Series comparison

-[PULL for-5.1 0/3] tcg patch queue
+[PULL 00/35] tcg patch queue
-The following changes since commit 95d1fbabae0cd44156ac4b96d512d143ca7dfd5e:
+The following changes since commit 57b6f58c1d0df757c9311496c32d502925056894:
-  Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200716-pull-request' into staging (2020-07-16 18:50:51 +0100)
+  Merge remote-tracking branch 'remotes/hreitz/tags/pull-block-2021-09-15' into staging (2021-09-15 18:55:59 +0100)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20200717
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210916
-for you to fetch changes up to ba3c35d9c4026361fd380b269dc6def9510b7166:
+for you to fetch changes up to 50febfe212f24a9b91b4224d03f653415fddf8e1:
-  tcg/cpu-exec: precise single-stepping after an interrupt (2020-07-17 11:09:34 -0700)
+  tcg/mips: Drop special alignment for code_gen_buffer (2021-09-16 09:37:39 -0400)
 ----------------------------------------------------------------
-Fix vector min/max fallback expansion
+Restrict cpu_has_work to sysemu, and move to AccelOpsClass.
-Fix singlestep from exception and interrupt
+Move cpu_signal_handler declaration out of target/.
 Misc tcg/mips/ cleanups.
 ----------------------------------------------------------------
-Luc Michel (1):
+Philippe Mathieu-Daudé (30):
-      tcg/cpu-exec: precise single-stepping after an exception
+      accel/tcg: Restrict cpu_handle_halt() to sysemu
       hw/core: Restrict cpu_has_work() to sysemu
       hw/core: Un-inline cpu_has_work()
       sysemu: Introduce AccelOpsClass::has_work()
       accel/kvm: Implement AccelOpsClass::has_work()
       accel/whpx: Implement AccelOpsClass::has_work()
       accel/tcg: Implement AccelOpsClass::has_work() as stub
       target/alpha: Restrict has_work() handler to sysemu
       target/arm: Restrict has_work() handler to sysemu and TCG
       target/avr: Restrict has_work() handler to sysemu
       target/cris: Restrict has_work() handler to sysemu
       target/hexagon: Remove unused has_work() handler
       target/hppa: Restrict has_work() handler to sysemu
       target/i386: Restrict has_work() handler to sysemu and TCG
       target/m68k: Restrict has_work() handler to sysemu
       target/microblaze: Restrict has_work() handler to sysemu
       target/mips: Restrict has_work() handler to sysemu and TCG
       target/nios2: Restrict has_work() handler to sysemu
       target/openrisc: Restrict has_work() handler to sysemu
       target/ppc: Introduce PowerPCCPUClass::has_work()
       target/ppc: Restrict has_work() handlers to sysemu and TCG
       target/riscv: Restrict has_work() handler to sysemu and TCG
       target/rx: Restrict has_work() handler to sysemu
       target/s390x: Restrict has_work() handler to sysemu and TCG
       target/sh4: Restrict has_work() handler to sysemu
       target/sparc: Remove pointless use of CONFIG_TCG definition
       target/sparc: Restrict has_work() handler to sysemu
       target/tricore: Restrict has_work() handler to sysemu
       target/xtensa: Restrict has_work() handler to sysemu
       accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one
-Richard Henderson (2):
+Richard Henderson (5):
-      tcg: Save/restore vecop_list around minmax fallback
+      include/exec: Move cpu_signal_handler declaration
-      tcg/cpu-exec: precise single-stepping after an interrupt
+      tcg/mips: Drop inline markers
       tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
       tcg/mips: Unset TCG_TARGET_HAS_direct_jump
       tcg/mips: Drop special alignment for code_gen_buffer
- accel/tcg/cpu-exec.c | 19 ++++++++++++++++++-
+ include/exec/exec-all.h           |  13 +++++
- tcg/tcg-op-vec.c     |  2 ++
+ include/hw/core/cpu.h             |  28 ++++------
-files changed, 20 insertions(+), 1 deletion(-)
+ include/hw/core/tcg-cpu-ops.h     |   4 ++
  include/sysemu/accel-ops.h        |   5 ++
  target/alpha/cpu.h                |   6 ---
  target/arm/cpu.h                  |   7 ---
  target/avr/cpu.h                  |   2 -
  target/cris/cpu.h                 |   8 ---
  target/hexagon/cpu.h              |   3 --
  target/hppa/cpu.h                 |   3 --
  target/i386/cpu.h                 |   7 ---
  target/m68k/cpu.h                 |   8 ---
  target/microblaze/cpu.h           |   7 ---
  target/mips/cpu.h                 |   3 --
  target/mips/internal.h            |   2 -
  target/nios2/cpu.h                |   2 -
  target/openrisc/cpu.h             |   2 -
  target/ppc/cpu-qom.h              |   3 ++
  target/ppc/cpu.h                  |   7 ---
  target/riscv/cpu.h                |   2 -
  target/rx/cpu.h                   |   4 --
  target/s390x/cpu.h                |   7 ---
  target/sh4/cpu.h                  |   3 --
  target/sparc/cpu.h                |   2 -
  target/tricore/cpu.h              |   2 -
  target/xtensa/cpu.h               |   2 -
  tcg/mips/tcg-target.h             |  12 ++---
  accel/hvf/hvf-accel-ops.c         |   6 +++
  accel/kvm/kvm-accel-ops.c         |   6 +++
  accel/qtest/qtest.c               |   6 +++
  accel/tcg/cpu-exec.c              |   6 ++-
  accel/tcg/tcg-accel-ops.c         |  12 +++++
  accel/xen/xen-all.c               |   6 +++
  hw/core/cpu-common.c              |   6 ---
  softmmu/cpus.c                    |  10 ++--
  target/alpha/cpu.c                |   4 +-
  target/arm/cpu.c                  |   7 ++-
  target/avr/cpu.c                  |   2 +-
  target/cris/cpu.c                 |   4 +-
  target/hexagon/cpu.c              |   6 ---
  target/hppa/cpu.c                 |   4 +-
  target/i386/cpu.c                 |   6 ---
  target/i386/hax/hax-accel-ops.c   |   6 +++
  target/i386/nvmm/nvmm-accel-ops.c |   6 +++
  target/i386/tcg/tcg-cpu.c         |   8 ++-
  target/i386/whpx/whpx-accel-ops.c |   6 +++
  target/m68k/cpu.c                 |   4 +-
  target/microblaze/cpu.c           |   8 +--
  target/mips/cpu.c                 |   4 +-
  target/nios2/cpu.c                |   4 +-
  target/openrisc/cpu.c             |   4 +-
  target/ppc/cpu_init.c             |  37 ++++++++++----
  target/riscv/cpu.c                |   8 ++-
  target/rx/cpu.c                   |   4 +-
  target/s390x/cpu.c                |   4 +-
  target/sh4/cpu.c                  |   5 +-
  target/sparc/cpu.c                |   6 +--
  target/tricore/cpu.c              |   6 ++-
  target/xtensa/cpu.c               |  14 ++---
  tcg/region.c                      |  91 ---------------------------------
  tcg/mips/tcg-target.c.inc         | 105 +++++++++++++-------------------------
 files changed, 233 insertions(+), 342 deletions(-)

-New patch
+[PULL 01/35] include/exec: Move cpu_signal_handler declaration
+There is nothing target specific about this.  The implementation
+is host specific, but the declaration is 100% common.
+Reviewed-By: Warner Losh <imp@bsdimp.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/exec/exec-all.h | 13 +++++++++++++
+ target/alpha/cpu.h      |  6 ------
+ target/arm/cpu.h        |  7 -------
+ target/avr/cpu.h        |  2 --
+ target/cris/cpu.h       |  8 --------
+ target/hexagon/cpu.h    |  3 ---
+ target/hppa/cpu.h       |  3 ---
+ target/i386/cpu.h       |  7 -------
+ target/m68k/cpu.h       |  8 --------
+ target/microblaze/cpu.h |  7 -------
+ target/mips/cpu.h       |  3 ---
+ target/mips/internal.h  |  2 --
+ target/nios2/cpu.h      |  2 --
+ target/openrisc/cpu.h   |  2 --
+ target/ppc/cpu.h        |  7 -------
+ target/riscv/cpu.h      |  2 --
+ target/rx/cpu.h         |  4 ----
+ target/s390x/cpu.h      |  7 -------
+ target/sh4/cpu.h        |  3 ---
+ target/sparc/cpu.h      |  2 --
+ target/tricore/cpu.h    |  2 --
+ target/xtensa/cpu.h     |  2 --
+files changed, 13 insertions(+), 89 deletions(-)
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/exec-all.h
++++ b/include/exec/exec-all.h
+@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
+     }
+     return addr;
+ }
++
++/**
++ * cpu_signal_handler
++ * @signum: host signal number
++ * @pinfo: host siginfo_t
++ * @puc: host ucontext_t
++ *
++ * To be called from the SIGBUS and SIGSEGV signal handler to inform the
++ * virtual cpu of exceptions.  Returns true if the signal was handled by
++ * the virtual CPU.
++ */
++int cpu_signal_handler(int signum, void *pinfo, void *puc);
++
+ #else
+ static inline void mmap_lock(void) {}
+ static inline void mmap_unlock(void) {}
+diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/cpu.h
++++ b/target/alpha/cpu.h
+@@ -XXX,XX +XXX,XX @@ void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
+                                    int mmu_idx, uintptr_t retaddr);
+ #define cpu_list alpha_cpu_list
+-#define cpu_signal_handler cpu_alpha_signal_handler
+ typedef CPUAlphaState CPUArchState;
+ typedef AlphaCPU ArchCPU;
+@@ -XXX,XX +XXX,XX @@ void alpha_translate_init(void);
+ #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
+ void alpha_cpu_list(void);
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_alpha_signal_handler(int host_signum, void *pinfo,
+-                             void *puc);
+ bool alpha_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                         MMUAccessType access_type, int mmu_idx,
+                         bool probe, uintptr_t retaddr);
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool is_a64(CPUARMState *env)
+     return env->aarch64;
+ }
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_arm_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+-
+ /**
+  * pmu_op_start/finish
+  * @env: CPUARMState
+@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
+ #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
+ #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
+-#define cpu_signal_handler cpu_arm_signal_handler
+ #define cpu_list arm_cpu_list
+ /* ARM has the following "translation regimes" (as the ARM ARM calls them):
+diff --git a/target/avr/cpu.h b/target/avr/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/avr/cpu.h
++++ b/target/avr/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
+ }
+ #define cpu_list avr_cpu_list
+-#define cpu_signal_handler cpu_avr_signal_handler
+ #define cpu_mmu_index avr_cpu_mmu_index
+ static inline int avr_cpu_mmu_index(CPUAVRState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ void avr_cpu_tcg_init(void);
+ void avr_cpu_list(void);
+ int cpu_avr_exec(CPUState *cpu);
+-int cpu_avr_signal_handler(int host_signum, void *pinfo, void *puc);
+ int avr_cpu_memory_rw_debug(CPUState *cs, vaddr address, uint8_t *buf,
+                             int len, bool is_write);
+diff --git a/target/cris/cpu.h b/target/cris/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/cris/cpu.h
++++ b/target/cris/cpu.h
+@@ -XXX,XX +XXX,XX @@ int crisv10_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+ int cris_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+ int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_cris_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+-
+ void cris_initialize_tcg(void);
+ void cris_initialize_crisv10_tcg(void);
+@@ -XXX,XX +XXX,XX @@ enum {
+ #define CRIS_CPU_TYPE_NAME(name) (name CRIS_CPU_TYPE_SUFFIX)
+ #define CPU_RESOLVING_TYPE TYPE_CRIS_CPU
+-#define cpu_signal_handler cpu_cris_signal_handler
+-
+ /* MMU modes definitions */
+ #define MMU_USER_IDX 1
+ static inline int cpu_mmu_index (CPUCRISState *env, bool ifetch)
+diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/cpu.h
++++ b/target/hexagon/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct HexagonCPU {
+ #include "cpu_bits.h"
+-#define cpu_signal_handler cpu_hexagon_signal_handler
+-int cpu_hexagon_signal_handler(int host_signum, void *pinfo, void *puc);
+-
+ static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, target_ulong *pc,
+                                         target_ulong *cs_base, uint32_t *flags)
+ {
+diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/cpu.h
++++ b/target/hppa/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_hppa_change_prot_id(CPUHPPAState *env) { }
+ void cpu_hppa_change_prot_id(CPUHPPAState *env);
+ #endif
+-#define cpu_signal_handler cpu_hppa_signal_handler
+-
+-int cpu_hppa_signal_handler(int host_signum, void *pinfo, void *puc);
+ hwaddr hppa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr);
+ int hppa_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+ int hppa_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -XXX,XX +XXX,XX @@ void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
+ void cpu_x86_fxsave(CPUX86State *s, target_ulong ptr);
+ void cpu_x86_fxrstor(CPUX86State *s, target_ulong ptr);
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_x86_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+-
+ /* cpu.c */
+ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
+                               uint32_t vendor2, uint32_t vendor3);
+@@ -XXX,XX +XXX,XX @@ uint64_t cpu_get_tsc(CPUX86State *env);
+ #define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("qemu32")
+ #endif
+-#define cpu_signal_handler cpu_x86_signal_handler
+ #define cpu_list x86_cpu_list
+ /* MMU modes definitions */
+diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.h
++++ b/target/m68k/cpu.h
+@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+ void m68k_tcg_init(void);
+ void m68k_cpu_init_gdb(M68kCPU *cpu);
+-/*
+- * you can call this signal handler from your SIGBUS and SIGSEGV
+- * signal handlers to inform the virtual CPU of exceptions. non zero
+- * is returned if the signal was handled by the virtual CPU.
+- */
+-int cpu_m68k_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+ uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
+ void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
+ void cpu_m68k_set_sr(CPUM68KState *env, uint32_t);
+@@ -XXX,XX +XXX,XX @@ enum {
+ #define M68K_CPU_TYPE_NAME(model) model M68K_CPU_TYPE_SUFFIX
+ #define CPU_RESOLVING_TYPE TYPE_M68K_CPU
+-#define cpu_signal_handler cpu_m68k_signal_handler
+ #define cpu_list m68k_cpu_list
+ /* MMU modes definitions */
+diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/cpu.h
++++ b/target/microblaze/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
+ }
+ void mb_tcg_init(void);
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_mb_signal_handler(int host_signum, void *pinfo,
+-                          void *puc);
+ #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
+-#define cpu_signal_handler cpu_mb_signal_handler
+-
+ /* MMU modes definitions */
+ #define MMU_NOMMU_IDX   0
+ #define MMU_KERNEL_IDX  1
+diff --git a/target/mips/cpu.h b/target/mips/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/cpu.h
++++ b/target/mips/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct MIPSCPU {
+ void mips_cpu_list(void);
+-#define cpu_signal_handler cpu_mips_signal_handler
+ #define cpu_list mips_cpu_list
+ extern void cpu_wrdsp(uint32_t rs, uint32_t mask_num, CPUMIPSState *env);
+@@ -XXX,XX +XXX,XX @@ enum {
+  */
+ #define CPU_INTERRUPT_WAKE CPU_INTERRUPT_TGT_INT_0
+-int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
+-
+ #define MIPS_CPU_TYPE_SUFFIX "-" TYPE_MIPS_CPU
+ #define MIPS_CPU_TYPE_NAME(model) model MIPS_CPU_TYPE_SUFFIX
+ #define CPU_RESOLVING_TYPE TYPE_MIPS_CPU
+diff --git a/target/mips/internal.h b/target/mips/internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/internal.h
++++ b/target/mips/internal.h
+@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_mips_cpu;
+ #endif /* !CONFIG_USER_ONLY */
+-#define cpu_signal_handler cpu_mips_signal_handler
+-
+ static inline bool cpu_mips_hw_interrupts_enabled(CPUMIPSState *env)
+ {
+     return (env->CP0_Status & (1 << CP0St_IE)) &&
+diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/nios2/cpu.h
++++ b/target/nios2/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct Nios2CPU {
+ void nios2_tcg_init(void);
+ void nios2_cpu_do_interrupt(CPUState *cs);
+-int cpu_nios2_signal_handler(int host_signum, void *pinfo, void *puc);
+ void dump_mmu(CPUNios2State *env);
+ void nios2_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
+ hwaddr nios2_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+@@ -XXX,XX +XXX,XX @@ void do_nios2_semihosting(CPUNios2State *env);
+ #define CPU_RESOLVING_TYPE TYPE_NIOS2_CPU
+ #define cpu_gen_code cpu_nios2_gen_code
+-#define cpu_signal_handler cpu_nios2_signal_handler
+ #define CPU_SAVE_VERSION 1
+diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/openrisc/cpu.h
++++ b/target/openrisc/cpu.h
+@@ -XXX,XX +XXX,XX @@ void openrisc_translate_init(void);
+ bool openrisc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                            MMUAccessType access_type, int mmu_idx,
+                            bool probe, uintptr_t retaddr);
+-int cpu_openrisc_signal_handler(int host_signum, void *pinfo, void *puc);
+ int print_insn_or1k(bfd_vma addr, disassemble_info *info);
+ #define cpu_list cpu_openrisc_list
+-#define cpu_signal_handler cpu_openrisc_signal_handler
+ #ifndef CONFIG_USER_ONLY
+ extern const VMStateDescription vmstate_openrisc_cpu;
+diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu.h
++++ b/target/ppc/cpu.h
+@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
+ /*****************************************************************************/
+ void ppc_translate_init(void);
+-/*
+- * you can call this signal handler from your SIGBUS and SIGSEGV
+- * signal handlers to inform the virtual CPU of exceptions. non zero
+- * is returned if the signal was handled by the virtual CPU.
+- */
+-int cpu_ppc_signal_handler(int host_signum, void *pinfo, void *puc);
+ bool ppc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                       MMUAccessType access_type, int mmu_idx,
+                       bool probe, uintptr_t retaddr);
+@@ -XXX,XX +XXX,XX @@ int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
+ #define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
+ #define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
+-#define cpu_signal_handler cpu_ppc_signal_handler
+ #define cpu_list ppc_cpu_list
+ /* MMU modes definitions */
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+ char *riscv_isa_string(RISCVCPU *cpu);
+ void riscv_cpu_list(void);
+-#define cpu_signal_handler riscv_cpu_signal_handler
+ #define cpu_list riscv_cpu_list
+ #define cpu_mmu_index riscv_cpu_mmu_index
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
+ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
+ void riscv_translate_init(void);
+-int riscv_cpu_signal_handler(int host_signum, void *pinfo, void *puc);
+ void QEMU_NORETURN riscv_raise_exception(CPURISCVState *env,
+                                          uint32_t exception, uintptr_t pc);
+diff --git a/target/rx/cpu.h b/target/rx/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/cpu.h
++++ b/target/rx/cpu.h
+@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+ hwaddr rx_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+ void rx_translate_init(void);
+-int cpu_rx_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+-
+ void rx_cpu_list(void);
+ void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
+-#define cpu_signal_handler cpu_rx_signal_handler
+ #define cpu_list rx_cpu_list
+ #include "exec/cpu-all.h"
+diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.h
++++ b/target/s390x/cpu.h
+@@ -XXX,XX +XXX,XX @@ void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
+ #define S390_CPU_TYPE_NAME(name) (name S390_CPU_TYPE_SUFFIX)
+ #define CPU_RESOLVING_TYPE TYPE_S390_CPU
+-/* you can call this signal handler from your SIGBUS and SIGSEGV
+-   signal handlers to inform the virtual CPU of exceptions. non zero
+-   is returned if the signal was handled by the virtual CPU.  */
+-int cpu_s390x_signal_handler(int host_signum, void *pinfo, void *puc);
+-#define cpu_signal_handler cpu_s390x_signal_handler
+-
+-
+ /* interrupt.c */
+ #define RA_IGNORED                  0
+ void s390_program_interrupt(CPUS390XState *env, uint32_t code, uintptr_t ra);
+diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/cpu.h
++++ b/target/sh4/cpu.h
+@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
+                                     int mmu_idx, uintptr_t retaddr);
+ void sh4_translate_init(void);
+-int cpu_sh4_signal_handler(int host_signum, void *pinfo,
+-                           void *puc);
+ bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                          MMUAccessType access_type, int mmu_idx,
+                          bool probe, uintptr_t retaddr);
+@@ -XXX,XX +XXX,XX @@ void cpu_load_tlb(CPUSH4State * env);
+ #define SUPERH_CPU_TYPE_NAME(model) model SUPERH_CPU_TYPE_SUFFIX
+ #define CPU_RESOLVING_TYPE TYPE_SUPERH_CPU
+-#define cpu_signal_handler cpu_sh4_signal_handler
+ #define cpu_list sh4_cpu_list
+ /* MMU modes definitions */
+diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.h
++++ b/target/sparc/cpu.h
+@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
+                                            int mmu_idx);
+ #endif
+ #endif
+-int cpu_sparc_signal_handler(int host_signum, void *pinfo, void *puc);
+ #define SPARC_CPU_TYPE_SUFFIX "-" TYPE_SPARC_CPU
+ #define SPARC_CPU_TYPE_NAME(model) model SPARC_CPU_TYPE_SUFFIX
+ #define CPU_RESOLVING_TYPE TYPE_SPARC_CPU
+-#define cpu_signal_handler cpu_sparc_signal_handler
+ #define cpu_list sparc_cpu_list
+ /* MMU modes definitions */
+diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/cpu.h
++++ b/target/tricore/cpu.h
+@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env);
+ void tricore_cpu_list(void);
+-#define cpu_signal_handler cpu_tricore_signal_handler
+ #define cpu_list tricore_cpu_list
+ static inline int cpu_mmu_index(CPUTriCoreState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ typedef TriCoreCPU ArchCPU;
+ void cpu_state_reset(CPUTriCoreState *s);
+ void tricore_tcg_init(void);
+-int cpu_tricore_signal_handler(int host_signum, void *pinfo, void *puc);
+ static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
+                                         target_ulong *cs_base, uint32_t *flags)
+diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/cpu.h
++++ b/target/xtensa/cpu.h
+@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
+                                     MMUAccessType access_type,
+                                     int mmu_idx, uintptr_t retaddr);
+-#define cpu_signal_handler cpu_xtensa_signal_handler
+ #define cpu_list xtensa_cpu_list
+ #define XTENSA_CPU_TYPE_SUFFIX "-" TYPE_XTENSA_CPU
+@@ -XXX,XX +XXX,XX @@ void check_interrupts(CPUXtensaState *s);
+ void xtensa_irq_init(CPUXtensaState *env);
+ qemu_irq *xtensa_get_extints(CPUXtensaState *env);
+ qemu_irq xtensa_get_runstall(CPUXtensaState *env);
+-int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
+ void xtensa_cpu_list(void);
+ void xtensa_sync_window_from_phys(CPUXtensaState *env);
+ void xtensa_sync_phys_from_window(CPUXtensaState *env);
+--
+.25.1

