB cache to force re-translation of such TBs.
 +     * This is heavyweight, but we're debugging anyway.
 +     */
 +    tb_flush(cpu);
  }
  #endif
 --
-.20.1
+.25.1

The following changes since commit e18e5501d8ac692d32657a3e1ef545b14e72b730:

Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20200210' into staging (2020-02-10 18:09:14 +0000)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20200212

for you to fetch changes up to 2445971604c1cfd3ec484457159f4ac300fb04d2:

tcg: Add tcg_gen_gvec_5_ptr (2020-02-12 14:58:36 -0800)

----------------------------------------------------------------
Fix breakpoint invalidation.
Add support for tcg helpers with 7 arguments.
Add support for gvec helpers with 5 arguments.

----------------------------------------------------------------
Max Filippov (1):
      exec: flush CPU TB cache in breakpoint_invalidate

Richard Henderson (1):
      tcg: Add tcg_gen_gvec_5_ptr

Taylor Simpson (1):
      tcg: Add support for a helper with 7 arguments

From: Max Filippov <jcmvbkbc@gmail.com>

When a breakpoint is inserted at location for which there's currently no
virtual to physical translation no action is taken on CPU TB cache. If a
TB for that virtual address already exists but is not visible ATM the
breakpoint won't be hit next time an instruction at that address will be
executed.

Flush entire CPU TB cache in breakpoint_invalidate to force
re-translation of all TBs for the breakpoint address.

This change fixes the following scenario:
- linux user application is running
- a breakpoint is inserted from QEMU gdbstub for a user address that is
  not currently present in the target CPU TLB
- an instruction at that address is executed, but the external debugger
  doesn't get control.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Message-Id: <20191127220602.10827-2-jcmvbkbc@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 exec.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
 
 static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
-    MemTxAttrs attrs;
-    hwaddr phys = cpu_get_phys_page_attrs_debug(cpu, pc, &attrs);
-    int asidx = cpu_asidx_from_attrs(cpu, attrs);
-    if (phys != -1) {
-        /* Locks grabbed by tb_invalidate_phys_addr */
-        tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
-                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
-    }
+    /*
+     * There may not be a virtual to physical translation for the pc
+     * right now, but there may exist cached TB for this pc.
+     * Flush the whole TB cache to force re-translation of such TBs.
+     * This is heavyweight, but we're debugging anyway.
+     */
+    tb_flush(cpu);
 }
 #endif
 
-- 
2.20.1

From: Taylor Simpson <tsimpson@quicinc.com>

Currently, helpers can only take up to 6 arguments.  This patch adds the
capability for up to 7 arguments.  I have tested it with the Hexagon port
that I am preparing for submission.

Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <1580942510-2820-1-git-send-email-tsimpson@quicinc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/helper-gen.h   | 13 +++++++++++++
 include/exec/helper-head.h  |  2 ++
 include/exec/helper-proto.h |  6 ++++++
 include/exec/helper-tcg.h   |  7 +++++++
 4 files changed, 28 insertions(+)

diff --git a/include/exec/helper-gen.h b/include/exec/helper-gen.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-gen.h
+++ b/include/exec/helper-gen.h
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
   tcg_gen_callN(HELPER(name), dh_retvar(ret), 6, args);                 \
 }
 
+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7)\
+static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
+    dh_arg_decl(t1, 1),  dh_arg_decl(t2, 2), dh_arg_decl(t3, 3),        \
+    dh_arg_decl(t4, 4), dh_arg_decl(t5, 5), dh_arg_decl(t6, 6),         \
+    dh_arg_decl(t7, 7))                                                 \
+{                                                                       \
+  TCGTemp *args[7] = { dh_arg(t1, 1), dh_arg(t2, 2), dh_arg(t3, 3),     \
+                     dh_arg(t4, 4), dh_arg(t5, 5), dh_arg(t6, 6),       \
+                     dh_arg(t7, 7) };                                   \
+  tcg_gen_callN(HELPER(name), dh_retvar(ret), 7, args);                 \
+}
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "trace/generated-helpers-wrappers.h"
@@ -XXX,XX +XXX,XX @@ static inline void glue(gen_helper_, name)(dh_retvar_decl(ret)          \
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 #undef GEN_HELPER
 
 #endif /* HELPER_GEN_H */
diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
     DEF_HELPER_FLAGS_5(name, 0, ret, t1, t2, t3, t4, t5)
 #define DEF_HELPER_6(name, ret, t1, t2, t3, t4, t5, t6) \
     DEF_HELPER_FLAGS_6(name, 0, ret, t1, t2, t3, t4, t5, t6)
+#define DEF_HELPER_7(name, ret, t1, t2, t3, t4, t5, t6, t7) \
+    DEF_HELPER_FLAGS_7(name, 0, ret, t1, t2, t3, t4, t5, t6, t7)
 
 /* MAX_OPC_PARAM_IARGS must be set to n if last entry is DEF_HELPER_FLAGS_n. */
 
diff --git a/include/exec/helper-proto.h b/include/exec/helper-proto.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-proto.h
+++ b/include/exec/helper-proto.h
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
                             dh_ctype(t4), dh_ctype(t5), dh_ctype(t6));
 