-[PULL for-5.1 3/3] tcg/cpu-exec: precise single-stepping after an interrupt
+[PULL 02/35] accel/tcg: Restrict cpu_handle_halt() to sysemu
-When single-stepping with a debugger attached to QEMU, and when an
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 interrupt is raised, the debugger misses the first instruction after
 the interrupt.
-Tested-by: Luc Michel <luc.michel@greensocs.com>
+Commit 372579427a5 ("tcg: enable thread-per-vCPU") added the following
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+comment describing EXCP_HALTED in qemu_tcg_cpu_thread_fn():
-Buglink: https://bugs.launchpad.net/qemu/+bug/757702
-Message-Id: <20200717163029.2737546-1-richard.henderson@linaro.org>
+    case EXCP_HALTED:
          /* during start-up the vCPU is reset and the thread is
           * kicked several times. If we don't ensure we go back
           * to sleep in the halted state we won't cleanly
           * start-up when the vCPU is enabled.
           *
           * cpu->halted should ensure we sleep in wait_io_event
           */
          g_assert(cpu->halted);
          break;
 qemu_wait_io_event() is sysemu-specific, so we can restrict the
 cpu_handle_halt() call in cpu_exec() to system emulation.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-2-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c | 8 +++++++-
+ accel/tcg/cpu-exec.c | 6 ++++--
-file changed, 7 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
-         else {
-             if (cc->cpu_exec_interrupt(cpu, interrupt_request)) {
+ static inline bool cpu_handle_halt(CPUState *cpu)
-                 replay_interrupt();
+ {
--                cpu->exception_index = -1;
++#ifndef CONFIG_USER_ONLY
-+                /*
+     if (cpu->halted) {
-+                 * After processing the interrupt, ensure an EXCP_DEBUG is
+-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
-+                 * raised when single-stepping so that GDB doesn't miss the
++#if defined(TARGET_I386)
-+                 * next instruction.
+         if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
-+                 */
+             X86CPU *x86_cpu = X86_CPU(cpu);
-+                cpu->exception_index =
+             qemu_mutex_lock_iothread();
-+                    (cpu->singlestep_enabled ? EXCP_DEBUG : -1);
+@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_halt(CPUState *cpu)
-                 *last_tb = NULL;
+             cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
-             }
+             qemu_mutex_unlock_iothread();
-             /* The target hook may have updated the 'cpu->interrupt_request';
+         }
 -#endif
 +#endif /* TARGET_I386 */
          if (!cpu_has_work(cpu)) {
              return true;
          }
          cpu->halted = 0;
      }
 +#endif /* !CONFIG_USER_ONLY */
      return false;
  }
 --
 .25.1

-New patch
+[PULL 03/35] hw/core: Restrict cpu_has_work() to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+cpu_has_work() is only called from system emulation code.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-3-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/hw/core/cpu.h | 32 ++++++++++++++++----------------
+file changed, 16 insertions(+), 16 deletions(-)
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/core/cpu.h
++++ b/include/hw/core/cpu.h
+@@ -XXX,XX +XXX,XX @@ enum CPUDumpFlags {
+ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
+ #ifndef CONFIG_USER_ONLY
++/**
++ * cpu_has_work:
++ * @cpu: The vCPU to check.
++ *
++ * Checks whether the CPU has work to do.
++ *
++ * Returns: %true if the CPU has work, %false otherwise.
++ */
++static inline bool cpu_has_work(CPUState *cpu)
++{
++    CPUClass *cc = CPU_GET_CLASS(cpu);
++
++    g_assert(cc->has_work);
++    return cc->has_work(cpu);
++}
++
+ /**
+  * cpu_get_phys_page_attrs_debug:
+  * @cpu: The CPU to obtain the physical page address for.
+@@ -XXX,XX +XXX,XX @@ CPUState *cpu_create(const char *typename);
+  */
+ const char *parse_cpu_option(const char *cpu_option);
+-/**
+- * cpu_has_work:
+- * @cpu: The vCPU to check.
+- *
+- * Checks whether the CPU has work to do.
+- *
+- * Returns: %true if the CPU has work, %false otherwise.
+- */
+-static inline bool cpu_has_work(CPUState *cpu)
+-{
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
+-
+-    g_assert(cc->has_work);
+-    return cc->has_work(cpu);
+-}
+-
+ /**
+  * qemu_cpu_is_self:
+  * @cpu: The vCPU to check against.
+--
+.25.1

-New patch
+[PULL 04/35] hw/core: Un-inline cpu_has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We want to make cpu_has_work() per-accelerator. Only declare its
+prototype and move its definition to softmmu/cpus.c.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-4-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/hw/core/cpu.h | 8 +-------
+ softmmu/cpus.c        | 8 ++++++++
+files changed, 9 insertions(+), 7 deletions(-)
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/core/cpu.h
++++ b/include/hw/core/cpu.h
+@@ -XXX,XX +XXX,XX @@ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
+  *
+  * Returns: %true if the CPU has work, %false otherwise.
+  */
+-static inline bool cpu_has_work(CPUState *cpu)
+-{
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
+-
+-    g_assert(cc->has_work);
+-    return cc->has_work(cpu);
+-}
++bool cpu_has_work(CPUState *cpu);
+ /**
+  * cpu_get_phys_page_attrs_debug:
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
+     }
+ }
++bool cpu_has_work(CPUState *cpu)
++{
++    CPUClass *cc = CPU_GET_CLASS(cpu);
++
++    g_assert(cc->has_work);
++    return cc->has_work(cpu);
++}
++
+ static int do_vm_stop(RunState state, bool send_stop)
+ {
+     int ret = 0;
+--
+.25.1

-New patch
+[PULL 05/35] sysemu: Introduce AccelOpsClass::has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Introduce an accelerator-specific has_work() handler.
+Eventually call it from cpu_has_work().
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-5-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/sysemu/accel-ops.h | 5 +++++
+ softmmu/cpus.c             | 3 +++
+files changed, 8 insertions(+)
+diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/sysemu/accel-ops.h
++++ b/include/sysemu/accel-ops.h
+@@ -XXX,XX +XXX,XX @@ struct AccelOpsClass {
+     void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
+     void (*kick_vcpu_thread)(CPUState *cpu);
++    /**
++     * @has_work: Callback for checking if there is work to do.
++     */
++    bool (*has_work)(CPUState *cpu);
++
+     void (*synchronize_post_reset)(CPUState *cpu);
+     void (*synchronize_post_init)(CPUState *cpu);
+     void (*synchronize_state)(CPUState *cpu);
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@ bool cpu_has_work(CPUState *cpu)
+ {
+     CPUClass *cc = CPU_GET_CLASS(cpu);
++    if (cpus_accel->has_work) {
++        return cpus_accel->has_work(cpu);
++    }
+     g_assert(cc->has_work);
+     return cc->has_work(cpu);
+ }
+--
+.25.1

-New patch
+[PULL 06/35] accel/kvm: Implement AccelOpsClass::has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Implement KVM has_work() handler in AccelOpsClass and
+remove it from cpu_thread_is_idle() since cpu_has_work()
+is already called.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-6-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/kvm/kvm-accel-ops.c | 6 ++++++
+ softmmu/cpus.c            | 2 +-
+files changed, 7 insertions(+), 1 deletion(-)
+diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/kvm/kvm-accel-ops.c
++++ b/accel/kvm/kvm-accel-ops.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
+                        cpu, QEMU_THREAD_JOINABLE);
+ }
++static bool kvm_cpu_has_work(CPUState *cpu)
++{
++    return kvm_halt_in_kernel();
++}
++
+ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+ {
+     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+     ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
+     ops->synchronize_state = kvm_cpu_synchronize_state;
+     ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
++    ops->has_work = kvm_cpu_has_work;
+ }
+ static const TypeInfo kvm_accel_ops_type = {
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
+         return true;
+     }
+     if (!cpu->halted || cpu_has_work(cpu) ||
+-        kvm_halt_in_kernel() || whpx_apic_in_platform()) {
++        whpx_apic_in_platform()) {
+         return false;
+     }
+     return true;
+--
+.25.1

-New patch
+[PULL 07/35] accel/whpx: Implement AccelOpsClass::has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Implement WHPX has_work() handler in AccelOpsClass and
+remove it from cpu_thread_is_idle() since cpu_has_work()
+is already called.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-7-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ softmmu/cpus.c                    | 4 +---
+ target/i386/whpx/whpx-accel-ops.c | 6 ++++++
+files changed, 7 insertions(+), 3 deletions(-)
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/replay.h"
+ #include "sysemu/runstate.h"
+ #include "sysemu/cpu-timers.h"
+-#include "sysemu/whpx.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+ #include "trace.h"
+@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
+     if (cpu_is_stopped(cpu)) {
+         return true;
+     }
+-    if (!cpu->halted || cpu_has_work(cpu) ||
+-        whpx_apic_in_platform()) {
++    if (!cpu->halted || cpu_has_work(cpu)) {
+         return false;
+     }
+     return true;
+diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/whpx/whpx-accel-ops.c
++++ b/target/i386/whpx/whpx-accel-ops.c
+@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
+     }
+ }
++static bool whpx_cpu_has_work(CPUState *cpu)
++{
++    return whpx_apic_in_platform();
++}
++
+ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+ {
+     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
+     ops->synchronize_state = whpx_cpu_synchronize_state;
+     ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
++    ops->has_work = whpx_cpu_has_work;
+ }
+ static const TypeInfo whpx_accel_ops_type = {
+--
+.25.1

-New patch
+[PULL 08/35] accel/tcg: Implement AccelOpsClass::has_work() as stub
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Add TCG target-specific has_work() handler in TCGCPUOps,
+and add tcg_cpu_has_work() as AccelOpsClass has_work()
+implementation.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-8-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/hw/core/tcg-cpu-ops.h |  4 ++++
+ accel/tcg/tcg-accel-ops.c     | 12 ++++++++++++
+files changed, 16 insertions(+)
+diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/core/tcg-cpu-ops.h
++++ b/include/hw/core/tcg-cpu-ops.h
+@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
+     void (*do_interrupt)(CPUState *cpu);
+ #endif /* !CONFIG_USER_ONLY || !TARGET_I386 */
+ #ifdef CONFIG_SOFTMMU
++    /**
++     * @has_work: Callback for checking if there is work to do.
++     */
++    bool (*has_work)(CPUState *cpu);
+     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+     /**
+diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/tcg-accel-ops.c
++++ b/accel/tcg/tcg-accel-ops.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/main-loop.h"
+ #include "qemu/guest-random.h"
+ #include "exec/exec-all.h"
++#include "hw/core/tcg-cpu-ops.h"
+ #include "tcg-accel-ops.h"
+ #include "tcg-accel-ops-mttcg.h"
+@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
+     return ret;
+ }
++static bool tcg_cpu_has_work(CPUState *cpu)
++{
++    CPUClass *cc = CPU_GET_CLASS(cpu);
++
++    if (!cc->tcg_ops->has_work) {
++        return false;
++    }
++    return cc->tcg_ops->has_work(cpu);
++}
++
+ /* mask must never be zero, except for A20 change call */
+ void tcg_handle_interrupt(CPUState *cpu, int mask)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_accel_ops_init(AccelOpsClass *ops)
+         ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+         ops->handle_interrupt = tcg_handle_interrupt;
+     }
++    ops->has_work = tcg_cpu_has_work;
+ }
+ static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
+--
+.25.1

-New patch
+[PULL 09/35] target/alpha: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-9-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/alpha/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/cpu.c
++++ b/target/alpha/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.pc = value;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool alpha_cpu_has_work(CPUState *cs)
+ {
+     /* Here we are checking to see if the CPU should wake up from HALT.
+@@ -XXX,XX +XXX,XX @@ static bool alpha_cpu_has_work(CPUState *cs)
+                                     | CPU_INTERRUPT_SMP
+                                     | CPU_INTERRUPT_MCHK);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void alpha_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps alpha_tcg_ops = {
+     .tlb_fill = alpha_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = alpha_cpu_has_work,
+     .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
+     .do_interrupt = alpha_cpu_do_interrupt,
+     .do_transaction_failed = alpha_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+                                     &acc->parent_realize);
+     cc->class_by_name = alpha_cpu_class_by_name;
+-    cc->has_work = alpha_cpu_has_work;
+     cc->dump_state = alpha_cpu_dump_state;
+     cc->set_pc = alpha_cpu_set_pc;
+     cc->gdb_read_register = alpha_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 10/35] target/arm: Restrict has_work() handler to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-10-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/cpu.c | 7 +++++--
+file changed, 5 insertions(+), 2 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
+         env->regs[15] = tb->pc;
+     }
+ }
+-#endif /* CONFIG_TCG */
++#ifndef CONFIG_USER_ONLY
+ static bool arm_cpu_has_work(CPUState *cs)
+ {
+     ARMCPU *cpu = ARM_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
+          | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
+          | CPU_INTERRUPT_EXITTB);
+ }
++#endif /* !CONFIG_USER_ONLY */
++
++#endif /* CONFIG_TCG */
+ void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+                                  void *opaque)
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps arm_tcg_ops = {
+     .debug_excp_handler = arm_debug_excp_handler,
+ #if !defined(CONFIG_USER_ONLY)
++    .has_work = arm_cpu_has_work,
+     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
+     .do_interrupt = arm_cpu_do_interrupt,
+     .do_transaction_failed = arm_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, arm_cpu_reset, &acc->parent_reset);
+     cc->class_by_name = arm_cpu_class_by_name;
+-    cc->has_work = arm_cpu_has_work;
+     cc->dump_state = arm_cpu_dump_state;
+     cc->set_pc = arm_cpu_set_pc;
+     cc->gdb_read_register = arm_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 11/35] target/avr: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-11-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/avr/cpu.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/avr/cpu.c b/target/avr/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/avr/cpu.c
++++ b/target/avr/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
+ static const struct TCGCPUOps avr_tcg_ops = {
+     .initialize = avr_cpu_tcg_init,
+     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
++    .has_work = avr_cpu_has_work,
+     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
+     .tlb_fill = avr_cpu_tlb_fill,
+     .do_interrupt = avr_cpu_do_interrupt,
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
+     cc->class_by_name = avr_cpu_class_by_name;
+-    cc->has_work = avr_cpu_has_work;
+     cc->dump_state = avr_cpu_dump_state;
+     cc->set_pc = avr_cpu_set_pc;
+     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
+--
+.25.1

-New patch
+[PULL 12/35] target/cris: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-12-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/cris/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/cris/cpu.c b/target/cris/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/cris/cpu.c
++++ b/target/cris/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.pc = value;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool cris_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void cris_cpu_reset(DeviceState *dev)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps crisv10_tcg_ops = {
+     .tlb_fill = cris_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = cris_cpu_has_work,
+     .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+     .do_interrupt = crisv10_cpu_do_interrupt,
+ #endif /* !CONFIG_USER_ONLY */
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, cris_cpu_reset, &ccc->parent_reset);
+     cc->class_by_name = cris_cpu_class_by_name;
+-    cc->has_work = cris_cpu_has_work;
+     cc->dump_state = cris_cpu_dump_state;
+     cc->set_pc = cris_cpu_set_pc;
+     cc->gdb_read_register = cris_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 13/35] target/hexagon: Remove unused has_work() handler
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+has_work() is sysemu specific, and Hexagon target only provides
+a linux-user implementation. Remove the unused hexagon_cpu_has_work().
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-13-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/hexagon/cpu.c | 6 ------
+file changed, 6 deletions(-)
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/cpu.c
++++ b/target/hexagon/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
+     env->gpr[HEX_REG_PC] = tb->pc;
+ }
+-static bool hexagon_cpu_has_work(CPUState *cs)
+-{
+-    return true;
+-}
+-
+ void restore_state_to_opc(CPUHexagonState *env, TranslationBlock *tb,
+                           target_ulong *data)
+ {
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_parent_reset(dc, hexagon_cpu_reset, &mcc->parent_reset);
+     cc->class_by_name = hexagon_cpu_class_by_name;
+-    cc->has_work = hexagon_cpu_has_work;
+     cc->dump_state = hexagon_dump_state;
+     cc->set_pc = hexagon_cpu_set_pc;
+     cc->gdb_read_register = hexagon_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 14/35] target/hppa: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-14-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/hppa/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/cpu.c
++++ b/target/hppa/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
+     cpu->env.psw_n = (tb->flags & PSW_N) != 0;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool hppa_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps hppa_tcg_ops = {
+     .tlb_fill = hppa_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = hppa_cpu_has_work,
+     .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
+     .do_interrupt = hppa_cpu_do_interrupt,
+     .do_unaligned_access = hppa_cpu_do_unaligned_access,
+@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+                                     &acc->parent_realize);
+     cc->class_by_name = hppa_cpu_class_by_name;
+-    cc->has_work = hppa_cpu_has_work;
+     cc->dump_state = hppa_cpu_dump_state;
+     cc->set_pc = hppa_cpu_set_pc;
+     cc->gdb_read_register = hppa_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 15/35] target/i386: Restrict has_work() handler to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-15-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/i386/cpu.c         | 6 ------
+ target/i386/tcg/tcg-cpu.c | 8 +++++++-
+files changed, 7 insertions(+), 7 deletions(-)
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -XXX,XX +XXX,XX @@ int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
+     return 0;
+ }
+-static bool x86_cpu_has_work(CPUState *cs)
+-{
+-    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
+-}
+-
+ static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
+ {
+     X86CPU *cpu = X86_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
+     cc->class_by_name = x86_cpu_class_by_name;
+     cc->parse_features = x86_cpu_parse_featurestr;
+-    cc->has_work = x86_cpu_has_work;
+     cc->dump_state = x86_cpu_dump_state;
+     cc->set_pc = x86_cpu_set_pc;
+     cc->gdb_read_register = x86_cpu_gdb_read_register;
+diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/tcg-cpu.c
++++ b/target/i386/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
+ }
+ #ifndef CONFIG_USER_ONLY
++static bool x86_cpu_has_work(CPUState *cs)
++{
++    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
++}
++
+ static bool x86_debug_check_breakpoint(CPUState *cs)
+ {
+     X86CPU *cpu = X86_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
+     /* RF disables all architectural breakpoints. */
+     return !(env->eflags & RF_MASK);
+ }
+-#endif
++#endif /* CONFIG_USER_ONLY */
+ #include "hw/core/tcg-cpu-ops.h"
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps x86_tcg_ops = {
+ #ifdef CONFIG_USER_ONLY
+     .fake_user_interrupt = x86_cpu_do_interrupt,
+ #else
++    .has_work = x86_cpu_has_work,
+     .do_interrupt = x86_cpu_do_interrupt,
+     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+     .debug_excp_handler = breakpoint_handler,
+--
+.25.1

-New patch
+[PULL 16/35] target/m68k: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-16-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/m68k/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.c
++++ b/target/m68k/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.pc = value;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool m68k_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void m68k_set_feature(CPUM68KState *env, int feature)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps m68k_tcg_ops = {
+     .tlb_fill = m68k_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = m68k_cpu_has_work,
+     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
+     .do_interrupt = m68k_cpu_do_interrupt,
+     .do_transaction_failed = m68k_cpu_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_parent_reset(dc, m68k_cpu_reset, &mcc->parent_reset);
+     cc->class_by_name = m68k_cpu_class_by_name;
+-    cc->has_work = m68k_cpu_has_work;
+     cc->dump_state = m68k_cpu_dump_state;
+     cc->set_pc = m68k_cpu_set_pc;
+     cc->gdb_read_register = m68k_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 17/35] target/microblaze: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-17-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/microblaze/cpu.c | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/cpu.c
++++ b/target/microblaze/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
+     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
+ }
++#ifndef CONFIG_USER_ONLY
++
+ static bool mb_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
+ }
+-#ifndef CONFIG_USER_ONLY
+ static void mb_cpu_ns_axi_dp(void *opaque, int irq, int level)
+ {
+     MicroBlazeCPU *cpu = opaque;
+@@ -XXX,XX +XXX,XX @@ static void microblaze_cpu_set_irq(void *opaque, int irq, int level)
+         cpu_reset_interrupt(cs, type);
+     }
+ }
+-#endif
++#endif /* !CONFIG_USER_ONLY */
+ static void mb_cpu_reset(DeviceState *dev)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mb_tcg_ops = {
+     .tlb_fill = mb_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = mb_cpu_has_work,
+     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
+     .do_interrupt = mb_cpu_do_interrupt,
+     .do_transaction_failed = mb_cpu_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, mb_cpu_reset, &mcc->parent_reset);
+     cc->class_by_name = mb_cpu_class_by_name;
+-    cc->has_work = mb_cpu_has_work;
+-
+     cc->dump_state = mb_cpu_dump_state;
+     cc->set_pc = mb_cpu_set_pc;
+     cc->gdb_read_register = mb_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 18/35] target/mips: Restrict has_work() handler to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-18-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/mips/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/mips/cpu.c b/target/mips/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/cpu.c
++++ b/target/mips/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
+     mips_env_set_pc(&cpu->env, value);
+ }
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+ static bool mips_cpu_has_work(CPUState *cs)
+ {
+     MIPSCPU *cpu = MIPS_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static bool mips_cpu_has_work(CPUState *cs)
+     }
+     return has_work;
+ }
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+ #include "cpu-defs.c.inc"
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mips_tcg_ops = {
+     .tlb_fill = mips_cpu_tlb_fill,
+ #if !defined(CONFIG_USER_ONLY)
++    .has_work = mips_cpu_has_work,
+     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+     .do_interrupt = mips_cpu_do_interrupt,
+     .do_transaction_failed = mips_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_props(dc, mips_cpu_properties);
+     cc->class_by_name = mips_cpu_class_by_name;
+-    cc->has_work = mips_cpu_has_work;
+     cc->dump_state = mips_cpu_dump_state;
+     cc->set_pc = mips_cpu_set_pc;
+     cc->gdb_read_register = mips_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 19/35] target/nios2: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-19-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/nios2/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/nios2/cpu.c
++++ b/target/nios2/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
+     env->regs[R_PC] = value;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool nios2_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void nios2_cpu_reset(DeviceState *dev)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps nios2_tcg_ops = {
+     .tlb_fill = nios2_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = nios2_cpu_has_work,
+     .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
+     .do_interrupt = nios2_cpu_do_interrupt,
+     .do_unaligned_access = nios2_cpu_do_unaligned_access,
+@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, nios2_cpu_reset, &ncc->parent_reset);
+     cc->class_by_name = nios2_cpu_class_by_name;
+-    cc->has_work = nios2_cpu_has_work;
+     cc->dump_state = nios2_cpu_dump_state;
+     cc->set_pc = nios2_cpu_set_pc;
+     cc->disas_set_info = nios2_cpu_disas_set_info;
+--
+.25.1

-New patch
+[PULL 20/35] target/openrisc: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-20-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/openrisc/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/openrisc/cpu.c
++++ b/target/openrisc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.dflag = 0;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool openrisc_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD |
+                                     CPU_INTERRUPT_TIMER);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void openrisc_disas_set_info(CPUState *cpu, disassemble_info *info)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps openrisc_tcg_ops = {
+     .tlb_fill = openrisc_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = openrisc_cpu_has_work,
+     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
+     .do_interrupt = openrisc_cpu_do_interrupt,
+ #endif /* !CONFIG_USER_ONLY */
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, openrisc_cpu_reset, &occ->parent_reset);
+     cc->class_by_name = openrisc_cpu_class_by_name;
+-    cc->has_work = openrisc_cpu_has_work;
+     cc->dump_state = openrisc_cpu_dump_state;
+     cc->set_pc = openrisc_cpu_set_pc;
+     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 21/35] target/ppc: Introduce PowerPCCPUClass::has_work()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We're moving the hook from CPUState to TCGCPUOps. TCGCPUOps is
+a const structure, so to avoid creating multiple versions of
+the same structure, simply changing the has_work() handler,
+introduce yet another indirection with a has_work() handler in
+PowerPCCPUClass, and ppc_cpu_has_work() method which dispatch
+to it.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-21-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/ppc/cpu-qom.h  |  1 +
+ target/ppc/cpu_init.c | 23 ++++++++++++++---------
+files changed, 15 insertions(+), 9 deletions(-)
+diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu-qom.h
++++ b/target/ppc/cpu-qom.h
+@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
+     uint32_t flags;
+     int bfd_mach;
+     uint32_t l1_dcache_size, l1_icache_size;
++    bool (*has_work)(CPUState *cpu);
+ #ifndef CONFIG_USER_ONLY
+     unsigned int gdb_num_sprs;
+     const char *gdb_spr_xml;
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+     dc->fw_name = "PowerPC,POWER7";
+     dc->desc = "POWER7";
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
+     pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
+     pcc->init_proc = init_proc_POWER7;
+     pcc->check_pow = check_pow_nocheck;
+-    cc->has_work = cpu_has_work_POWER7;
++    pcc->has_work = cpu_has_work_POWER7;
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
+                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+     dc->fw_name = "PowerPC,POWER8";
+     dc->desc = "POWER8";
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
+     pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
+     pcc->init_proc = init_proc_POWER8;
+     pcc->check_pow = check_pow_nocheck;
+-    cc->has_work = cpu_has_work_POWER8;
++    pcc->has_work = cpu_has_work_POWER8;
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
+                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+     dc->fw_name = "PowerPC,POWER9";
+     dc->desc = "POWER9";
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
+                          PCR_COMPAT_2_05;
+     pcc->init_proc = init_proc_POWER9;
+     pcc->check_pow = check_pow_nocheck;
+-    cc->has_work = cpu_has_work_POWER9;
++    pcc->has_work = cpu_has_work_POWER9;
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
+                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
+     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+     dc->fw_name = "PowerPC,POWER10";
+     dc->desc = "POWER10";
+@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
+                          PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
+     pcc->init_proc = init_proc_POWER10;
+     pcc->check_pow = check_pow_nocheck;
+-    cc->has_work = cpu_has_work_POWER10;
++    pcc->has_work = cpu_has_work_POWER10;
+     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
+                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.nip = value;
+ }
+-static bool ppc_cpu_has_work(CPUState *cs)
++static bool cpu_has_work_default(CPUState *cs)
+ {
+     PowerPCCPU *cpu = POWERPC_CPU(cs);
+     CPUPPCState *env = &cpu->env;
+@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
+     return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
+ }
++static bool ppc_cpu_has_work(CPUState *cs)
++{
++    PowerPCCPU *cpu = POWERPC_CPU(cs);
++    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
++
++    return pcc->has_work(cs);
++}
++
+ static void ppc_cpu_reset(DeviceState *dev)
+ {
+     CPUState *s = CPU(dev);
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
+                                       &pcc->parent_unrealize);
+     pcc->pvr_match = ppc_pvr_match_default;
++    pcc->has_work = cpu_has_work_default;
+     device_class_set_props(dc, ppc_cpu_properties);
+     device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
+--
+.25.1

-New patch
+[PULL 22/35] target/ppc: Restrict has_work() handlers to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Restrict PowerPCCPUClass::has_work() and ppc_cpu_has_work()
 - SysemuCPUOps::has_work() implementation - to TCG sysemu.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210912172731.789788-22-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/ppc/cpu-qom.h  |  4 +++-
  target/ppc/cpu_init.c | 24 ++++++++++++++++++------
 files changed, 21 insertions(+), 7 deletions(-)
 diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu-qom.h
 +++ b/target/ppc/cpu-qom.h
@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
      uint32_t flags;
      int bfd_mach;
      uint32_t l1_dcache_size, l1_icache_size;
 -    bool (*has_work)(CPUState *cpu);
  #ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_TCG
 +    bool (*has_work)(CPUState *cpu);
 +#endif /* CONFIG_TCG */
      unsigned int gdb_num_sprs;
      const char *gdb_spr_xml;
  #endif
 diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu_init.c
 +++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER7(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER7(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
      pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER7;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER7;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2;
      pcc->mmu_model = POWERPC_MMU_2_06;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER7;
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->lrg_decr_bits = 32;
  #endif
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER8(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER8(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
      pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER8;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER8;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                     LPCR_P8_PECE3 | LPCR_P8_PECE4;
      pcc->mmu_model = POWERPC_MMU_2_07;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER8;
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->lrg_decr_bits = 32;
      pcc->n_host_threads = 8;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power9(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER9(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER9(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER9;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER9;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
      pcc->mmu_model = POWERPC_MMU_3_00;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER9;
      /* segment page size remain the same */
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->radix_page_info = &POWER9_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power10(PowerPCCPUClass *pcc, uint32_t pvr)
      return false;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_POWER10(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER10(CPUState *cs)
          return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
      }
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
                           PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
      pcc->init_proc = init_proc_POWER10;
      pcc->check_pow = check_pow_nocheck;
 -    pcc->has_work = cpu_has_work_POWER10;
      pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                         PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                         PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
      pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
      pcc->mmu_model = POWERPC_MMU_3_00;
  #if defined(CONFIG_SOFTMMU)
 +    pcc->has_work = cpu_has_work_POWER10;
      /* segment page size remain the same */
      pcc->hash64_opts = &ppc_hash64_opts_POWER7;
      pcc->radix_page_info = &POWER10_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
      cpu->env.nip = value;
  }
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static bool cpu_has_work_default(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
      return pcc->has_work(cs);
  }
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  static void ppc_cpu_reset(DeviceState *dev)
  {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps ppc_tcg_ops = {
    .tlb_fill = ppc_cpu_tlb_fill,
  #ifndef CONFIG_USER_ONLY
 +  .has_work = ppc_cpu_has_work,
    .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
    .do_interrupt = ppc_cpu_do_interrupt,
    .cpu_exec_enter = ppc_cpu_exec_enter,
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
                                        &pcc->parent_unrealize);
      pcc->pvr_match = ppc_pvr_match_default;
 -    pcc->has_work = cpu_has_work_default;
      device_class_set_props(dc, ppc_cpu_properties);
      device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
      cc->class_by_name = ppc_cpu_class_by_name;
 -    cc->has_work = ppc_cpu_has_work;
      cc->dump_state = ppc_cpu_dump_state;
      cc->set_pc = ppc_cpu_set_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops = &ppc_tcg_ops;
 +#ifndef CONFIG_USER_ONLY
 +    pcc->has_work = cpu_has_work_default;
 +#endif
  #endif /* CONFIG_TCG */
  }
 --
 .25.1