+#define DEF_HELPER_FLAGS_7(name, flags, ret, t1, t2, t3, t4, t5, t6, t7) \
+dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
+                            dh_ctype(t4), dh_ctype(t5), dh_ctype(t6), \
+                            dh_ctype(t7));
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@ dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), \
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 
 #endif /* HELPER_PROTO_H */
diff --git a/include/exec/helper-tcg.h b/include/exec/helper-tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-tcg.h
+++ b/include/exec/helper-tcg.h
@@ -XXX,XX +XXX,XX @@
     | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
     | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) },
 
+#define DEF_HELPER_FLAGS_7(NAME, FLAGS, ret, t1, t2, t3, t4, t5, t6, t7) \
+  { .func = HELPER(NAME), .name = str(NAME), .flags = FLAGS, \
+    .sizemask = dh_sizemask(ret, 0) | dh_sizemask(t1, 1) \
+    | dh_sizemask(t2, 2) | dh_sizemask(t3, 3) | dh_sizemask(t4, 4) \
+    | dh_sizemask(t5, 5) | dh_sizemask(t6, 6) | dh_sizemask(t7, 7) },
+
 #include "helper.h"
 #include "trace/generated-helpers.h"
 #include "tcg-runtime.h"
@@ -XXX,XX +XXX,XX @@
 #undef DEF_HELPER_FLAGS_4
 #undef DEF_HELPER_FLAGS_5
 #undef DEF_HELPER_FLAGS_6
+#undef DEF_HELPER_FLAGS_7
 
 #endif /* HELPER_TCG_H */
-- 
2.20.1

Extend the vector generator infrastructure to handle
5 vector arguments.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec.h |  7 +++++++
 tcg/tcg-op-gvec.c         | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/include/tcg/tcg-op-gvec.h b/include/tcg/tcg-op-gvec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                         uint32_t maxsz, int32_t data,
                         gen_helper_gvec_4_ptr *fn);
 
+typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
+                                   TCGv_ptr, TCGv_ptr, TCGv_i32);
+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_5_ptr *fn);
+
 /* Expand a gvec operation.  Either inline or out-of-line depending on
    the actual vector size and the operations supported by the host.  */
 typedef struct {
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_temp_free_i32(desc);
 }
 
+/* Generate a call to a gvec-style helper with five vector operands
+   and an extra pointer operand.  */
+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                        uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_5_ptr *fn)
+{
+    TCGv_ptr a0, a1, a2, a3, a4;
+    TCGv_i32 desc = tcg_const_i32(simd_desc(oprsz, maxsz, data));
+
+    a0 = tcg_temp_new_ptr();
+    a1 = tcg_temp_new_ptr();
+    a2 = tcg_temp_new_ptr();
+    a3 = tcg_temp_new_ptr();
+    a4 = tcg_temp_new_ptr();
+
+    tcg_gen_addi_ptr(a0, cpu_env, dofs);
+    tcg_gen_addi_ptr(a1, cpu_env, aofs);
+    tcg_gen_addi_ptr(a2, cpu_env, bofs);
+    tcg_gen_addi_ptr(a3, cpu_env, cofs);
+    tcg_gen_addi_ptr(a4, cpu_env, eofs);
+
+    fn(a0, a1, a2, a3, a4, ptr, desc);
+
+    tcg_temp_free_ptr(a0);
+    tcg_temp_free_ptr(a1);
+    tcg_temp_free_ptr(a2);
+    tcg_temp_free_ptr(a3);
+    tcg_temp_free_ptr(a4);
+    tcg_temp_free_i32(desc);
+}
+
 /* Return true if we want to implement something of OPRSZ bytes
    in units of LNSZ.  This limits the expansion of inline code.  */
 static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
-- 
2.20.1

Note that I've extended the expiration date of my gpg key
and have uploaded it to keyserver.ubuntu.com.

The following changes since commit 99c44988d5ba1866a411450c877ed818b1b70081:

Merge remote-tracking branch 'remotes/bsdimp/tags/pull-bsd-user-20210910' into staging (2021-09-11 14:00:39 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210912

for you to fetch changes up to 267a3ec3e2a8fb3e06a9d46d09fcfc57dfefd118:

tcg/arm: Fix tcg_out_vec_op function signature (2021-09-12 05:07:36 -0700)

----------------------------------------------------------------
Fix translation race condition for user-only.
Fix tcg/i386 encoding for VPSLLVQ, VPSRLVQ.
Fix tcg/arm tcg_out_vec_op signature.
Fix tcg/ppc (32bit) build with clang.
Remove dupluate TCG_KICK_PERIOD definition.
Remove unused tcg_global_reg_new.
Use __builtin_bswap*.

----------------------------------------------------------------
Bin Meng (1):
      tcg: Remove tcg_global_reg_new defines

Ilya Leoshkevich (2):
      accel/tcg: Add DisasContextBase argument to translator_ld*
      accel/tcg: Clear PAGE_WRITE before translation

Jose R. Ziviani (1):
      tcg/arm: Fix tcg_out_vec_op function signature

Luc Michel (1):
      accel/tcg: remove redundant TCG_KICK_PERIOD define

Richard Henderson (4):
      tcg/i386: Split P_VEXW from P_REXW
      include/qemu: Use builtins for bswap
      tcg/ppc: Replace TCG_TARGET_CALL_DARWIN with _CALL_DARWIN
      tcg/ppc: Ensure _CALL_SYSV is set for 32-bit ELF