-New patch
+[PULL 23/35] target/riscv: Restrict has_work() handler to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-23-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/riscv/cpu.c | 8 +++-----
+file changed, 3 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
+     env->pc = tb->pc;
+ }
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+ static bool riscv_cpu_has_work(CPUState *cs)
+ {
+-#ifndef CONFIG_USER_ONLY
+     RISCVCPU *cpu = RISCV_CPU(cs);
+     CPURISCVState *env = &cpu->env;
+     /*
+@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
+      * mode and delegation registers, but respect individual enables
+      */
+     return (env->mip & env->mie) != 0;
+-#else
+-    return true;
+-#endif
+ }
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+ void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
+                           target_ulong *data)
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
+     .tlb_fill = riscv_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = riscv_cpu_has_work,
+     .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
+     .do_interrupt = riscv_cpu_do_interrupt,
+     .do_transaction_failed = riscv_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_parent_reset(dc, riscv_cpu_reset, &mcc->parent_reset);
+     cc->class_by_name = riscv_cpu_class_by_name;
+-    cc->has_work = riscv_cpu_has_work;
+     cc->dump_state = riscv_cpu_dump_state;
+     cc->set_pc = riscv_cpu_set_pc;
+     cc->gdb_read_register = riscv_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 24/35] target/rx: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-24-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/rx/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/cpu.c
++++ b/target/rx/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
+     cpu->env.pc = tb->pc;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool rx_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request &
+         (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void rx_cpu_reset(DeviceState *dev)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps rx_tcg_ops = {
+     .tlb_fill = rx_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = rx_cpu_has_work,
+     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
+     .do_interrupt = rx_cpu_do_interrupt,
+ #endif /* !CONFIG_USER_ONLY */
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
+                                   &rcc->parent_reset);
+     cc->class_by_name = rx_cpu_class_by_name;
+-    cc->has_work = rx_cpu_has_work;
+     cc->dump_state = rx_cpu_dump_state;
+     cc->set_pc = rx_cpu_set_pc;
+--
+.25.1

-New patch
+[PULL 25/35] target/s390x: Restrict has_work() handler to sysemu and TCG
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to TCG sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-25-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/s390x/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.psw.addr = value;
+ }
++#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+ static bool s390_cpu_has_work(CPUState *cs)
+ {
+     S390CPU *cpu = S390_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static bool s390_cpu_has_work(CPUState *cs)
+     return s390_cpu_has_int(cpu);
+ }
++#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+ /* S390CPUClass::reset() */
+ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps s390_tcg_ops = {
+     .tlb_fill = s390_cpu_tlb_fill,
+ #if !defined(CONFIG_USER_ONLY)
++    .has_work = s390_cpu_has_work,
+     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+     .do_interrupt = s390_cpu_do_interrupt,
+     .debug_excp_handler = s390x_cpu_debug_excp_handler,
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+     scc->reset = s390_cpu_reset;
+     cc->class_by_name = s390_cpu_class_by_name,
+-    cc->has_work = s390_cpu_has_work;
+     cc->dump_state = s390_cpu_dump_state;
+     cc->set_pc = s390_cpu_set_pc;
+     cc->gdb_read_register = s390_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 26/35] target/sh4: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-26-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/sh4/cpu.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/cpu.c
++++ b/target/sh4/cpu.c
+@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
+     }
+     return false;
+ }
+-#endif
+ static bool superh_cpu_has_work(CPUState *cs)
+ {
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
+ }
++#endif /* !CONFIG_USER_ONLY */
++
+ static void superh_cpu_reset(DeviceState *dev)
+ {
+     CPUState *s = CPU(dev);
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps superh_tcg_ops = {
+     .tlb_fill = superh_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = superh_cpu_has_work,
+     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
+     .do_interrupt = superh_cpu_do_interrupt,
+     .do_unaligned_access = superh_cpu_do_unaligned_access,
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, superh_cpu_reset, &scc->parent_reset);
+     cc->class_by_name = superh_cpu_class_by_name;
+-    cc->has_work = superh_cpu_has_work;
+     cc->dump_state = superh_cpu_dump_state;
+     cc->set_pc = superh_cpu_set_pc;
+     cc->gdb_read_register = superh_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 27/35] target/sparc: Remove pointless use of CONFIG_TCG definition
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The SPARC target only support TCG acceleration. Remove the CONFIG_TCG
+definition introduced by mistake in commit 78271684719 ("cpu: tcg_ops:
+move to tcg-cpu-ops.h, keep a pointer in CPUClass").
+Reported-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-27-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/sparc/cpu.c | 2 --
+file changed, 2 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
+ };
+ #endif
+-#ifdef CONFIG_TCG
+ #include "hw/core/tcg-cpu-ops.h"
+ static const struct TCGCPUOps sparc_tcg_ops = {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
+     .do_unaligned_access = sparc_cpu_do_unaligned_access,
+ #endif /* !CONFIG_USER_ONLY */
+ };
+-#endif /* CONFIG_TCG */
+ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+ {
+--
+.25.1

-New patch
+[PULL 28/35] target/sparc: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-28-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/sparc/cpu.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
+     cpu->env.npc = tb->cs_base;
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool sparc_cpu_has_work(CPUState *cs)
+ {
+     SPARCCPU *cpu = SPARC_CPU(cs);
+@@ -XXX,XX +XXX,XX @@ static bool sparc_cpu_has_work(CPUState *cs)
+     return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+            cpu_interrupts_enabled(env);
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static char *sparc_cpu_type_name(const char *cpu_model)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
+     .tlb_fill = sparc_cpu_tlb_fill,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = sparc_cpu_has_work,
+     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
+     .do_interrupt = sparc_cpu_do_interrupt,
+     .do_transaction_failed = sparc_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+     cc->class_by_name = sparc_cpu_class_by_name;
+     cc->parse_features = sparc_cpu_parse_features;
+-    cc->has_work = sparc_cpu_has_work;
+     cc->dump_state = sparc_cpu_dump_state;
+ #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
+     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
+--
+.25.1

-New patch
+[PULL 29/35] target/tricore: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-29-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/tricore/cpu.c | 6 +++++-
+file changed, 5 insertions(+), 1 deletion(-)
+diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/cpu.c
++++ b/target/tricore/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_reset(DeviceState *dev)
+     cpu_state_reset(env);
+ }
++#if !defined(CONFIG_USER_ONLY)
+ static bool tricore_cpu_has_work(CPUState *cs)
+ {
+     return true;
+ }
++#endif /* !CONFIG_USER_ONLY */
+ static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps tricore_tcg_ops = {
+     .initialize = tricore_tcg_init,
+     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
+     .tlb_fill = tricore_cpu_tlb_fill,
++#if !defined(CONFIG_USER_ONLY)
++    .has_work = tricore_cpu_has_work,
++#endif
+ };
+ static void tricore_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
+     device_class_set_parent_reset(dc, tricore_cpu_reset, &mcc->parent_reset);
+     cc->class_by_name = tricore_cpu_class_by_name;
+-    cc->has_work = tricore_cpu_has_work;
+     cc->gdb_read_register = tricore_cpu_gdb_read_register;
+     cc->gdb_write_register = tricore_cpu_gdb_write_register;
+--
+.25.1

-New patch
+[PULL 30/35] target/xtensa: Restrict has_work() handler to sysemu
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Restrict has_work() to sysemu.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20210912172731.789788-30-f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/xtensa/cpu.c | 14 +++++++-------
+file changed, 7 insertions(+), 7 deletions(-)
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/cpu.c
++++ b/target/xtensa/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
+     cpu->env.pc = value;
+ }
++#ifndef CONFIG_USER_ONLY
++
+ static bool xtensa_cpu_has_work(CPUState *cs)
+ {
+-#ifndef CONFIG_USER_ONLY
+     XtensaCPU *cpu = XTENSA_CPU(cs);
+     return !cpu->env.runstall && cpu->env.pending_irq_level;
+-#else
+-    return true;
+-#endif
+ }
+-#ifdef CONFIG_USER_ONLY
++#else /* CONFIG_USER_ONLY*/
++
+ static bool abi_call0;
+ void xtensa_set_abi_call0(void)
+@@ -XXX,XX +XXX,XX @@ bool xtensa_abi_call0(void)
+ {
+     return abi_call0;
+ }
+-#endif
++
++#endif /* CONFIG_USER_ONLY */
+ static void xtensa_cpu_reset(DeviceState *dev)
+ {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps xtensa_tcg_ops = {
+     .debug_excp_handler = xtensa_breakpoint_handler,
+ #ifndef CONFIG_USER_ONLY
++    .has_work = xtensa_cpu_has_work,
+     .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
+     .do_interrupt = xtensa_cpu_do_interrupt,
+     .do_transaction_failed = xtensa_cpu_do_transaction_failed,
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
+     device_class_set_parent_reset(dc, xtensa_cpu_reset, &xcc->parent_reset);
+     cc->class_by_name = xtensa_cpu_class_by_name;
+-    cc->has_work = xtensa_cpu_has_work;
+     cc->dump_state = xtensa_cpu_dump_state;
+     cc->set_pc = xtensa_cpu_set_pc;
+     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
+--
+.25.1

-New patch
+[PULL 31/35] accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 cpu_common_has_work() is the default has_work() implementation
 and returns 'false'.
 Explicit it for the QTest / HAX / HVF / NVMM / Xen accelerators
 and remove cpu_common_has_work().
 Since there are no more implementations of SysemuCPUOps::has_work,
 remove it along with the assertion in cpu_has_work().
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Paul Durrant <paul@xen.org>
 Message-Id: <20210912172731.789788-31-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  include/hw/core/cpu.h             | 2 --
  accel/hvf/hvf-accel-ops.c         | 6 ++++++
  accel/qtest/qtest.c               | 6 ++++++
  accel/xen/xen-all.c               | 6 ++++++
  hw/core/cpu-common.c              | 6 ------
  softmmu/cpus.c                    | 9 ++-------
  target/i386/hax/hax-accel-ops.c   | 6 ++++++
  target/i386/nvmm/nvmm-accel-ops.c | 6 ++++++
 files changed, 32 insertions(+), 15 deletions(-)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
   * instantiatable CPU type.
   * @parse_features: Callback to parse command line arguments.
   * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
 - * @has_work: Callback for checking if there is work to do.
   * @memory_rw_debug: Callback for GDB memory access.
   * @dump_state: Callback for dumping state.
   * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*parse_features)(const char *typename, char *str, Error **errp);
      int reset_dump_flags;
 -    bool (*has_work)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
      void (*dump_state)(CPUState *cpu, FILE *, int flags);
 diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/hvf/hvf-accel-ops.c
 +++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 +static bool hvf_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
      ops->synchronize_state = hvf_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
 +    ops->has_work = hvf_cpu_has_work;
  };
  static const TypeInfo hvf_accel_ops_type = {
      .name = ACCEL_OPS_NAME("hvf"),
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
  };
  module_obj(TYPE_QTEST_ACCEL);
 +static bool qtest_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
      ops->create_vcpu_thread = dummy_start_vcpu_thread;
      ops->get_virtual_clock = qtest_get_virtual_clock;
 +    ops->has_work = qtest_cpu_has_work;
  };
  static const TypeInfo qtest_accel_ops_type = {
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
      .class_init = xen_accel_class_init,
  };
 +static bool xen_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
      ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +    ops->has_work = xen_cpu_has_work;
  }
  static const TypeInfo xen_accel_ops_type = {
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
      }
  }
 -static bool cpu_common_has_work(CPUState *cs)
 -{
 -    return false;
 -}
 -
  ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
  {
      CPUClass *cc = CPU_CLASS(object_class_by_name(typename));
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
      k->parse_features = cpu_common_parse_features;
      k->get_arch_id = cpu_common_get_arch_id;
 -    k->has_work = cpu_common_has_work;
      k->gdb_read_register = cpu_common_gdb_read_register;
      k->gdb_write_register = cpu_common_gdb_write_register;
      set_bit(DEVICE_CATEGORY_CPU, dc->categories);
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
  bool cpu_has_work(CPUState *cpu)
  {
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    if (cpus_accel->has_work) {
 -        return cpus_accel->has_work(cpu);
 -    }
 -    g_assert(cc->has_work);
 -    return cc->has_work(cpu);
 +    g_assert(cpus_accel->has_work);
 +    return cpus_accel->has_work(cpu);
  }
  static int do_vm_stop(RunState state, bool send_stop)
 diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-accel-ops.c
 +++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
  #endif
  }
 +static bool hax_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = hax_cpu_synchronize_post_init;
      ops->synchronize_state = hax_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
 +    ops->has_work = hax_cpu_has_work;
  }
  static const TypeInfo hax_accel_ops_type = {
 diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/nvmm/nvmm-accel-ops.c
 +++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void nvmm_kick_vcpu_thread(CPUState *cpu)
      cpus_kick_thread(cpu);
  }
 +static bool nvmm_cpu_has_work(CPUState *cpu)
 +{
 +    return false;
 +}
 +
  static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
  {
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
      ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
      ops->synchronize_state = nvmm_cpu_synchronize_state;
      ops->synchronize_pre_loadvm = nvmm_cpu_synchronize_pre_loadvm;
 +    ops->has_work = nvmm_cpu_has_work;
  }
  static const TypeInfo nvmm_accel_ops_type = {
 --
 .25.1

-[PULL for-5.1 1/3] tcg: Save/restore vecop_list around minmax fallback
+[PULL 32/35] tcg/mips: Drop inline markers
-Forgetting this asserts when tcg_gen_cmp_vec is called from
+Let the compiler decide about inlining.
-within tcg_gen_cmpsel_vec.
+Remove tcg_out_ext8s and tcg_out_ext16s as unused.
-Fixes: 72b4c792c7a
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-op-vec.c | 2 ++
+ tcg/mips/tcg-target.c.inc | 76 ++++++++++++++-------------------------
-file changed, 2 insertions(+)
+file changed, 27 insertions(+), 49 deletions(-)
-diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-vec.c
+--- a/tcg/mips/tcg-target.c.inc
-+++ b/tcg/tcg-op-vec.c
++++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void do_minmax(unsigned vece, TCGv_vec r, TCGv_vec a,
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-                       TCGv_vec b, TCGOpcode opc, TCGCond cond)
+ #endif
- {
-     if (!do_op3(vece, r, a, b, opc)) {
-+        const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);
+-static inline bool is_p2m1(tcg_target_long val)
-         tcg_gen_cmpsel_vec(cond, vece, r, a, b, a, b);
++static bool is_p2m1(tcg_target_long val)
-+        tcg_swap_vecop_list(hold_list);
+ {
      return val && ((val + 1) & val) == 0;
  }
@@ -XXX,XX +XXX,XX @@ typedef enum {
  /*
   * Type reg
   */
 -static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
 -                                   TCGReg rd, TCGReg rs, TCGReg rt)
 +static void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
 +                            TCGReg rd, TCGReg rs, TCGReg rt)
  {
      int32_t inst;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
  /*
   * Type immediate
   */
 -static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
 -                                   TCGReg rt, TCGReg rs, TCGArg imm)
 +static void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
 +                            TCGReg rt, TCGReg rs, TCGArg imm)
  {
      int32_t inst;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
  /*
   * Type bitfield
   */
 -static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
 -                                  TCGReg rs, int msb, int lsb)
 +static void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
 +                           TCGReg rs, int msb, int lsb)
  {
      int32_t inst;
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
      tcg_out32(s, inst);
  }
 -static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
 -                                    MIPSInsn oph, TCGReg rt, TCGReg rs,
 +static void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
 +                             MIPSInsn oph, TCGReg rt, TCGReg rs,
                                      int msb, int lsb)
  {
      if (lsb >= 32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
  /*
   * Type branch
   */
 -static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
 -                                  TCGReg rt, TCGReg rs)
 +static void tcg_out_opc_br(TCGContext *s, MIPSInsn opc, TCGReg rt, TCGReg rs)
  {
      tcg_out_opc_imm(s, opc, rt, rs, 0);
  }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
  /*
   * Type sa
   */
 -static inline void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
 -                                  TCGReg rd, TCGReg rt, TCGArg sa)
 +static void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
 +                           TCGReg rd, TCGReg rt, TCGArg sa)
  {
      int32_t inst;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_opc_jmp(TCGContext *s, MIPSInsn opc, const void *target)
      return true;
  }
 -static inline void tcg_out_nop(TCGContext *s)
 +static void tcg_out_nop(TCGContext *s)
  {
      tcg_out32(s, 0);
  }
 -static inline void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 +static void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
  {
      tcg_out_opc_sa64(s, OPC_DSLL, OPC_DSLL32, rd, rt, sa);
  }
 -static inline void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 +static void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
  {
      tcg_out_opc_sa64(s, OPC_DSRL, OPC_DSRL32, rd, rt, sa);
  }
 -static inline void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 +static void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
  {
      tcg_out_opc_sa64(s, OPC_DSRA, OPC_DSRA32, rd, rt, sa);
  }
 -static inline bool tcg_out_mov(TCGContext *s, TCGType type,
 -                               TCGReg ret, TCGReg arg)
 +static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
  {
      /* Simple reg-reg move, optimising out the 'do nothing' case */
      if (ret != arg) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
      }
  }
+-static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
+-{
+-    if (use_mips32r2_instructions) {
+-        tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
+-    } else {
+-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
+-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 24);
+-    }
+-}
+-
+-static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
+-{
+-    if (use_mips32r2_instructions) {
+-        tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
+-    } else {
+-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 16);
+-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
+-    }
+-}
+-
+-static inline void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
++static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
+ {
+     if (use_mips32r2_instructions) {
+         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
+     tcg_out_opc_imm(s, opc, data, addr, lo);
+ }
+-static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
+-                              TCGReg arg1, intptr_t arg2)
++static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
++                       TCGReg arg1, intptr_t arg2)
+ {
+     MIPSInsn opc = OPC_LD;
+     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
+     tcg_out_ldst(s, opc, arg, arg1, arg2);
+ }
+-static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+-                              TCGReg arg1, intptr_t arg2)
++static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
++                       TCGReg arg1, intptr_t arg2)
+ {
+     MIPSInsn opc = OPC_SD;
+     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
+@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+     tcg_out_ldst(s, opc, arg, arg1, arg2);
+ }
+-static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
+-                               TCGReg base, intptr_t ofs)
++static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
++                        TCGReg base, intptr_t ofs)
+ {
+     if (val == 0) {
+         tcg_out_st(s, type, TCG_REG_ZERO, base, ofs);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_clz(TCGContext *s, MIPSInsn opcv2, MIPSInsn opcv6,
+     }
+ }
+-static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
+-                              const TCGArg args[TCG_MAX_OP_ARGS],
+-                              const int const_args[TCG_MAX_OP_ARGS])
++static void tcg_out_op(TCGContext *s, TCGOpcode opc,
++                       const TCGArg args[TCG_MAX_OP_ARGS],
++                       const int const_args[TCG_MAX_OP_ARGS])
+ {
+     MIPSInsn i1, i2;
+     TCGArg a0, a1, a2;
 --
 .25.1