From: Ilya Leoshkevich <iii@linux.ibm.com>

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
[rth: Split out of a larger patch.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h                 |  9 +++++----
 target/arm/arm_ldst.h                     | 12 ++++++------
 target/alpha/translate.c                  |  2 +-
 target/arm/translate-a64.c                |  2 +-
 target/arm/translate.c                    |  9 +++++----
 target/hexagon/translate.c                |  3 ++-
 target/hppa/translate.c                   |  2 +-
 target/i386/tcg/translate.c               | 10 +++++-----
 target/m68k/translate.c                   |  2 +-
 target/mips/tcg/translate.c               |  8 ++++----
 target/openrisc/translate.c               |  2 +-
 target/ppc/translate.c                    |  5 +++--
 target/riscv/translate.c                  |  5 +++--
 target/s390x/tcg/translate.c              | 16 +++++++++-------
 target/sh4/translate.c                    |  4 ++--
 target/sparc/translate.c                  |  2 +-
 target/xtensa/translate.c                 |  5 +++--
 target/mips/tcg/micromips_translate.c.inc |  2 +-
 target/mips/tcg/mips16e_translate.c.inc   |  4 ++--
 target/mips/tcg/nanomips_translate.c.inc  |  4 ++--
 20 files changed, 58 insertions(+), 50 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
     static inline type                                                  \
-    fullname ## _swap(CPUArchState *env, abi_ptr pc, bool do_swap)      \
+    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
+                      abi_ptr pc, bool do_swap)                         \
     {                                                                   \
         type ret = load_fn(env, pc);                                    \
         if (do_swap) {                                                  \
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
         plugin_insn_append(&ret, sizeof(ret));                          \
         return ret;                                                     \
     }                                                                   \
-                                                                        \
-    static inline type fullname(CPUArchState *env, abi_ptr pc)          \
+    static inline type fullname(CPUArchState *env,                      \
+                                DisasContextBase *dcbase, abi_ptr pc)   \
     {                                                                   \
-        return fullname ## _swap(env, pc, false);                       \
+        return fullname ## _swap(env, dcbase, pc, false);               \
     }
 
 GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm_ldst.h
+++ b/target/arm/arm_ldst.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 
 /* Load an instruction and return it in the standard little-endian order */
-static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,
-                                    bool sctlr_b)
+static inline uint32_t arm_ldl_code(CPUARMState *env, DisasContextBase *s,
+                                    target_ulong addr, bool sctlr_b)
 {
-    return translator_ldl_swap(env, addr, bswap_code(sctlr_b));
+    return translator_ldl_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 /* Ditto, for a halfword (Thumb) instruction */
-static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
-                                     bool sctlr_b)
+static inline uint16_t arm_lduw_code(CPUARMState *env, DisasContextBase* s,
+                                     target_ulong addr, bool sctlr_b)
 {
 #ifndef CONFIG_USER_ONLY
     /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped
@@ -XXX,XX +XXX,XX @@ static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,
         addr ^= 2;
     }
 #endif
-    return translator_lduw_swap(env, addr, bswap_code(sctlr_b));
+    return translator_lduw_swap(env, s, addr, bswap_code(sctlr_b));
 }
 
 #endif
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static void alpha_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPUAlphaState *env = cpu->env_ptr;
-    uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+    uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
     ctx->base.pc_next += 4;
     ctx->base.is_jmp = translate_one(ctx, insn);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
     uint32_t insn;
 
     s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
     s->insn = insn;
     s->base.pc_next += 4;
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
      * boundary, so we cross the page if the first 16 bits indicate
      * that this is a 32 bit insn.
      */
-    uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
+    uint16_t insn = arm_lduw_code(env, &s->base, s->base.pc_next, s->sctlr_b);
 
     return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
 }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     dc->insn = insn;
     dc->base.pc_next += 4;
     disas_arm_insn(dc, insn);
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
 
     dc->pc_curr = dc->base.pc_next;
-    insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
     dc->base.pc_next += 2;
     if (!is_16bit) {
-        uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
+        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
+                                       dc->sctlr_b);
 
         insn = insn << 16 | insn2;
         dc->base.pc_next += 2;
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static int read_packet_words(CPUHexagonState *env, DisasContext *ctx,
     memset(words, 0, PACKET_WORDS_MAX * sizeof(uint32_t));
     for (nwords = 0; !found_end && nwords < PACKET_WORDS_MAX; nwords++) {
         words[nwords] =
-            translator_ldl(env, ctx->base.pc_next + nwords * sizeof(uint32_t));
+            translator_ldl(env, &ctx->base,
+                           ctx->base.pc_next + nwords * sizeof(uint32_t));
         found_end = is_packet_end(words[nwords]);
     }
     if (!found_end) {
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static void hppa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     {
         /* Always fetch the insn, even if nullified, so that we check
            the page permissions for execute.  */
-        uint32_t insn = translator_ldl(env, ctx->base.pc_next);
+        uint32_t insn = translator_ldl(env, &ctx->base, ctx->base.pc_next);
 
         /* Set up the IA queue for the next insn.
            This will be overwritten by a branch.  */
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 
 static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldub(env, advance_pc(env, s, 1));
+    return translator_ldub(env, &s->base, advance_pc(env, s, 1));
 }
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, advance_pc(env, s, 2));
+    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_lduw(env, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint32_t x86_ldl_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldl(env, advance_pc(env, s, 4));
+    return translator_ldl(env, &s->base, advance_pc(env, s, 4));
 }
 
 #ifdef TARGET_X86_64
 static inline uint64_t x86_ldq_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldq(env, advance_pc(env, s, 8));
+    return translator_ldq(env, &s->base, advance_pc(env, s, 8));
 }
 #endif
 
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv gen_ldst(DisasContext *s, int opsize, TCGv addr, TCGv val,
 static inline uint16_t read_im16(CPUM68KState *env, DisasContext *s)
 {
     uint16_t im;
-    im = translator_lduw(env, s->pc);
+    im = translator_lduw(env, &s->base, s->pc);
     s->pc += 2;
     return im;
 }
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void mips_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     is_slot = ctx->hflags & MIPS_HFLAG_BMASK;
     if (ctx->insn_flags & ISA_NANOMIPS32) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_nanomips(env, ctx);
     } else if (!(ctx->hflags & MIPS_HFLAG_M16)) {
-        ctx->opcode = translator_ldl(env, ctx->base.pc_next);
+        ctx->opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = 4;
         decode_opc(env, ctx);
     } else if (ctx->insn_flags & ASE_MICROMIPS) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_isa_micromips(env, ctx);
     } else if (ctx->insn_flags & ASE_MIPS16) {
-        ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+        ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
         insn_bytes = decode_ase_mips16e(env, ctx);
     } else {
         gen_reserved_instruction(ctx);
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
-    uint32_t insn = translator_ldl(&cpu->env, dc->base.pc_next);
+    uint32_t insn = translator_ldl(&cpu->env, &dc->base, dc->base.pc_next);
 
     if (!decode(dc, insn)) {
         gen_illegal_exception(dc);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
               ctx->base.pc_next, ctx->mem_idx, (int)msr_ir);
 
     ctx->cia = pc = ctx->base.pc_next;
-    insn = translator_ldl_swap(env, pc, need_byteswap(ctx));
+    insn = translator_ldl_swap(env, dcbase, pc, need_byteswap(ctx));
     ctx->base.pc_next = pc += 4;
 
     if (!is_prefix_insn(ctx, insn)) {
@@ -XXX,XX +XXX,XX @@ static void ppc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
         gen_exception_err(ctx, POWERPC_EXCP_ALIGN, POWERPC_EXCP_ALIGN_INSN);
         ok = true;
     } else {
-        uint32_t insn2 = translator_ldl_swap(env, pc, need_byteswap(ctx));
+        uint32_t insn2 = translator_ldl_swap(env, dcbase, pc,
+                                             need_byteswap(ctx));
         ctx->base.pc_next = pc += 4;
         ok = decode_insn64(ctx, deposit64(insn2, 32, 32, insn));
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     } else {
         uint32_t opcode32 = opcode;
         opcode32 = deposit32(opcode32, 16, 16,
-                             translator_lduw(env, ctx->base.pc_next + 2));
+                             translator_lduw(env, &ctx->base,
+                                             ctx->base.pc_next + 2));
         ctx->pc_succ_insn = ctx->base.pc_next + 4;
         if (!decode_insn32(ctx, opcode32)) {
             gen_exception_illegal(ctx);
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPURISCVState *env = cpu->env_ptr;
-    uint16_t opcode16 = translator_lduw(env, ctx->base.pc_next);
+    uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
 
     decode_opc(env, ctx, opcode16);
     ctx->base.pc_next = ctx->pc_succ_insn;
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void update_cc_op(DisasContext *s)
     }
 }
 
-static inline uint64_t ld_code2(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code2(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)cpu_lduw_code(env, pc);
+    return (uint64_t)translator_lduw(env, &s->base, pc);
 }
 
-static inline uint64_t ld_code4(CPUS390XState *env, uint64_t pc)
+static inline uint64_t ld_code4(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
 {
-    return (uint64_t)(uint32_t)cpu_ldl_code(env, pc);
+    return (uint64_t)(uint32_t)translator_ldl(env, &s->base, pc);
 }
 
 static int get_mem_index(DisasContext *s)
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
         ilen = s->ex_value & 0xf;
         op = insn >> 56;
     } else {
-        insn = ld_code2(env, pc);
+        insn = ld_code2(env, s, pc);
         op = (insn >> 8) & 0xff;
         ilen = get_ilen(op);
         switch (ilen) {
@@ -XXX,XX +XXX,XX @@ static const DisasInsn *extract_insn(CPUS390XState *env, DisasContext *s)
             insn = insn << 48;
             break;
         case 4:
-            insn = ld_code4(env, pc) << 32;
+            insn = ld_code4(env, s, pc) << 32;
             break;
         case 6:
-            insn = (insn << 48) | (ld_code4(env, pc + 2) << 16);
+            insn = (insn << 48) | (ld_code4(env, s, pc + 2) << 16);
             break;
         default:
             g_assert_not_reached();
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
 
     /* Read all of the insns for the region.  */
     for (i = 0; i < max_insns; ++i) {
-        insns[i] = translator_lduw(env, pc + i * 2);
+        insns[i] = translator_lduw(env, &ctx->base, pc + i * 2);
     }
 
     ld_adr = ld_dst = ld_mop = -1;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 #endif
 