-New patch
+[PULL 33/35] tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
+Weaning off of unique alignment requirements, so allow JAL
+to not reach the target.  TCG_TMP1 is always available for
+use as a scratch because it is clobbered by the subroutine
+being called.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/mips/tcg-target.c.inc | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
+ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
+ {
+-    bool ok = tcg_out_opc_jmp(s, OPC_JAL, sub);
+-    tcg_debug_assert(ok);
++    if (!tcg_out_opc_jmp(s, OPC_JAL, sub)) {
++        tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP1, (uintptr_t)sub);
++        tcg_out_opc_reg(s, OPC_JALR, TCG_REG_RA, TCG_TMP1, 0);
++    }
+ }
+ static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
+--
+.25.1

-New patch
+[PULL 34/35] tcg/mips: Unset TCG_TARGET_HAS_direct_jump
+Only use indirect jumps.  Finish weaning away from the
+unique alignment requirements for code_gen_buffer.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/mips/tcg-target.h     | 12 +++++-------
+ tcg/mips/tcg-target.c.inc | 23 +++++------------------
+files changed, 10 insertions(+), 25 deletions(-)
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -XXX,XX +XXX,XX @@
+ #define TCG_TARGET_TLB_DISPLACEMENT_BITS 16
+ #define TCG_TARGET_NB_REGS 32
+-/*
+- * We have a 256MB branch region, but leave room to make sure the
+- * main executable is also within that region.
+- */
+-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * MiB)
++#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
+ typedef enum {
+     TCG_REG_ZERO = 0,
+@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
+ #define TCG_TARGET_HAS_muluh_i32        1
+ #define TCG_TARGET_HAS_mulsh_i32        1
+ #define TCG_TARGET_HAS_bswap32_i32      1
+-#define TCG_TARGET_HAS_direct_jump      1
++#define TCG_TARGET_HAS_direct_jump      0
+ #if TCG_TARGET_REG_BITS == 64
+ #define TCG_TARGET_HAS_add2_i32         0
+@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
+ #define TCG_TARGET_DEFAULT_MO (0)
+ #define TCG_TARGET_HAS_MEMORY_BSWAP     1
+-void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
++/* not defined -- call should be eliminated at compile time */
++void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
++    QEMU_ERROR("code path is reachable");
+ #ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+         }
+         break;
+     case INDEX_op_goto_tb:
+-        if (s->tb_jmp_insn_offset) {
+-            /* direct jump method */
+-            s->tb_jmp_insn_offset[a0] = tcg_current_code_size(s);
+-            /* Avoid clobbering the address during retranslation.  */
+-            tcg_out32(s, OPC_J | (*(uint32_t *)s->code_ptr & 0x3ffffff));
+-        } else {
+-            /* indirect jump method */
+-            tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
+-                       (uintptr_t)(s->tb_jmp_target_addr + a0));
+-            tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
+-        }
++        /* indirect jump method */
++        tcg_debug_assert(s->tb_jmp_insn_offset == 0);
++        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
++                   (uintptr_t)(s->tb_jmp_target_addr + a0));
++        tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
+         tcg_out_nop(s);
+         set_jmp_reset_offset(s, a0);
+         break;
+@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
+     tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP);   /* global pointer */
+ }
+-void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
+-                              uintptr_t jmp_rw, uintptr_t addr)
+-{
+-    qatomic_set((uint32_t *)jmp_rw, deposit32(OPC_J, 0, 26, addr >> 2));
+-    flush_idcache_range(jmp_rx, jmp_rw, 4);
+-}
+-
+ typedef struct {
+     DebugFrameHeader h;
+     uint8_t fde_def_cfa[4];
+--
+.25.1

-[PULL for-5.1 2/3] tcg/cpu-exec: precise single-stepping after an exception
+[PULL 35/35] tcg/mips: Drop special alignment for code_gen_buffer
-From: Luc Michel <luc.michel@greensocs.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 When single-stepping with a debugger attached to QEMU, and when an
 exception is raised, the debugger misses the first instruction after the
 exception:
 $ qemu-system-aarch64 -M virt -display none -cpu cortex-a53 -s -S
 $ aarch64-linux-gnu-gdb
 GNU gdb (GDB) 9.2
 [...]
 (gdb) tar rem :1234
 Remote debugging using :1234
 warning: No executable has been specified and target does not support
 determining executable automatically.  Try using the "file" command.
 x0000000000000000 in ?? ()
 (gdb) # writing nop insns to 0x200 and 0x204
 (gdb) set *0x200 = 0xd503201f
 (gdb) set *0x204 = 0xd503201f
 (gdb) # 0x0 address contains 0 which is an invalid opcode.
 (gdb) # The CPU should raise an exception and jump to 0x200
 (gdb) si
 x0000000000000204 in ?? ()
 With this commit, the same run steps correctly on the first instruction
 of the exception vector:
 (gdb) si
 x0000000000000200 in ?? ()
 Buglink: https://bugs.launchpad.net/qemu/+bug/757702
 Signed-off-by: Luc Michel <luc.michel@greensocs.com>
 Message-Id: <20200716193947.3058389-1-luc.michel@greensocs.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/cpu-exec.c | 11 +++++++++++
+ tcg/region.c | 91 ----------------------------------------------------
-file changed, 11 insertions(+)
+file changed, 91 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+diff --git a/tcg/region.c b/tcg/region.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/tcg/region.c
-+++ b/accel/tcg/cpu-exec.c
++++ b/tcg/region.c
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
+@@ -XXX,XX +XXX,XX @@ static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
-             cc->do_interrupt(cpu);
+   (DEFAULT_CODE_GEN_BUFFER_SIZE_1 < MAX_CODE_GEN_BUFFER_SIZE \
-             qemu_mutex_unlock_iothread();
+    ? DEFAULT_CODE_GEN_BUFFER_SIZE_1 : MAX_CODE_GEN_BUFFER_SIZE)
-             cpu->exception_index = -1;
-+
+-#ifdef __mips__
-+            if (unlikely(cpu->singlestep_enabled)) {
+-/*
-+                /*
+- * In order to use J and JAL within the code_gen_buffer, we require
-+                 * After processing the exception, ensure an EXCP_DEBUG is
+- * that the buffer not cross a 256MB boundary.
-+                 * raised when single-stepping so that GDB doesn't miss the
+- */
-+                 * next instruction.
+-static inline bool cross_256mb(void *addr, size_t size)
-+                 */
+-{
-+                *ret = EXCP_DEBUG;
+-    return ((uintptr_t)addr ^ ((uintptr_t)addr + size)) & ~0x0ffffffful;
-+                cpu_handle_debug_exception(cpu);
+-}
-+                return true;
+-
-+            }
+-/*
-         } else if (!replay_has_interrupt()) {
+- * We weren't able to allocate a buffer without crossing that boundary,
-             /* give a chance to iothread in replay mode */
+- * so make do with the larger portion of the buffer that doesn't cross.
-             *ret = EXCP_INTERRUPT;
+- * Returns the new base and size of the buffer in *obuf and *osize.
 - */
 -static inline void split_cross_256mb(void **obuf, size_t *osize,
 -                                     void *buf1, size_t size1)
 -{
 -    void *buf2 = (void *)(((uintptr_t)buf1 + size1) & ~0x0ffffffful);
 -    size_t size2 = buf1 + size1 - buf2;
 -
 -    size1 = buf2 - buf1;
 -    if (size1 < size2) {
 -        size1 = size2;
 -        buf1 = buf2;
 -    }
 -
 -    *obuf = buf1;
 -    *osize = size1;
 -}
 -#endif
 -
  #ifdef USE_STATIC_CODE_GEN_BUFFER
  static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE]
      __attribute__((aligned(CODE_GEN_ALIGN)));
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
          size = QEMU_ALIGN_DOWN(tb_size, qemu_real_host_page_size);
      }
 -#ifdef __mips__
 -    if (cross_256mb(buf, size)) {
 -        split_cross_256mb(&buf, &size, buf, size);
 -    }
 -#endif
 -
      region.start_aligned = buf;
      region.total_size = size;
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer_anon(size_t size, int prot,
          return -1;
      }
 -#ifdef __mips__
 -    if (cross_256mb(buf, size)) {
 -        /*
 -         * Try again, with the original still mapped, to avoid re-acquiring
 -         * the same 256mb crossing.
 -         */
 -        size_t size2;
 -        void *buf2 = mmap(NULL, size, prot, flags, -1, 0);
 -        switch ((int)(buf2 != MAP_FAILED)) {
 -        case 1:
 -            if (!cross_256mb(buf2, size)) {
 -                /* Success!  Use the new buffer.  */
 -                munmap(buf, size);
 -                break;
 -            }
 -            /* Failure.  Work with what we had.  */
 -            munmap(buf2, size);
 -            /* fallthru */
 -        default:
 -            /* Split the original buffer.  Free the smaller half.  */
 -            split_cross_256mb(&buf2, &size2, buf, size);
 -            if (buf == buf2) {
 -                munmap(buf + size2, size - size2);
 -            } else {
 -                munmap(buf, size - size2);
 -            }
 -            size = size2;
 -            break;
 -        }
 -        buf = buf2;
 -    }
 -#endif
 -
      region.start_aligned = buf;
      region.total_size = size;
      return prot;
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
      void *buf_rw = NULL, *buf_rx = MAP_FAILED;
      int fd = -1;
 -#ifdef __mips__
 -    /* Find space for the RX mapping, vs the 256MiB regions. */
 -    if (alloc_code_gen_buffer_anon(size, PROT_NONE,
 -                                   MAP_PRIVATE | MAP_ANONYMOUS |
 -                                   MAP_NORESERVE, errp) < 0) {
 -        return false;
 -    }
 -    /* The size of the mapping may have been adjusted. */
 -    buf_rx = region.start_aligned;
 -    size = region.total_size;
 -#endif
 -
      buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
      if (buf_rw == NULL) {
          goto fail;
      }
 -#ifdef __mips__
 -    void *tmp = mmap(buf_rx, size, PROT_READ | PROT_EXEC,
 -                     MAP_SHARED | MAP_FIXED, fd, 0);
 -    if (tmp != buf_rx) {
 -        goto fail_rx;
 -    }
 -#else
      buf_rx = mmap(NULL, size, PROT_READ | PROT_EXEC, MAP_SHARED, fd, 0);
      if (buf_rx == MAP_FAILED) {
          goto fail_rx;
      }
 -#endif
      close(fd);
      region.start_aligned = buf_rw;
 --
 .25.1

The following changes since commit 95d1fbabae0cd44156ac4b96d512d143ca7dfd5e:

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200716-pull-request' into staging (2020-07-16 18:50:51 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20200717

for you to fetch changes up to ba3c35d9c4026361fd380b269dc6def9510b7166:

tcg/cpu-exec: precise single-stepping after an interrupt (2020-07-17 11:09:34 -0700)

----------------------------------------------------------------
Fix vector min/max fallback expansion
Fix singlestep from exception and interrupt

----------------------------------------------------------------
Luc Michel (1):
      tcg/cpu-exec: precise single-stepping after an exception

Richard Henderson (2):
      tcg: Save/restore vecop_list around minmax fallback
      tcg/cpu-exec: precise single-stepping after an interrupt

accel/tcg/cpu-exec.c | 19 ++++++++++++++++++-
 tcg/tcg-op-vec.c     |  2 ++
 2 files changed, 20 insertions(+), 1 deletion(-)

From: Luc Michel <luc.michel@greensocs.com>

When single-stepping with a debugger attached to QEMU, and when an
exception is raised, the debugger misses the first instruction after the
exception:

$ qemu-system-aarch64 -M virt -display none -cpu cortex-a53 -s -S

$ aarch64-linux-gnu-gdb
GNU gdb (GDB) 9.2
[...]
(gdb) tar rem :1234
Remote debugging using :1234
warning: No executable has been specified and target does not support
determining executable automatically.  Try using the "file" command.
0x0000000000000000 in ?? ()
(gdb) # writing nop insns to 0x200 and 0x204
(gdb) set *0x200 = 0xd503201f
(gdb) set *0x204 = 0xd503201f
(gdb) # 0x0 address contains 0 which is an invalid opcode.
(gdb) # The CPU should raise an exception and jump to 0x200
(gdb) si
0x0000000000000204 in ?? ()

With this commit, the same run steps correctly on the first instruction
of the exception vector:

(gdb) si
0x0000000000000200 in ?? ()

Buglink: https://bugs.launchpad.net/qemu/+bug/757702
Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-Id: <20200716193947.3058389-1-luc.michel@greensocs.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             cc->do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
+
+            if (unlikely(cpu->singlestep_enabled)) {
+                /*
+                 * After processing the exception, ensure an EXCP_DEBUG is
+                 * raised when single-stepping so that GDB doesn't miss the
+                 * next instruction.
+                 */
+                *ret = EXCP_DEBUG;
+                cpu_handle_debug_exception(cpu);
+                return true;
+            }
         } else if (!replay_has_interrupt()) {
             /* give a chance to iothread in replay mode */
             *ret = EXCP_INTERRUPT;
-- 
2.25.1

When single-stepping with a debugger attached to QEMU, and when an
interrupt is raised, the debugger misses the first instruction after
the interrupt.

Tested-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Buglink: https://bugs.launchpad.net/qemu/+bug/757702
Message-Id: <20200717163029.2737546-1-richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
         else {
             if (cc->cpu_exec_interrupt(cpu, interrupt_request)) {
                 replay_interrupt();
-                cpu->exception_index = -1;
+                /*
+                 * After processing the interrupt, ensure an EXCP_DEBUG is
+                 * raised when single-stepping so that GDB doesn't miss the
+                 * next instruction.
+                 */
+                cpu->exception_index =
+                    (cpu->singlestep_enabled ? EXCP_DEBUG : -1);
                 *last_tb = NULL;
             }
             /* The target hook may have updated the 'cpu->interrupt_request';
-- 
2.25.1

The following changes since commit 57b6f58c1d0df757c9311496c32d502925056894:

Merge remote-tracking branch 'remotes/hreitz/tags/pull-block-2021-09-15' into staging (2021-09-15 18:55:59 +0100)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210916

for you to fetch changes up to 50febfe212f24a9b91b4224d03f653415fddf8e1:

tcg/mips: Drop special alignment for code_gen_buffer (2021-09-16 09:37:39 -0400)

----------------------------------------------------------------
Restrict cpu_has_work to sysemu, and move to AccelOpsClass.
Move cpu_signal_handler declaration out of target/.
Misc tcg/mips/ cleanups.

----------------------------------------------------------------
Philippe Mathieu-Daudé (30):
      accel/tcg: Restrict cpu_handle_halt() to sysemu
      hw/core: Restrict cpu_has_work() to sysemu
      hw/core: Un-inline cpu_has_work()
      sysemu: Introduce AccelOpsClass::has_work()
      accel/kvm: Implement AccelOpsClass::has_work()
      accel/whpx: Implement AccelOpsClass::has_work()
      accel/tcg: Implement AccelOpsClass::has_work() as stub
      target/alpha: Restrict has_work() handler to sysemu
      target/arm: Restrict has_work() handler to sysemu and TCG
      target/avr: Restrict has_work() handler to sysemu
      target/cris: Restrict has_work() handler to sysemu
      target/hexagon: Remove unused has_work() handler
      target/hppa: Restrict has_work() handler to sysemu
      target/i386: Restrict has_work() handler to sysemu and TCG
      target/m68k: Restrict has_work() handler to sysemu
      target/microblaze: Restrict has_work() handler to sysemu
      target/mips: Restrict has_work() handler to sysemu and TCG
      target/nios2: Restrict has_work() handler to sysemu
      target/openrisc: Restrict has_work() handler to sysemu
      target/ppc: Introduce PowerPCCPUClass::has_work()
      target/ppc: Restrict has_work() handlers to sysemu and TCG
      target/riscv: Restrict has_work() handler to sysemu and TCG
      target/rx: Restrict has_work() handler to sysemu
      target/s390x: Restrict has_work() handler to sysemu and TCG
      target/sh4: Restrict has_work() handler to sysemu
      target/sparc: Remove pointless use of CONFIG_TCG definition
      target/sparc: Restrict has_work() handler to sysemu
      target/tricore: Restrict has_work() handler to sysemu
      target/xtensa: Restrict has_work() handler to sysemu
      accel: Add missing AccelOpsClass::has_work() and drop SysemuCPUOps one

Richard Henderson (5):
      include/exec: Move cpu_signal_handler declaration
      tcg/mips: Drop inline markers
      tcg/mips: Allow JAL to be out of range in tcg_out_bswap_subr
      tcg/mips: Unset TCG_TARGET_HAS_direct_jump
      tcg/mips: Drop special alignment for code_gen_buffer

There is nothing target specific about this.  The implementation
is host specific, but the declaration is 100% common.