-    ctx->opcode = translator_lduw(env, ctx->base.pc_next);
+    ctx->opcode = translator_lduw(env, &ctx->base, ctx->base.pc_next);
     decode_opc(ctx);
     ctx->base.pc_next += 2;
 }
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     CPUSPARCState *env = cs->env_ptr;
     unsigned int insn;
 
-    insn = translator_ldl(env, dc->pc);
+    insn = translator_ldl(env, &dc->base, dc->pc);
     dc->base.pc_next += 4;
     disas_sparc_insn(dc, insn);
 
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static int arg_copy_compare(const void *a, const void *b)
 static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 {
     xtensa_isa isa = dc->config->isa;
-    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, dc->pc)};
+    unsigned char b[MAX_INSN_LENGTH] = {translator_ldub(env, &dc->base,
+                                                        dc->pc)};
     unsigned len = xtensa_op0_insn_len(dc, b[0]);
     xtensa_format fmt;
     int slot, slots;
@@ -XXX,XX +XXX,XX @@ static void disas_xtensa_insn(CPUXtensaState *env, DisasContext *dc)
 
     dc->base.pc_next = dc->pc + len;
     for (i = 1; i < len; ++i) {
-        b[i] = translator_ldub(env, dc->pc + i);
+        b[i] = translator_ldub(env, &dc->base, dc->pc + i);
     }
     xtensa_insnbuf_from_chars(isa, dc->insnbuf, b, len);
     fmt = xtensa_format_decode(isa, dc->insnbuf);
diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
     uint32_t op, minor, minor2, mips32_op;
     uint32_t cond, fmt, cc;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = (ctx->opcode >> 21) & 0x1f;
diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static void decode_i64_mips16(DisasContext *ctx,
 
 static int decode_extended_mips16_opc(CPUMIPSState *env, DisasContext *ctx)
 {
-    int extend = translator_lduw(env, ctx->base.pc_next + 2);
+    int extend = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     int op, rx, ry, funct, sa;
     int16_t imm, offset;
 
@@ -XXX,XX +XXX,XX @@ static int decode_ase_mips16e(CPUMIPSState *env, DisasContext *ctx)
         /* No delay slot, so just process as a normal instruction */
         break;
     case M16_OPC_JAL:
-        offset = translator_lduw(env, ctx->base.pc_next + 2);
+        offset = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
         offset = (((ctx->opcode & 0x1f) << 21)
                   | ((ctx->opcode >> 5) & 0x1f) << 16
                   | offset) << 2;
diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/nanomips_translate.c.inc
+++ b/target/mips/tcg/nanomips_translate.c.inc
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
     int offset;
     int imm;
 
-    insn = translator_lduw(env, ctx->base.pc_next + 2);
+    insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 2);
     ctx->opcode = (ctx->opcode << 16) | insn;
 
     rt = extract32(ctx->opcode, 21, 5);
@@ -XXX,XX +XXX,XX @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
         break;
     case NM_P48I:
         {
-            insn = translator_lduw(env, ctx->base.pc_next + 4);
+            insn = translator_lduw(env, &ctx->base, ctx->base.pc_next + 4);
             target_long addr_off = extract32(ctx->opcode, 0, 16) | insn << 16;
             switch (extract32(ctx->opcode, 16, 5)) {
             case NM_LI48:
-- 
2.25.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

translate_insn() implementations fetch instruction bytes piecemeal,
which can cause qemu-user to generate inconsistent translations if
another thread modifies them concurrently [1].

Fix by making pages containing translated instruction non-writable
right before loading instruction bytes from them.

[1] https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg00644.html

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20210805204835.158918-1-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translate-all.h |  1 +
 include/exec/translator.h    | 39 ++++++++++++++----------
 accel/tcg/translate-all.c    | 59 +++++++++++++++++++++---------------
 accel/tcg/translator.c       | 39 ++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 41 deletions(-)

diff --git a/include/exec/translate-all.h b/include/exec/translate-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translate-all.h
+++ b/include/exec/translate-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 
 #ifdef CONFIG_USER_ONLY
+void page_protect(tb_page_addr_t page_addr);
 int page_unprotect(target_ulong address, uintptr_t pc);
 #endif
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "exec/plugin-gen.h"
+#include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
 
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContextBase {
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
+#ifdef CONFIG_USER_ONLY
+    /*
+     * Guest address of the last byte of the last protected page.
+     *
+     * Pages containing the translated instructions are made non-writable in
+     * order to achieve consistency in case another thread is modifying the
+     * code while translate_insn() fetches the instruction bytes piecemeal.
+     * Such writer threads are blocked on mmap_lock() in page_unprotect().
+     */
+    target_ulong page_protect_end;
+#endif
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  */
 
 #define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    static inline type                                                  \
-    fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase,      \
-                      abi_ptr pc, bool do_swap)                         \
-    {                                                                   \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(&ret, sizeof(ret));                          \
-        return ret;                                                     \
-    }                                                                   \
+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
+                           abi_ptr pc, bool do_swap);                   \
     static inline type fullname(CPUArchState *env,                      \
                                 DisasContextBase *dcbase, abi_ptr pc)   \
     {                                                                   \
         return fullname ## _swap(env, dcbase, pc, false);               \
     }
 