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
     }
     return addr;
 }
+
+/**
+ * cpu_signal_handler
+ * @signum: host signal number
+ * @pinfo: host siginfo_t
+ * @puc: host ucontext_t
+ *
+ * To be called from the SIGBUS and SIGSEGV signal handler to inform the
+ * virtual cpu of exceptions.  Returns true if the signal was handled by
+ * the virtual CPU.
+ */
+int cpu_signal_handler(int signum, void *pinfo, void *puc);
+
 #else
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -XXX,XX +XXX,XX @@ void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                    int mmu_idx, uintptr_t retaddr);
 
 #define cpu_list alpha_cpu_list
-#define cpu_signal_handler cpu_alpha_signal_handler
 
 typedef CPUAlphaState CPUArchState;
 typedef AlphaCPU ArchCPU;
@@ -XXX,XX +XXX,XX @@ void alpha_translate_init(void);
 #define CPU_RESOLVING_TYPE TYPE_ALPHA_CPU
 
 void alpha_cpu_list(void);
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_alpha_signal_handler(int host_signum, void *pinfo,
-                             void *puc);
 bool alpha_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
                         bool probe, uintptr_t retaddr);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool is_a64(CPUARMState *env)
     return env->aarch64;
 }
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_arm_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 /**
  * pmu_op_start/finish
  * @env: CPUARMState
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
 
-#define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list
 
 /* ARM has the following "translation regimes" (as the ARM ARM calls them):
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void set_avr_feature(CPUAVRState *env, int feature)
 }
 
 #define cpu_list avr_cpu_list
-#define cpu_signal_handler cpu_avr_signal_handler
 #define cpu_mmu_index avr_cpu_mmu_index
 
 static inline int avr_cpu_mmu_index(CPUAVRState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ void avr_cpu_tcg_init(void);
 
 void avr_cpu_list(void);
 int cpu_avr_exec(CPUState *cpu);
-int cpu_avr_signal_handler(int host_signum, void *pinfo, void *puc);
 int avr_cpu_memory_rw_debug(CPUState *cs, vaddr address, uint8_t *buf,
                             int len, bool is_write);
 
diff --git a/target/cris/cpu.h b/target/cris/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.h
+++ b/target/cris/cpu.h
@@ -XXX,XX +XXX,XX @@ int crisv10_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int cris_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_cris_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 void cris_initialize_tcg(void);
 void cris_initialize_crisv10_tcg(void);
 
@@ -XXX,XX +XXX,XX @@ enum {
 #define CRIS_CPU_TYPE_NAME(name) (name CRIS_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_CRIS_CPU
 
-#define cpu_signal_handler cpu_cris_signal_handler
-
 /* MMU modes definitions */
 #define MMU_USER_IDX 1
 static inline int cpu_mmu_index (CPUCRISState *env, bool ifetch)
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct HexagonCPU {
 
 #include "cpu_bits.h"
 
-#define cpu_signal_handler cpu_hexagon_signal_handler
-int cpu_hexagon_signal_handler(int host_signum, void *pinfo, void *puc);
-
 static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
 {
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void cpu_hppa_change_prot_id(CPUHPPAState *env) { }
 void cpu_hppa_change_prot_id(CPUHPPAState *env);
 #endif
 
-#define cpu_signal_handler cpu_hppa_signal_handler
-
-int cpu_hppa_signal_handler(int host_signum, void *pinfo, void *puc);
 hwaddr hppa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr);
 int hppa_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int hppa_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
 void cpu_x86_fxsave(CPUX86State *s, target_ulong ptr);
 void cpu_x86_fxrstor(CPUX86State *s, target_ulong ptr);
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_x86_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 /* cpu.c */
 void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
                               uint32_t vendor2, uint32_t vendor3);
@@ -XXX,XX +XXX,XX @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("qemu32")
 #endif
 
-#define cpu_signal_handler cpu_x86_signal_handler
 #define cpu_list x86_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -XXX,XX +XXX,XX @@ int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void m68k_tcg_init(void);
 void m68k_cpu_init_gdb(M68kCPU *cpu);
-/*
- * you can call this signal handler from your SIGBUS and SIGSEGV
- * signal handlers to inform the virtual CPU of exceptions. non zero
- * is returned if the signal was handled by the virtual CPU.
- */
-int cpu_m68k_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
 uint32_t cpu_m68k_get_ccr(CPUM68KState *env);
 void cpu_m68k_set_ccr(CPUM68KState *env, uint32_t);
 void cpu_m68k_set_sr(CPUM68KState *env, uint32_t);
@@ -XXX,XX +XXX,XX @@ enum {
 #define M68K_CPU_TYPE_NAME(model) model M68K_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_M68K_CPU
 
-#define cpu_signal_handler cpu_m68k_signal_handler
 #define cpu_list m68k_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void mb_cpu_write_msr(CPUMBState *env, uint32_t val)
 }
 
 void mb_tcg_init(void);
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_mb_signal_handler(int host_signum, void *pinfo,
-                          void *puc);
 
 #define CPU_RESOLVING_TYPE TYPE_MICROBLAZE_CPU
 
-#define cpu_signal_handler cpu_mb_signal_handler
-
 /* MMU modes definitions */
 #define MMU_NOMMU_IDX   0
 #define MMU_KERNEL_IDX  1
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -XXX,XX +XXX,XX @@ struct MIPSCPU {
 
 void mips_cpu_list(void);
 
-#define cpu_signal_handler cpu_mips_signal_handler
 #define cpu_list mips_cpu_list
 
 extern void cpu_wrdsp(uint32_t rs, uint32_t mask_num, CPUMIPSState *env);
@@ -XXX,XX +XXX,XX @@ enum {
  */
 #define CPU_INTERRUPT_WAKE CPU_INTERRUPT_TGT_INT_0
 
-int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
-
 #define MIPS_CPU_TYPE_SUFFIX "-" TYPE_MIPS_CPU
 #define MIPS_CPU_TYPE_NAME(model) model MIPS_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_MIPS_CPU
diff --git a/target/mips/internal.h b/target/mips/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_mips_cpu;
 
 #endif /* !CONFIG_USER_ONLY */
 
-#define cpu_signal_handler cpu_mips_signal_handler
-
 static inline bool cpu_mips_hw_interrupts_enabled(CPUMIPSState *env)
 {
     return (env->CP0_Status & (1 << CP0St_IE)) &&
diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.h
+++ b/target/nios2/cpu.h
@@ -XXX,XX +XXX,XX @@ struct Nios2CPU {
 
 void nios2_tcg_init(void);
 void nios2_cpu_do_interrupt(CPUState *cs);
-int cpu_nios2_signal_handler(int host_signum, void *pinfo, void *puc);
 void dump_mmu(CPUNios2State *env);
 void nios2_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 hwaddr nios2_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
@@ -XXX,XX +XXX,XX @@ void do_nios2_semihosting(CPUNios2State *env);
 #define CPU_RESOLVING_TYPE TYPE_NIOS2_CPU
 
 #define cpu_gen_code cpu_nios2_gen_code
-#define cpu_signal_handler cpu_nios2_signal_handler
 
 #define CPU_SAVE_VERSION 1
 
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -XXX,XX +XXX,XX @@ void openrisc_translate_init(void);
 bool openrisc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                            MMUAccessType access_type, int mmu_idx,
                            bool probe, uintptr_t retaddr);
-int cpu_openrisc_signal_handler(int host_signum, void *pinfo, void *puc);
 int print_insn_or1k(bfd_vma addr, disassemble_info *info);
 
 #define cpu_list cpu_openrisc_list
-#define cpu_signal_handler cpu_openrisc_signal_handler
 
 #ifndef CONFIG_USER_ONLY
 extern const VMStateDescription vmstate_openrisc_cpu;
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription vmstate_ppc_cpu;
 
 /*****************************************************************************/
 void ppc_translate_init(void);
-/*
- * you can call this signal handler from your SIGBUS and SIGSEGV
- * signal handlers to inform the virtual CPU of exceptions. non zero
- * is returned if the signal was handled by the virtual CPU.
- */
-int cpu_ppc_signal_handler(int host_signum, void *pinfo, void *puc);
 bool ppc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
 #define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
 
-#define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
 char *riscv_isa_string(RISCVCPU *cpu);
 void riscv_cpu_list(void);
 
-#define cpu_signal_handler riscv_cpu_signal_handler
 #define cpu_list riscv_cpu_list
 #define cpu_mmu_index riscv_cpu_mmu_index
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
 void riscv_translate_init(void);
-int riscv_cpu_signal_handler(int host_signum, void *pinfo, void *puc);
 void QEMU_NORETURN riscv_raise_exception(CPURISCVState *env,
                                          uint32_t exception, uintptr_t pc);
 
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -XXX,XX +XXX,XX @@ int rx_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 hwaddr rx_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 void rx_translate_init(void);
-int cpu_rx_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
-
 void rx_cpu_list(void);
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 
-#define cpu_signal_handler cpu_rx_signal_handler
 #define cpu_list rx_cpu_list
 
 #include "exec/cpu-all.h"
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -XXX,XX +XXX,XX @@ void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
 #define S390_CPU_TYPE_NAME(name) (name S390_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_S390_CPU
 
-/* you can call this signal handler from your SIGBUS and SIGSEGV
-   signal handlers to inform the virtual CPU of exceptions. non zero
-   is returned if the signal was handled by the virtual CPU.  */
-int cpu_s390x_signal_handler(int host_signum, void *pinfo, void *puc);
-#define cpu_signal_handler cpu_s390x_signal_handler
-
-
 /* interrupt.c */
 #define RA_IGNORED                  0
 void s390_program_interrupt(CPUS390XState *env, uint32_t code, uintptr_t ra);
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                     int mmu_idx, uintptr_t retaddr);
 
 void sh4_translate_init(void);
-int cpu_sh4_signal_handler(int host_signum, void *pinfo,
-                           void *puc);
 bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                          MMUAccessType access_type, int mmu_idx,
                          bool probe, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ void cpu_load_tlb(CPUSH4State * env);
 #define SUPERH_CPU_TYPE_NAME(model) model SUPERH_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_SUPERH_CPU
 
-#define cpu_signal_handler cpu_sh4_signal_handler
 #define cpu_list sh4_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
                                            int mmu_idx);
 #endif
 #endif
-int cpu_sparc_signal_handler(int host_signum, void *pinfo, void *puc);
 
 #define SPARC_CPU_TYPE_SUFFIX "-" TYPE_SPARC_CPU
 #define SPARC_CPU_TYPE_NAME(model) model SPARC_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_SPARC_CPU
 
-#define cpu_signal_handler cpu_sparc_signal_handler
 #define cpu_list sparc_cpu_list
 
 /* MMU modes definitions */
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env);
 
 void tricore_cpu_list(void);
 
-#define cpu_signal_handler cpu_tricore_signal_handler
 #define cpu_list tricore_cpu_list
 
 static inline int cpu_mmu_index(CPUTriCoreState *env, bool ifetch)
@@ -XXX,XX +XXX,XX @@ typedef TriCoreCPU ArchCPU;
 
 void cpu_state_reset(CPUTriCoreState *s);
 void tricore_tcg_init(void);
-int cpu_tricore_signal_handler(int host_signum, void *pinfo, void *puc);
 
 static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -XXX,XX +XXX,XX @@ void xtensa_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
                                     MMUAccessType access_type,
                                     int mmu_idx, uintptr_t retaddr);
 
-#define cpu_signal_handler cpu_xtensa_signal_handler
 #define cpu_list xtensa_cpu_list
 
 #define XTENSA_CPU_TYPE_SUFFIX "-" TYPE_XTENSA_CPU
@@ -XXX,XX +XXX,XX @@ void check_interrupts(CPUXtensaState *s);
 void xtensa_irq_init(CPUXtensaState *env);
 qemu_irq *xtensa_get_extints(CPUXtensaState *env);
 qemu_irq xtensa_get_runstall(CPUXtensaState *env);
-int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
 void xtensa_cpu_list(void);
 void xtensa_sync_window_from_phys(CPUXtensaState *env);
 void xtensa_sync_phys_from_window(CPUXtensaState *env);
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Commit 372579427a5 ("tcg: enable thread-per-vCPU") added the following
comment describing EXCP_HALTED in qemu_tcg_cpu_thread_fn():

case EXCP_HALTED:
         /* during start-up the vCPU is reset and the thread is
          * kicked several times. If we don't ensure we go back
          * to sleep in the halted state we won't cleanly
          * start-up when the vCPU is enabled.
          *
          * cpu->halted should ensure we sleep in wait_io_event
          */
         g_assert(cpu->halted);
         break;

qemu_wait_io_event() is sysemu-specific, so we can restrict the
cpu_handle_halt() call in cpu_exec() to system emulation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-2-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
 static inline bool cpu_handle_halt(CPUState *cpu)
 {
+#ifndef CONFIG_USER_ONLY
     if (cpu->halted) {
-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
+#if defined(TARGET_I386)
         if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
             X86CPU *x86_cpu = X86_CPU(cpu);
             qemu_mutex_lock_iothread();
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_halt(CPUState *cpu)
             cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
             qemu_mutex_unlock_iothread();
         }
-#endif
+#endif /* TARGET_I386 */
         if (!cpu_has_work(cpu)) {
             return true;
         }
 
         cpu->halted = 0;
     }
+#endif /* !CONFIG_USER_ONLY */
 
     return false;
 }
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_has_work() is only called from system emulation code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-3-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ enum CPUDumpFlags {
 void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 
 #ifndef CONFIG_USER_ONLY
+/**
+ * cpu_has_work:
+ * @cpu: The vCPU to check.
+ *
+ * Checks whether the CPU has work to do.
+ *
+ * Returns: %true if the CPU has work, %false otherwise.
+ */
+static inline bool cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    g_assert(cc->has_work);
+    return cc->has_work(cpu);
+}
+
 /**
  * cpu_get_phys_page_attrs_debug:
  * @cpu: The CPU to obtain the physical page address for.
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_create(const char *typename);
  */
 const char *parse_cpu_option(const char *cpu_option);
 
-/**
- * cpu_has_work:
- * @cpu: The vCPU to check.
- *
- * Checks whether the CPU has work to do.
- *
- * Returns: %true if the CPU has work, %false otherwise.
- */
-static inline bool cpu_has_work(CPUState *cpu)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
-}
-
 /**
  * qemu_cpu_is_self:
  * @cpu: The vCPU to check against.
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We want to make cpu_has_work() per-accelerator. Only declare its
prototype and move its definition to softmmu/cpus.c.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-4-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 8 +-------
 softmmu/cpus.c        | 8 ++++++++
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
  *
  * Returns: %true if the CPU has work, %false otherwise.
  */
-static inline bool cpu_has_work(CPUState *cpu)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
-}
+bool cpu_has_work(CPUState *cpu);
 
 /**
  * cpu_get_phys_page_attrs_debug:
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
     }
 }
 
+bool cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    g_assert(cc->has_work);
+    return cc->has_work(cpu);
+}
+
 static int do_vm_stop(RunState state, bool send_stop)
 {
     int ret = 0;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Introduce an accelerator-specific has_work() handler.
Eventually call it from cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-5-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/accel-ops.h | 5 +++++
 softmmu/cpus.c             | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/accel-ops.h
+++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@ struct AccelOpsClass {
     void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
     void (*kick_vcpu_thread)(CPUState *cpu);
 
+    /**
+     * @has_work: Callback for checking if there is work to do.
+     */
+    bool (*has_work)(CPUState *cpu);
+
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
     void (*synchronize_state)(CPUState *cpu);
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ bool cpu_has_work(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
+    if (cpus_accel->has_work) {
+        return cpus_accel->has_work(cpu);
+    }
     g_assert(cc->has_work);
     return cc->has_work(cpu);
 }
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Implement KVM has_work() handler in AccelOpsClass and
remove it from cpu_thread_is_idle() since cpu_has_work()
is already called.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-6-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/kvm/kvm-accel-ops.c | 6 ++++++
 softmmu/cpus.c            | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+static bool kvm_cpu_has_work(CPUState *cpu)
+{
+    return kvm_halt_in_kernel();
+}
+
 static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
     ops->synchronize_state = kvm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+    ops->has_work = kvm_cpu_has_work;
 }
 
 static const TypeInfo kvm_accel_ops_type = {
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
         return true;
     }
     if (!cpu->halted || cpu_has_work(cpu) ||
-        kvm_halt_in_kernel() || whpx_apic_in_platform()) {
+        whpx_apic_in_platform()) {
         return false;
     }
     return true;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Implement WHPX has_work() handler in AccelOpsClass and
remove it from cpu_thread_is_idle() since cpu_has_work()
is already called.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-7-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/cpus.c                    | 4 +---
 target/i386/whpx/whpx-accel-ops.c | 6 ++++++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/replay.h"
 #include "sysemu/runstate.h"
 #include "sysemu/cpu-timers.h"
-#include "sysemu/whpx.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ bool cpu_thread_is_idle(CPUState *cpu)
     if (cpu_is_stopped(cpu)) {
         return true;
     }
-    if (!cpu->halted || cpu_has_work(cpu) ||
-        whpx_apic_in_platform()) {
+    if (!cpu->halted || cpu_has_work(cpu)) {
         return false;
     }
     return true;
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
     }
 }
 
+static bool whpx_cpu_has_work(CPUState *cpu)
+{
+    return whpx_apic_in_platform();
+}
+
 static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
     ops->synchronize_state = whpx_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
+    ops->has_work = whpx_cpu_has_work;
 }
 
 static const TypeInfo whpx_accel_ops_type = {
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add TCG target-specific has_work() handler in TCGCPUOps,
and add tcg_cpu_has_work() as AccelOpsClass has_work()
implementation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-8-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/tcg-cpu-ops.h |  4 ++++
 accel/tcg/tcg-accel-ops.c     | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/tcg-cpu-ops.h
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@ struct TCGCPUOps {
     void (*do_interrupt)(CPUState *cpu);
 #endif /* !CONFIG_USER_ONLY || !TARGET_I386 */
 #ifdef CONFIG_SOFTMMU
+    /**
+     * @has_work: Callback for checking if there is work to do.
+     */
+    bool (*has_work)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
     /**
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
 #include "exec/exec-all.h"
+#include "hw/core/tcg-cpu-ops.h"
 
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-mttcg.h"
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
     return ret;
 }
 
+static bool tcg_cpu_has_work(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!cc->tcg_ops->has_work) {
+        return false;
+    }
+    return cc->tcg_ops->has_work(cpu);
+}
+
 /* mask must never be zero, except for A20 change call */
 void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_ops_init(AccelOpsClass *ops)
         ops->kick_vcpu_thread = rr_kick_vcpu_thread;
         ops->handle_interrupt = tcg_handle_interrupt;
     }
+    ops->has_work = tcg_cpu_has_work;
 }
 
 static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-9-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool alpha_cpu_has_work(CPUState *cs)
 {
     /* Here we are checking to see if the CPU should wake up from HALT.
@@ -XXX,XX +XXX,XX @@ static bool alpha_cpu_has_work(CPUState *cs)
                                     | CPU_INTERRUPT_SMP
                                     | CPU_INTERRUPT_MCHK);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void alpha_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps alpha_tcg_ops = {
     .tlb_fill = alpha_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = alpha_cpu_has_work,
     .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
     .do_interrupt = alpha_cpu_do_interrupt,
     .do_transaction_failed = alpha_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
                                     &acc->parent_realize);
 
     cc->class_by_name = alpha_cpu_class_by_name;
-    cc->has_work = alpha_cpu_has_work;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-10-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
         env->regs[15] = tb->pc;
     }
 }
-#endif /* CONFIG_TCG */
 
+#ifndef CONFIG_USER_ONLY
 static bool arm_cpu_has_work(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
          | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
          | CPU_INTERRUPT_EXITTB);
 }
+#endif /* !CONFIG_USER_ONLY */
+
+#endif /* CONFIG_TCG */
 
 void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps arm_tcg_ops = {
     .debug_excp_handler = arm_debug_excp_handler,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = arm_cpu_has_work,
     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
     .do_interrupt = arm_cpu_do_interrupt,
     .do_transaction_failed = arm_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, arm_cpu_reset, &acc->parent_reset);
 
     cc->class_by_name = arm_cpu_class_by_name;
-    cc->has_work = arm_cpu_has_work;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-11-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 static const struct TCGCPUOps avr_tcg_ops = {
     .initialize = avr_cpu_tcg_init,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+    .has_work = avr_cpu_has_work,
     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
     .tlb_fill = avr_cpu_tlb_fill,
     .do_interrupt = avr_cpu_do_interrupt,
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = avr_cpu_class_by_name;
 
-    cc->has_work = avr_cpu_has_work;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-12-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool cris_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void cris_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps crisv10_tcg_ops = {
     .tlb_fill = cris_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = cris_cpu_has_work,
     .cpu_exec_interrupt = cris_cpu_exec_interrupt,
     .do_interrupt = crisv10_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, cris_cpu_reset, &ccc->parent_reset);
 
     cc->class_by_name = cris_cpu_class_by_name;
-    cc->has_work = cris_cpu_has_work;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

has_work() is sysemu specific, and Hexagon target only provides
a linux-user implementation. Remove the unused hexagon_cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-13-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/cpu.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
     env->gpr[HEX_REG_PC] = tb->pc;
 }
 
-static bool hexagon_cpu_has_work(CPUState *cs)
-{
-    return true;
-}
-
 void restore_state_to_opc(CPUHexagonState *env, TranslationBlock *tb,
                           target_ulong *data)
 {
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, hexagon_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = hexagon_cpu_class_by_name;
-    cc->has_work = hexagon_cpu_has_work;
     cc->dump_state = hexagon_dump_state;
     cc->set_pc = hexagon_cpu_set_pc;
     cc->gdb_read_register = hexagon_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-14-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.psw_n = (tb->flags & PSW_N) != 0;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool hppa_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps hppa_tcg_ops = {
     .tlb_fill = hppa_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = hppa_cpu_has_work,
     .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
     .do_interrupt = hppa_cpu_do_interrupt,
     .do_unaligned_access = hppa_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
                                     &acc->parent_realize);
 
     cc->class_by_name = hppa_cpu_class_by_name;
-    cc->has_work = hppa_cpu_has_work;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-15-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/cpu.c         | 6 ------
 target/i386/tcg/tcg-cpu.c | 8 +++++++-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
     return 0;
 }
 
-static bool x86_cpu_has_work(CPUState *cs)
-{
-    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
-}
-
 static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = x86_cpu_class_by_name;
     cc->parse_features = x86_cpu_parse_featurestr;
-    cc->has_work = x86_cpu_has_work;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
     cc->gdb_read_register = x86_cpu_gdb_read_register;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 }
 
 #ifndef CONFIG_USER_ONLY
+static bool x86_cpu_has_work(CPUState *cs)
+{
+    return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
+}
+
 static bool x86_debug_check_breakpoint(CPUState *cs)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool x86_debug_check_breakpoint(CPUState *cs)
     /* RF disables all architectural breakpoints. */
     return !(env->eflags & RF_MASK);
 }
-#endif
+#endif /* CONFIG_USER_ONLY */
 
 #include "hw/core/tcg-cpu-ops.h"
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps x86_tcg_ops = {
 #ifdef CONFIG_USER_ONLY
     .fake_user_interrupt = x86_cpu_do_interrupt,
 #else
+    .has_work = x86_cpu_has_work,
     .do_interrupt = x86_cpu_do_interrupt,
     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
     .debug_excp_handler = breakpoint_handler,
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-16-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool m68k_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void m68k_set_feature(CPUM68KState *env, int feature)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps m68k_tcg_ops = {
     .tlb_fill = m68k_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = m68k_cpu_has_work,
     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
     .do_interrupt = m68k_cpu_do_interrupt,
     .do_transaction_failed = m68k_cpu_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, m68k_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = m68k_cpu_class_by_name;
-    cc->has_work = m68k_cpu_has_work;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-17-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
 }
 
+#ifndef CONFIG_USER_ONLY
+
 static bool mb_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
 
-#ifndef CONFIG_USER_ONLY
 static void mb_cpu_ns_axi_dp(void *opaque, int irq, int level)
 {
     MicroBlazeCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static void microblaze_cpu_set_irq(void *opaque, int irq, int level)
         cpu_reset_interrupt(cs, type);
     }
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
 
 static void mb_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mb_tcg_ops = {
     .tlb_fill = mb_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = mb_cpu_has_work,
     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
     .do_interrupt = mb_cpu_do_interrupt,
     .do_transaction_failed = mb_cpu_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, mb_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = mb_cpu_class_by_name;
-    cc->has_work = mb_cpu_has_work;
-
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-18-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     mips_env_set_pc(&cpu->env, value);
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool mips_cpu_has_work(CPUState *cs)
 {
     MIPSCPU *cpu = MIPS_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool mips_cpu_has_work(CPUState *cs)
     }
     return has_work;
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 #include "cpu-defs.c.inc"
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps mips_tcg_ops = {
     .tlb_fill = mips_cpu_tlb_fill,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = mips_cpu_has_work,
     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
     .do_interrupt = mips_cpu_do_interrupt,
     .do_transaction_failed = mips_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_props(dc, mips_cpu_properties);
 
     cc->class_by_name = mips_cpu_class_by_name;
-    cc->has_work = mips_cpu_has_work;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-19-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
     env->regs[R_PC] = value;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool nios2_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void nios2_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps nios2_tcg_ops = {
     .tlb_fill = nios2_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = nios2_cpu_has_work,
     .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
     .do_interrupt = nios2_cpu_do_interrupt,
     .do_unaligned_access = nios2_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, nios2_cpu_reset, &ncc->parent_reset);
 
     cc->class_by_name = nios2_cpu_class_by_name;
-    cc->has_work = nios2_cpu_has_work;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-20-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.dflag = 0;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool openrisc_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD |
                                     CPU_INTERRUPT_TIMER);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void openrisc_disas_set_info(CPUState *cpu, disassemble_info *info)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps openrisc_tcg_ops = {
     .tlb_fill = openrisc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = openrisc_cpu_has_work,
     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
     .do_interrupt = openrisc_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, openrisc_cpu_reset, &occ->parent_reset);
 
     cc->class_by_name = openrisc_cpu_class_by_name;
-    cc->has_work = openrisc_cpu_has_work;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We're moving the hook from CPUState to TCGCPUOps. TCGCPUOps is
a const structure, so to avoid creating multiple versions of
the same structure, simply changing the has_work() handler,
introduce yet another indirection with a has_work() handler in
PowerPCCPUClass, and ppc_cpu_has_work() method which dispatch
to it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-21-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/cpu-qom.h  |  1 +
 target/ppc/cpu_init.c | 23 ++++++++++++++---------
 2 files changed, 15 insertions(+), 9 deletions(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict PowerPCCPUClass::has_work() and ppc_cpu_has_work()
- SysemuCPUOps::has_work() implementation - to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-22-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/cpu-qom.h  |  4 +++-
 target/ppc/cpu_init.c | 24 ++++++++++++++++++------
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu-qom.h
+++ b/target/ppc/cpu-qom.h
@@ -XXX,XX +XXX,XX @@ struct PowerPCCPUClass {
     uint32_t flags;
     int bfd_mach;
     uint32_t l1_dcache_size, l1_icache_size;
-    bool (*has_work)(CPUState *cpu);
 #ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_TCG
+    bool (*has_work)(CPUState *cpu);
+#endif /* CONFIG_TCG */
     unsigned int gdb_num_sprs;
     const char *gdb_spr_xml;
 #endif
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER7(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER7(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->pcr_supported = PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER7;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER7;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER7;
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->lrg_decr_bits = 32;
 #endif
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER8(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER8(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
     pcc->pcr_supported = PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER8;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER8;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                    LPCR_P8_PECE3 | LPCR_P8_PECE4;
     pcc->mmu_model = POWERPC_MMU_2_07;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER8;
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->lrg_decr_bits = 32;
     pcc->n_host_threads = 8;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power9(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER9(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER9(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
                          PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER9;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER9;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
     pcc->mmu_model = POWERPC_MMU_3_00;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER9;
     /* segment page size remain the same */
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->radix_page_info = &POWER9_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static bool ppc_pvr_match_power10(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_POWER10(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool cpu_has_work_POWER10(CPUState *cs)
         return msr_ee && (cs->interrupt_request & CPU_INTERRUPT_HARD);
     }
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
                          PCR_COMPAT_2_06 | PCR_COMPAT_2_05;
     pcc->init_proc = init_proc_POWER10;
     pcc->check_pow = check_pow_nocheck;
-    pcc->has_work = cpu_has_work_POWER10;
     pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
@@ -XXX,XX +XXX,XX @@ POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
     pcc->lpcr_pm = LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
     pcc->mmu_model = POWERPC_MMU_3_00;
 #if defined(CONFIG_SOFTMMU)
+    pcc->has_work = cpu_has_work_POWER10;
     /* segment page size remain the same */
     pcc->hash64_opts = &ppc_hash64_opts_POWER7;
     pcc->radix_page_info = &POWER10_radix_page_info;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.nip = value;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool cpu_has_work_default(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_has_work(CPUState *cs)
 
     return pcc->has_work(cs);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void ppc_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps ppc_tcg_ops = {
   .tlb_fill = ppc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+  .has_work = ppc_cpu_has_work,
   .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
   .do_interrupt = ppc_cpu_do_interrupt,
   .cpu_exec_enter = ppc_cpu_exec_enter,
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_unrealize(dc, ppc_cpu_unrealize,
                                       &pcc->parent_unrealize);
     pcc->pvr_match = ppc_pvr_match_default;
-    pcc->has_work = cpu_has_work_default;
     device_class_set_props(dc, ppc_cpu_properties);
 
     device_class_set_parent_reset(dc, ppc_cpu_reset, &pcc->parent_reset);
 
     cc->class_by_name = ppc_cpu_class_by_name;
-    cc->has_work = ppc_cpu_has_work;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
 #ifdef CONFIG_TCG
     cc->tcg_ops = &ppc_tcg_ops;
+#ifndef CONFIG_USER_ONLY
+    pcc->has_work = cpu_has_work_default;
+#endif
 #endif /* CONFIG_TCG */
 }
 
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-23-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
     env->pc = tb->pc;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool riscv_cpu_has_work(CPUState *cs)
 {
-#ifndef CONFIG_USER_ONLY
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     /*
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
      * mode and delegation registers, but respect individual enables
      */
     return (env->mip & env->mie) != 0;
-#else
-    return true;
-#endif
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
                           target_ulong *data)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
     .tlb_fill = riscv_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = riscv_cpu_has_work,
     .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
     .do_interrupt = riscv_cpu_do_interrupt,
     .do_transaction_failed = riscv_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_parent_reset(dc, riscv_cpu_reset, &mcc->parent_reset);
 
     cc->class_by_name = riscv_cpu_class_by_name;
-    cc->has_work = riscv_cpu_has_work;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-24-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/rx/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.pc = tb->pc;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool rx_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request &
         (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void rx_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps rx_tcg_ops = {
     .tlb_fill = rx_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = rx_cpu_has_work,
     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
     .do_interrupt = rx_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
                                   &rcc->parent_reset);
 
     cc->class_by_name = rx_cpu_class_by_name;
-    cc->has_work = rx_cpu_has_work;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
 
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to TCG sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-25-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.psw.addr = value;
 }
 
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static bool s390_cpu_has_work(CPUState *cs)
 {
     S390CPU *cpu = S390_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool s390_cpu_has_work(CPUState *cs)
 
     return s390_cpu_has_int(cpu);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 /* S390CPUClass::reset() */
 static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps s390_tcg_ops = {
     .tlb_fill = s390_cpu_tlb_fill,
 
 #if !defined(CONFIG_USER_ONLY)
+    .has_work = s390_cpu_has_work,
     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
     .do_interrupt = s390_cpu_do_interrupt,
     .debug_excp_handler = s390x_cpu_debug_excp_handler,
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 
     scc->reset = s390_cpu_reset;
     cc->class_by_name = s390_cpu_class_by_name,
-    cc->has_work = s390_cpu_has_work;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-26-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/cpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     }
     return false;
 }
-#endif
 
 static bool superh_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 }
 
+#endif /* !CONFIG_USER_ONLY */
+
 static void superh_cpu_reset(DeviceState *dev)
 {
     CPUState *s = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps superh_tcg_ops = {
     .tlb_fill = superh_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = superh_cpu_has_work,
     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
     .do_interrupt = superh_cpu_do_interrupt,
     .do_unaligned_access = superh_cpu_do_unaligned_access,
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, superh_cpu_reset, &scc->parent_reset);
 
     cc->class_by_name = superh_cpu_class_by_name;
-    cc->has_work = superh_cpu_has_work;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The SPARC target only support TCG acceleration. Remove the CONFIG_TCG
definition introduced by mistake in commit 78271684719 ("cpu: tcg_ops:
move to tcg-cpu-ops.h, keep a pointer in CPUClass").