-GEN_TRANSLATOR_LD(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)
-GEN_TRANSLATOR_LD(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)
-GEN_TRANSLATOR_LD(translator_lduw, uint16_t, cpu_lduw_code, bswap16)
-GEN_TRANSLATOR_LD(translator_ldl, uint32_t, cpu_ldl_code, bswap32)
-GEN_TRANSLATOR_LD(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+#define FOR_EACH_TRANSLATOR_LD(F)                                       \
+    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
+    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
+    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
+    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
+    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+
+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+
 #undef GEN_TRANSLATOR_LD
 
 #endif  /* EXEC__TRANSLATOR_H */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
     invalidate_page_bitmap(p);
 
 #if defined(CONFIG_USER_ONLY)
-    if (p->flags & PAGE_WRITE) {
-        target_ulong addr;
-        PageDesc *p2;
-        int prot;
-
-        /* force the host page as non writable (writes will have a
-           page fault + mprotect overhead) */
-        page_addr &= qemu_host_page_mask;
-        prot = 0;
-        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
-            addr += TARGET_PAGE_SIZE) {
-
-            p2 = page_find(addr >> TARGET_PAGE_BITS);
-            if (!p2) {
-                continue;
-            }
-            prot |= p2->flags;
-            p2->flags &= ~PAGE_WRITE;
-          }
-        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
-                 (prot & PAGE_BITS) & ~PAGE_WRITE);
-        if (DEBUG_TB_INVALIDATE_GATE) {
-            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
-        }
-    }
+    /* translator_loop() must have made all TB pages non-writable */
+    assert(!(p->flags & PAGE_WRITE));
 #else
     /* if some code is already present, then the pages are already
        protected. So we handle the case where only the first TB is
@@ -XXX,XX +XXX,XX @@ int page_check_range(target_ulong start, target_ulong len, int flags)
     return 0;
 }
 
+void page_protect(tb_page_addr_t page_addr)
+{
+    target_ulong addr;
+    PageDesc *p;
+    int prot;
+
+    p = page_find(page_addr >> TARGET_PAGE_BITS);
+    if (p && (p->flags & PAGE_WRITE)) {
+        /*
+         * Force the host page as non writable (writes will have a page fault +
+         * mprotect overhead).
+         */
+        page_addr &= qemu_host_page_mask;
+        prot = 0;
+        for (addr = page_addr; addr < page_addr + qemu_host_page_size;
+             addr += TARGET_PAGE_SIZE) {
+
+            p = page_find(addr >> TARGET_PAGE_BITS);
+            if (!p) {
+                continue;
+            }
+            prot |= p->flags;
+            p->flags &= ~PAGE_WRITE;
+        }
+        mprotect(g2h_untagged(page_addr), qemu_host_page_size,
+                 (prot & PAGE_BITS) & ~PAGE_WRITE);
+        if (DEBUG_TB_INVALIDATE_GATE) {
+            printf("protecting code page: 0x" TB_PAGE_ADDR_FMT "\n", page_addr);
+        }
+    }
+}
+
 /* called from signal handler: invalidate the code and unprotect the
  * page. Return 0 if the fault was not handled, 1 if it was handled,
  * and 2 if it was handled but the caller must cause the TB to be
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
+static inline void translator_page_protect(DisasContextBase *dcbase,
+                                           target_ulong pc)
+{
+#ifdef CONFIG_USER_ONLY
+    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
+    page_protect(pc);
+#endif
+}
+
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
                      CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
+    translator_page_protect(db, db->pc_next);
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
     }
 #endif
 }
+
+static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
+                                                 target_ulong pc, size_t len)
+{
+#ifdef CONFIG_USER_ONLY
+    target_ulong end = pc + len - 1;
+
+    if (end > dcbase->page_protect_end) {
+        translator_page_protect(dcbase, end);
+    }
+#endif
+}
+
+#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
+    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
+                           abi_ptr pc, bool do_swap)                    \
+    {                                                                   \
+        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
+        type ret = load_fn(env, pc);                                    \
+        if (do_swap) {                                                  \
+            ret = swap_fn(ret);                                         \
+        }                                                               \
+        plugin_insn_append(&ret, sizeof(ret));                          \
+        return ret;                                                     \
+    }
+
+FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+
+#undef GEN_TRANSLATOR_LD
-- 
2.25.1

We need to be able to represent VEX.W on a 32-bit host, where REX.W
will always be zero.  Fixes the encoding for VPSLLVQ and VPSRLVQ.

Fixes: a2ce146a068 ("tcg/i386: Support vector variable shift opcodes")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/385
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define P_EXT		0x100		/* 0x0f opcode prefix */
 #define P_EXT38         0x200           /* 0x0f 0x38 opcode prefix */
 #define P_DATA16        0x400           /* 0x66 opcode prefix */
+#define P_VEXW          0x1000          /* Set VEX.W = 1 */
 #if TCG_TARGET_REG_BITS == 64
-# define P_REXW         0x1000          /* Set REX.W = 1 */
+# define P_REXW         P_VEXW          /* Set REX.W = 1; match VEXW */
 # define P_REXB_R       0x2000          /* REG field as byte register */
 # define P_REXB_RM      0x4000          /* R/M field as byte register */
 # define P_GS           0x8000          /* gs segment override */
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPBROADCASTW (0x79 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTD (0x58 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
-#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_REXW)
+#define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
 #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
 #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
-#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_REXW)
+#define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
 #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
 #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
-#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_REXW)
+#define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
 #define OPC_XCHG_ax_r32	(0x90)
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
 
     /* Use the two byte form if possible, which cannot encode
        VEX.W, VEX.B, VEX.X, or an m-mmmm field other than P_EXT.  */
-    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_REXW)) == P_EXT
+    if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_VEXW)) == P_EXT
         && ((rm | index) & 8) == 0) {
         /* Two byte VEX prefix.  */
         tcg_out8(s, 0xc5);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
         tmp |= (rm & 8 ? 0 : 0x20);            /* VEX.B */
         tcg_out8(s, tmp);
 
-        tmp = (opc & P_REXW ? 0x80 : 0);       /* VEX.W */
+        tmp = (opc & P_VEXW ? 0x80 : 0);       /* VEX.W */
     }
 
     tmp |= (opc & P_VEXL ? 0x04 : 0);      /* VEX.L */
-- 
2.25.1

From: Bin Meng <bmeng.cn@gmail.com>

Since commit 1c2adb958fc0 ("tcg: Initialize cpu_env generically"),
these tcg_global_reg_new_ macros are not used anywhere.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210816143507.11200-1-bmeng.cn@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op.h    | 2 --
 target/hppa/translate.c | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
 
 #if TARGET_LONG_BITS == 32
 #define tcg_temp_new() tcg_temp_new_i32()
-#define tcg_global_reg_new tcg_global_reg_new_i32
 #define tcg_global_mem_new tcg_global_mem_new_i32
 #define tcg_temp_local_new() tcg_temp_local_new_i32()
 #define tcg_temp_free tcg_temp_free_i32
@@ -XXX,XX +XXX,XX @@ static inline void tcg_gen_plugin_cb_end(void)
 #define tcg_gen_qemu_st_tl tcg_gen_qemu_st_i32
 #else
 #define tcg_temp_new() tcg_temp_new_i64()
-#define tcg_global_reg_new tcg_global_reg_new_i64
 #define tcg_global_mem_new tcg_global_mem_new_i64
 #define tcg_temp_local_new() tcg_temp_local_new_i64()
 #define tcg_temp_free tcg_temp_free_i64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@
 
 #undef TCGv
 #undef tcg_temp_new
-#undef tcg_global_reg_new
 #undef tcg_global_mem_new
 #undef tcg_temp_local_new
 #undef tcg_temp_free
@@ -XXX,XX +XXX,XX @@
 #define TCGv_reg             TCGv_i64
 
 #define tcg_temp_new         tcg_temp_new_i64
-#define tcg_global_reg_new   tcg_global_reg_new_i64
 #define tcg_global_mem_new   tcg_global_mem_new_i64
 #define tcg_temp_local_new   tcg_temp_local_new_i64
 #define tcg_temp_free        tcg_temp_free_i64
@@ -XXX,XX +XXX,XX @@
 #else
 #define TCGv_reg             TCGv_i32
 #define tcg_temp_new         tcg_temp_new_i32
-#define tcg_global_reg_new   tcg_global_reg_new_i32
 #define tcg_global_mem_new   tcg_global_mem_new_i32
 #define tcg_temp_local_new   tcg_temp_local_new_i32
 #define tcg_temp_free        tcg_temp_free_i32
-- 
2.25.1

All supported compilers have builtins for this.
Drop all of the complicated system detection stuff.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210708181743.750220-1-richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 meson.build          |  6 -----
 include/qemu/bswap.h | 53 +++-----------------------------------------
 2 files changed, 3 insertions(+), 56 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul'))
 config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
 
 # has_header_symbol
-config_host_data.set('CONFIG_BYTESWAP_H',
-                     cc.has_header_symbol('byteswap.h', 'bswap_32'))
 config_host_data.set('CONFIG_EPOLL_CREATE1',
                      cc.has_header_symbol('sys/epoll.h', 'epoll_create1'))
 config_host_data.set('CONFIG_HAS_ENVIRON',
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_INOTIFY',
                      cc.has_header_symbol('sys/inotify.h', 'inotify_init'))
 config_host_data.set('CONFIG_INOTIFY1',
                      cc.has_header_symbol('sys/inotify.h', 'inotify_init1'))
-config_host_data.set('CONFIG_MACHINE_BSWAP_H',
-                     cc.has_header_symbol('machine/bswap.h', 'bswap32',
-                                          prefix: '''#include <sys/endian.h>
-                                                     #include <sys/types.h>'''))
 config_host_data.set('CONFIG_PRCTL_PR_SET_TIMERSLACK',
                      cc.has_header_symbol('sys/prctl.h', 'PR_SET_TIMERSLACK'))
 config_host_data.set('CONFIG_RTNETLINK',
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
-#ifdef CONFIG_MACHINE_BSWAP_H
-# include <sys/endian.h>
-# include <machine/bswap.h>
-#elif defined(__FreeBSD__)
-# include <sys/endian.h>
-#elif defined(__HAIKU__)
-# include <endian.h>
-#elif defined(CONFIG_BYTESWAP_H)
-# include <byteswap.h>
-#define BSWAP_FROM_BYTESWAP
-# else
-#define BSWAP_FROM_FALLBACKS
-#endif /* ! CONFIG_MACHINE_BSWAP_H */
-
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 #include "fpu/softfloat-types.h"
 