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-27-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 };
 #endif
 
-#ifdef CONFIG_TCG
 #include "hw/core/tcg-cpu-ops.h"
 
 static const struct TCGCPUOps sparc_tcg_ops = {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
     .do_unaligned_access = sparc_cpu_do_unaligned_access,
 #endif /* !CONFIG_USER_ONLY */
 };
-#endif /* CONFIG_TCG */
 
 static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-28-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.npc = tb->cs_base;
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool sparc_cpu_has_work(CPUState *cs)
 {
     SPARCCPU *cpu = SPARC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool sparc_cpu_has_work(CPUState *cs)
     return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
            cpu_interrupts_enabled(env);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static char *sparc_cpu_type_name(const char *cpu_model)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps sparc_tcg_ops = {
     .tlb_fill = sparc_cpu_tlb_fill,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = sparc_cpu_has_work,
     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
     .do_interrupt = sparc_cpu_do_interrupt,
     .do_transaction_failed = sparc_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
-    cc->has_work = sparc_cpu_has_work;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-29-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_reset(DeviceState *dev)
     cpu_state_reset(env);
 }
 
+#if !defined(CONFIG_USER_ONLY)
 static bool tricore_cpu_has_work(CPUState *cs)
 {
     return true;
 }
+#endif /* !CONFIG_USER_ONLY */
 
 static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps tricore_tcg_ops = {
     .initialize = tricore_tcg_init,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
     .tlb_fill = tricore_cpu_tlb_fill,
+#if !defined(CONFIG_USER_ONLY)
+    .has_work = tricore_cpu_has_work,
+#endif
 };
 
 static void tricore_cpu_class_init(ObjectClass *c, void *data)
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     device_class_set_parent_reset(dc, tricore_cpu_reset, &mcc->parent_reset);
     cc->class_by_name = tricore_cpu_class_by_name;
-    cc->has_work = tricore_cpu_has_work;
 
     cc->gdb_read_register = tricore_cpu_gdb_read_register;
     cc->gdb_write_register = tricore_cpu_gdb_write_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Restrict has_work() to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210912172731.789788-30-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/xtensa/cpu.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+#ifndef CONFIG_USER_ONLY
+
 static bool xtensa_cpu_has_work(CPUState *cs)
 {
-#ifndef CONFIG_USER_ONLY
     XtensaCPU *cpu = XTENSA_CPU(cs);
 
     return !cpu->env.runstall && cpu->env.pending_irq_level;
-#else
-    return true;
-#endif
 }
 
-#ifdef CONFIG_USER_ONLY
+#else /* CONFIG_USER_ONLY*/
+
 static bool abi_call0;
 
 void xtensa_set_abi_call0(void)
@@ -XXX,XX +XXX,XX @@ bool xtensa_abi_call0(void)
 {
     return abi_call0;
 }
-#endif
+
+#endif /* CONFIG_USER_ONLY */
 
 static void xtensa_cpu_reset(DeviceState *dev)
 {
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps xtensa_tcg_ops = {
     .debug_excp_handler = xtensa_breakpoint_handler,
 
 #ifndef CONFIG_USER_ONLY
+    .has_work = xtensa_cpu_has_work,
     .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
     .do_interrupt = xtensa_cpu_do_interrupt,
     .do_transaction_failed = xtensa_cpu_do_transaction_failed,
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     device_class_set_parent_reset(dc, xtensa_cpu_reset, &xcc->parent_reset);
 
     cc->class_by_name = xtensa_cpu_class_by_name;
-    cc->has_work = xtensa_cpu_has_work;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_common_has_work() is the default has_work() implementation
and returns 'false'.

Explicit it for the QTest / HAX / HVF / NVMM / Xen accelerators
and remove cpu_common_has_work().

Since there are no more implementations of SysemuCPUOps::has_work,
remove it along with the assertion in cpu_has_work().

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Paul Durrant <paul@xen.org>
Message-Id: <20210912172731.789788-31-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h             | 2 --
 accel/hvf/hvf-accel-ops.c         | 6 ++++++
 accel/qtest/qtest.c               | 6 ++++++
 accel/xen/xen-all.c               | 6 ++++++
 hw/core/cpu-common.c              | 6 ------
 softmmu/cpus.c                    | 9 ++-------
 target/i386/hax/hax-accel-ops.c   | 6 ++++++
 target/i386/nvmm/nvmm-accel-ops.c | 6 ++++++
 8 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
  * instantiatable CPU type.
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
- * @has_work: Callback for checking if there is work to do.
  * @memory_rw_debug: Callback for GDB memory access.
  * @dump_state: Callback for dumping state.
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*parse_features)(const char *typename, char *str, Error **errp);
 
     int reset_dump_flags;
-    bool (*has_work)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
     void (*dump_state)(CPUState *cpu, FILE *, int flags);
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+static bool hvf_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
     ops->synchronize_state = hvf_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
+    ops->has_work = hvf_cpu_has_work;
 };
 static const TypeInfo hvf_accel_ops_type = {
     .name = ACCEL_OPS_NAME("hvf"),
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
 };
 module_obj(TYPE_QTEST_ACCEL);
 
+static bool qtest_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
     ops->get_virtual_clock = qtest_get_virtual_clock;
+    ops->has_work = qtest_cpu_has_work;
 };
 
 static const TypeInfo qtest_accel_ops_type = {
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
+static bool xen_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->has_work = xen_cpu_has_work;
 }
 
 static const TypeInfo xen_accel_ops_type = {
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
     }
 }
 
-static bool cpu_common_has_work(CPUState *cs)
-{
-    return false;
-}
-
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
 {
     CPUClass *cc = CPU_CLASS(object_class_by_name(typename));
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
 
     k->parse_features = cpu_common_parse_features;
     k->get_arch_id = cpu_common_get_arch_id;
-    k->has_work = cpu_common_has_work;
     k->gdb_read_register = cpu_common_gdb_read_register;
     k->gdb_write_register = cpu_common_gdb_write_register;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void cpu_interrupt(CPUState *cpu, int mask)
 
 bool cpu_has_work(CPUState *cpu)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    if (cpus_accel->has_work) {
-        return cpus_accel->has_work(cpu);
-    }
-    g_assert(cc->has_work);
-    return cc->has_work(cpu);
+    g_assert(cpus_accel->has_work);
+    return cpus_accel->has_work(cpu);
 }
 
 static int do_vm_stop(RunState state, bool send_stop)
diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-accel-ops.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
 #endif
 }
 
+static bool hax_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = hax_cpu_synchronize_post_init;
     ops->synchronize_state = hax_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
+    ops->has_work = hax_cpu_has_work;
 }
 
 static const TypeInfo hax_accel_ops_type = {
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void nvmm_kick_vcpu_thread(CPUState *cpu)
     cpus_kick_thread(cpu);
 }
 
+static bool nvmm_cpu_has_work(CPUState *cpu)
+{
+    return false;
+}
+
 static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
     ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
     ops->synchronize_state = nvmm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = nvmm_cpu_synchronize_pre_loadvm;
+    ops->has_work = nvmm_cpu_has_work;
 }
 
 static const TypeInfo nvmm_accel_ops_type = {
-- 
2.25.1

Let the compiler decide about inlining.
Remove tcg_out_ext8s and tcg_out_ext16s as unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 76 ++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 49 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
 #endif
 
 
-static inline bool is_p2m1(tcg_target_long val)
+static bool is_p2m1(tcg_target_long val)
 {
     return val && ((val + 1) & val) == 0;
 }
@@ -XXX,XX +XXX,XX @@ typedef enum {
 /*
  * Type reg
  */
-static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
-                                   TCGReg rd, TCGReg rs, TCGReg rt)
+static void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
+                            TCGReg rd, TCGReg rs, TCGReg rt)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_reg(TCGContext *s, MIPSInsn opc,
 /*
  * Type immediate
  */
-static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
-                                   TCGReg rt, TCGReg rs, TCGArg imm)
+static void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
+                            TCGReg rt, TCGReg rs, TCGArg imm)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_imm(TCGContext *s, MIPSInsn opc,
 /*
  * Type bitfield
  */
-static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
-                                  TCGReg rs, int msb, int lsb)
+static void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
+                           TCGReg rs, int msb, int lsb)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf(TCGContext *s, MIPSInsn opc, TCGReg rt,
     tcg_out32(s, inst);
 }
 
-static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
-                                    MIPSInsn oph, TCGReg rt, TCGReg rs,
+static void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
+                             MIPSInsn oph, TCGReg rt, TCGReg rs,
                                     int msb, int lsb)
 {
     if (lsb >= 32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_bf64(TCGContext *s, MIPSInsn opc, MIPSInsn opm,
 /*
  * Type branch
  */
-static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
-                                  TCGReg rt, TCGReg rs)
+static void tcg_out_opc_br(TCGContext *s, MIPSInsn opc, TCGReg rt, TCGReg rs)
 {
     tcg_out_opc_imm(s, opc, rt, rs, 0);
 }
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_opc_br(TCGContext *s, MIPSInsn opc,
 /*
  * Type sa
  */
-static inline void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
-                                  TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_opc_sa(TCGContext *s, MIPSInsn opc,
+                           TCGReg rd, TCGReg rt, TCGArg sa)
 {
     int32_t inst;
 
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_opc_jmp(TCGContext *s, MIPSInsn opc, const void *target)
     return true;
 }
 
-static inline void tcg_out_nop(TCGContext *s)
+static void tcg_out_nop(TCGContext *s)
 {
     tcg_out32(s, 0);
 }
 
-static inline void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsll(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSLL, OPC_DSLL32, rd, rt, sa);
 }
 
-static inline void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsrl(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSRL, OPC_DSRL32, rd, rt, sa);
 }
 
-static inline void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
+static void tcg_out_dsra(TCGContext *s, TCGReg rd, TCGReg rt, TCGArg sa)
 {
     tcg_out_opc_sa64(s, OPC_DSRA, OPC_DSRA32, rd, rt, sa);
 }
 
-static inline bool tcg_out_mov(TCGContext *s, TCGType type,
-                               TCGReg ret, TCGReg arg)
+static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     /* Simple reg-reg move, optimising out the 'do nothing' case */
     if (ret != arg) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
     }
 }
 
-static inline void tcg_out_ext8s(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_SEB, ret, 0, arg);
-    } else {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 24);
-    }
-}
-
-static inline void tcg_out_ext16s(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_SEH, ret, 0, arg);
-    } else {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 16);
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);
-    }
-}
-
-static inline void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
+static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
     if (use_mips32r2_instructions) {
         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
     tcg_out_opc_imm(s, opc, data, addr, lo);
 }
 
-static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
-                              TCGReg arg1, intptr_t arg2)
+static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
+                       TCGReg arg1, intptr_t arg2)
 {
     MIPSInsn opc = OPC_LD;
     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
-static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
-                              TCGReg arg1, intptr_t arg2)
+static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
+                       TCGReg arg1, intptr_t arg2)
 {
     MIPSInsn opc = OPC_SD;
     if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
-static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
-                               TCGReg base, intptr_t ofs)
+static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
+                        TCGReg base, intptr_t ofs)
 {
     if (val == 0) {
         tcg_out_st(s, type, TCG_REG_ZERO, base, ofs);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_clz(TCGContext *s, MIPSInsn opcv2, MIPSInsn opcv6,
     }
 }
 
-static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
-                              const TCGArg args[TCG_MAX_OP_ARGS],
-                              const int const_args[TCG_MAX_OP_ARGS])
+static void tcg_out_op(TCGContext *s, TCGOpcode opc,
+                       const TCGArg args[TCG_MAX_OP_ARGS],
+                       const int const_args[TCG_MAX_OP_ARGS])
 {
     MIPSInsn i1, i2;
     TCGArg a0, a1, a2;
-- 
2.25.1

Weaning off of unique alignment requirements, so allow JAL
to not reach the target.  TCG_TMP1 is always available for
use as a scratch because it is clobbered by the subroutine
being called.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
 
 static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
 {
-    bool ok = tcg_out_opc_jmp(s, OPC_JAL, sub);
-    tcg_debug_assert(ok);
+    if (!tcg_out_opc_jmp(s, OPC_JAL, sub)) {
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP1, (uintptr_t)sub);
+        tcg_out_opc_reg(s, OPC_JALR, TCG_REG_RA, TCG_TMP1, 0);
+    }
 }
 
 static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
-- 
2.25.1

Only use indirect jumps.  Finish weaning away from the
unique alignment requirements for code_gen_buffer.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.h     | 12 +++++-------
 tcg/mips/tcg-target.c.inc | 23 +++++------------------
 2 files changed, 10 insertions(+), 25 deletions(-)

diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_TLB_DISPLACEMENT_BITS 16
 #define TCG_TARGET_NB_REGS 32
 
-/*
- * We have a 256MB branch region, but leave room to make sure the
- * main executable is also within that region.
- */
-#define MAX_CODE_GEN_BUFFER_SIZE  (128 * MiB)
+#define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
 
 typedef enum {
     TCG_REG_ZERO = 0,
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_direct_jump      1
+#define TCG_TARGET_HAS_direct_jump      0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_DEFAULT_MO (0)
 #define TCG_TARGET_HAS_MEMORY_BSWAP     1
 
-void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+/* not defined -- call should be eliminated at compile time */
+void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
+    QEMU_ERROR("code path is reachable");
 
 #ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
     case INDEX_op_goto_tb:
-        if (s->tb_jmp_insn_offset) {
-            /* direct jump method */
-            s->tb_jmp_insn_offset[a0] = tcg_current_code_size(s);
-            /* Avoid clobbering the address during retranslation.  */
-            tcg_out32(s, OPC_J | (*(uint32_t *)s->code_ptr & 0x3ffffff));
-        } else {
-            /* indirect jump method */
-            tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
-                       (uintptr_t)(s->tb_jmp_target_addr + a0));
-            tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
-        }
+        /* indirect jump method */
+        tcg_debug_assert(s->tb_jmp_insn_offset == 0);
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_REG_ZERO,
+                   (uintptr_t)(s->tb_jmp_target_addr + a0));
+        tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
         tcg_out_nop(s);
         set_jmp_reset_offset(s, a0);
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP);   /* global pointer */
 }
 
-void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
-                              uintptr_t jmp_rw, uintptr_t addr)
-{
-    qatomic_set((uint32_t *)jmp_rw, deposit32(OPC_J, 0, 26, addr >> 2));
-    flush_idcache_range(jmp_rx, jmp_rw, 4);
-}
-
 typedef struct {
     DebugFrameHeader h;
     uint8_t fde_def_cfa[4];
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/region.c | 91 ----------------------------------------------------
 1 file changed, 91 deletions(-)

diff --git a/tcg/region.c b/tcg/region.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -XXX,XX +XXX,XX @@ static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
   (DEFAULT_CODE_GEN_BUFFER_SIZE_1 < MAX_CODE_GEN_BUFFER_SIZE \
    ? DEFAULT_CODE_GEN_BUFFER_SIZE_1 : MAX_CODE_GEN_BUFFER_SIZE)
 
-#ifdef __mips__
-/*
- * In order to use J and JAL within the code_gen_buffer, we require
- * that the buffer not cross a 256MB boundary.
- */
-static inline bool cross_256mb(void *addr, size_t size)
-{
-    return ((uintptr_t)addr ^ ((uintptr_t)addr + size)) & ~0x0ffffffful;
-}
-
-/*
- * We weren't able to allocate a buffer without crossing that boundary,
- * so make do with the larger portion of the buffer that doesn't cross.
- * Returns the new base and size of the buffer in *obuf and *osize.
- */
-static inline void split_cross_256mb(void **obuf, size_t *osize,
-                                     void *buf1, size_t size1)
-{
-    void *buf2 = (void *)(((uintptr_t)buf1 + size1) & ~0x0ffffffful);
-    size_t size2 = buf1 + size1 - buf2;
-
-    size1 = buf2 - buf1;
-    if (size1 < size2) {
-        size1 = size2;
-        buf1 = buf2;
-    }
-
-    *obuf = buf1;
-    *osize = size1;
-}
-#endif
-
 #ifdef USE_STATIC_CODE_GEN_BUFFER
 static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE]
     __attribute__((aligned(CODE_GEN_ALIGN)));
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer(size_t tb_size, int splitwx, Error **errp)
         size = QEMU_ALIGN_DOWN(tb_size, qemu_real_host_page_size);
     }
 
-#ifdef __mips__
-    if (cross_256mb(buf, size)) {
-        split_cross_256mb(&buf, &size, buf, size);
-    }
-#endif
-
     region.start_aligned = buf;
     region.total_size = size;
 
@@ -XXX,XX +XXX,XX @@ static int alloc_code_gen_buffer_anon(size_t size, int prot,
         return -1;
     }
 
-#ifdef __mips__
-    if (cross_256mb(buf, size)) {
-        /*
-         * Try again, with the original still mapped, to avoid re-acquiring
-         * the same 256mb crossing.
-         */
-        size_t size2;
-        void *buf2 = mmap(NULL, size, prot, flags, -1, 0);
-        switch ((int)(buf2 != MAP_FAILED)) {
-        case 1:
-            if (!cross_256mb(buf2, size)) {
-                /* Success!  Use the new buffer.  */
-                munmap(buf, size);
-                break;
-            }
-            /* Failure.  Work with what we had.  */
-            munmap(buf2, size);
-            /* fallthru */
-        default:
-            /* Split the original buffer.  Free the smaller half.  */
-            split_cross_256mb(&buf2, &size2, buf, size);
-            if (buf == buf2) {
-                munmap(buf + size2, size - size2);
-            } else {
-                munmap(buf, size - size2);
-            }
-            size = size2;
-            break;
-        }
-        buf = buf2;
-    }
-#endif
-
     region.start_aligned = buf;
     region.total_size = size;
     return prot;
@@ -XXX,XX +XXX,XX @@ static bool alloc_code_gen_buffer_splitwx_memfd(size_t size, Error **errp)
     void *buf_rw = NULL, *buf_rx = MAP_FAILED;
     int fd = -1;
 
-#ifdef __mips__
-    /* Find space for the RX mapping, vs the 256MiB regions. */
-    if (alloc_code_gen_buffer_anon(size, PROT_NONE,
-                                   MAP_PRIVATE | MAP_ANONYMOUS |
-                                   MAP_NORESERVE, errp) < 0) {
-        return false;
-    }
-    /* The size of the mapping may have been adjusted. */
-    buf_rx = region.start_aligned;
-    size = region.total_size;
-#endif
-
     buf_rw = qemu_memfd_alloc("tcg-jit", size, 0, &fd, errp);
     if (buf_rw == NULL) {
         goto fail;
     }
 
-#ifdef __mips__
-    void *tmp = mmap(buf_rx, size, PROT_READ | PROT_EXEC,
-                     MAP_SHARED | MAP_FIXED, fd, 0);
-    if (tmp != buf_rx) {
-        goto fail_rx;
-    }
-#else
     buf_rx = mmap(NULL, size, PROT_READ | PROT_EXEC, MAP_SHARED, fd, 0);
     if (buf_rx == MAP_FAILED) {
         goto fail_rx;
     }
-#endif
 
     close(fd);
     region.start_aligned = buf_rw;
-- 
2.25.1