-#ifdef BSWAP_FROM_BYTESWAP
 static inline uint16_t bswap16(uint16_t x)
 {
-    return bswap_16(x);
+    return __builtin_bswap16(x);
 }
 
 static inline uint32_t bswap32(uint32_t x)
 {
-    return bswap_32(x);
+    return __builtin_bswap32(x);
 }
 
 static inline uint64_t bswap64(uint64_t x)
 {
-    return bswap_64(x);
+    return __builtin_bswap64(x);
 }
-#endif
-
-#ifdef BSWAP_FROM_FALLBACKS
-static inline uint16_t bswap16(uint16_t x)
-{
-    return (((x & 0x00ff) << 8) |
-            ((x & 0xff00) >> 8));
-}
-
-static inline uint32_t bswap32(uint32_t x)
-{
-    return (((x & 0x000000ffU) << 24) |
-            ((x & 0x0000ff00U) <<  8) |
-            ((x & 0x00ff0000U) >>  8) |
-            ((x & 0xff000000U) >> 24));
-}
-
-static inline uint64_t bswap64(uint64_t x)
-{
-    return (((x & 0x00000000000000ffULL) << 56) |
-            ((x & 0x000000000000ff00ULL) << 40) |
-            ((x & 0x0000000000ff0000ULL) << 24) |
-            ((x & 0x00000000ff000000ULL) <<  8) |
-            ((x & 0x000000ff00000000ULL) >>  8) |
-            ((x & 0x0000ff0000000000ULL) >> 24) |
-            ((x & 0x00ff000000000000ULL) >> 40) |
-            ((x & 0xff00000000000000ULL) >> 56));
-}
-#endif
-
-#undef BSWAP_FROM_BYTESWAP
-#undef BSWAP_FROM_FALLBACKS
 
 static inline void bswap16s(uint16_t *s)
 {
-- 
2.25.1

If __APPLE__, ensure that _CALL_DARWIN is set, then remove
our local TCG_TARGET_CALL_DARWIN.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "../tcg-pool.c.inc"
 
-#if defined _CALL_DARWIN || defined __APPLE__
-#define TCG_TARGET_CALL_DARWIN
+#if !defined _CALL_DARWIN && defined __APPLE__
+#define _CALL_DARWIN 1
 #endif
 #ifdef _CALL_SYSV
 # define TCG_TARGET_CALL_ALIGN_ARGS   1
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
 };
 
 static const int tcg_target_callee_save_regs[] = {
-#ifdef TCG_TARGET_CALL_DARWIN
+#ifdef _CALL_DARWIN
     TCG_REG_R11,
 #endif
     TCG_REG_R14,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 # define LINK_AREA_SIZE                (6 * SZR)
 # define LR_OFFSET                     (1 * SZR)
 # define TCG_TARGET_CALL_STACK_OFFSET  (LINK_AREA_SIZE + 8 * SZR)
-#elif defined(TCG_TARGET_CALL_DARWIN)
+#elif defined(_CALL_DARWIN)
 # define LINK_AREA_SIZE                (6 * SZR)
 # define LR_OFFSET                     (2 * SZR)
 #elif TCG_TARGET_REG_BITS == 64
-- 
2.25.1

Clang only sets _CALL_ELF for ppc64, and nothing at all to specify
the ABI for ppc32.  Make a good guess based on other symbols.

Reported-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "../tcg-pool.c.inc"
 
-#if !defined _CALL_DARWIN && defined __APPLE__
-#define _CALL_DARWIN 1
-#endif
+/*
+ * Standardize on the _CALL_FOO symbols used by GCC:
+ * Apple XCode does not define _CALL_DARWIN.
+ * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV (32-bit).
+ */
+#if !defined(_CALL_SYSV) && \
+    !defined(_CALL_DARWIN) && \
+    !defined(_CALL_AIX) && \
+    !defined(_CALL_ELF)
+# if defined(__APPLE__)
+#  define _CALL_DARWIN
+# elif defined(__ELF__) && TCG_TARGET_REG_BITS == 32
+#  define _CALL_SYSV
+# else
+#  error "Unknown ABI"
+# endif
+#endif 
+
 #ifdef _CALL_SYSV
 # define TCG_TARGET_CALL_ALIGN_ARGS   1
 #endif
-- 
2.25.1

From: "Jose R. Ziviani" <jziviani@suse.de>

Commit 5e8892db93 fixed several function signatures but tcg_out_vec_op
for arm is missing. It causes a build error on armv6 and armv7:

tcg-target.c.inc:2718:42: error: argument 5 of type 'const TCGArg *'
{aka 'const unsigned int *'} declared as a pointer [-Werror=array-parameter=]
   const TCGArg *args, const int *const_args)
  ~~~~~~~~~~~~~~^~~~
../tcg/tcg.c:120:41: note: previously declared as an array 'const TCGArg[16]'
{aka 'const unsigned int[16]'}
   const TCGArg args[TCG_MAX_OP_ARGS],
  ~~~~~~~~~~~~~~^~~~

Signed-off-by: Jose R. Ziviani <jziviani@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210908185338.7927-1-jziviani@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const ARMInsn vec_cmp0_insn[16] = {
 
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
-                           const TCGArg *args, const int *const_args)
+                           const TCGArg args[TCG_MAX_OP_ARGS],
+                           const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGType type = vecl + TCG_TYPE_V64;
     unsigned q = vecl;
-- 
2.25.1