Series comparison

-[PULL 00/11] tcg patch queue
+[PULL 00/34] tcg patch queue
-The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
+The following changes since commit 0a301624c2f4ced3331ffd5bce85b4274fe132af:
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
+  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220208' into staging (2022-02-08 11:40:08 +0000)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20201008
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220211
-for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:
+for you to fetch changes up to 5c1a101ef6b85537a4ade93c39ea81cadd5c246e:
-  accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)
+  tests/tcg/multiarch: Add sigbus.c (2022-02-09 09:00:01 +1100)
 ----------------------------------------------------------------
-Extend maximum gvec vector size
+Fix safe_syscall_base for sparc64.
-Fix i386 avx2 dupi
+Fix host signal handling for sparc64-linux.
-Fix mips host user-only write detection
+Speedups for jump cache and work list probing.
-Misc cleanups.
+Fix for exception replays.
 Raise guest SIGBUS for user-only misaligned accesses.
 ----------------------------------------------------------------
-Kele Huang (1):
+Idan Horowitz (2):
-      accel/tcg: Fix computing of is_write for MIPS
+      accel/tcg: Optimize jump cache flush during tlb range flush
       softmmu/cpus: Check if the cpu work list is empty atomically
-Richard Henderson (10):
+Pavel Dovgalyuk (1):
-      tcg: Adjust simd_desc size encoding
+      replay: use CF_NOIRQ for special exception-replaying TB
       tcg: Drop union from TCGArgConstraint
       tcg: Move sorted_args into TCGArgConstraint.sort_index
       tcg: Remove TCG_CT_REG
       tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
       tcg: Remove TCGOpDef.used
       tcg/i386: Fix dupi for avx2 32-bit hosts
       tcg: Fix generation of dupi_vec for 32-bit host
       tcg/optimize: Fold dup2_vec
       tcg: Remove TCG_TARGET_HAS_cmp_vec
- include/tcg/tcg-gvec-desc.h  | 38 ++++++++++++------
+Richard Henderson (29):
- include/tcg/tcg.h            | 22 ++++------
+      common-user/host/sparc64: Fix safe_syscall_base
- tcg/aarch64/tcg-target.h     |  1 -
+      linux-user: Introduce host_signal_mask
- tcg/i386/tcg-target.h        |  1 -
+      linux-user: Introduce host_sigcontext
- tcg/ppc/tcg-target.h         |  1 -
+      linux-user: Move sparc/host-signal.h to sparc64/host-signal.h
- accel/tcg/user-exec.c        | 43 ++++++++++++++++++--
+      linux-user/include/host/sparc64: Fix host_sigcontext
- tcg/optimize.c               | 15 +++++++
+      tcg/i386: Support raising sigbus for user-only
- tcg/tcg-op-gvec.c            | 35 ++++++++++++----
+      tcg/aarch64: Support raising sigbus for user-only
- tcg/tcg-op-vec.c             | 12 ++++--
+      tcg/ppc: Support raising sigbus for user-only
- tcg/tcg.c                    | 96 +++++++++++++++++++-------------------------
+      tcg/riscv: Support raising sigbus for user-only
- tcg/aarch64/tcg-target.c.inc | 17 ++++----
+      tcg/s390x: Support raising sigbus for user-only
- tcg/arm/tcg-target.c.inc     | 29 ++++++-------
+      tcg/tci: Support raising sigbus for user-only
- tcg/i386/tcg-target.c.inc    | 39 +++++++-----------
+      tcg/arm: Drop support for armv4 and armv5 hosts
- tcg/mips/tcg-target.c.inc    | 21 +++++-----
+      tcg/arm: Remove use_armv5t_instructions
- tcg/ppc/tcg-target.c.inc     | 29 ++++++-------
+      tcg/arm: Remove use_armv6_instructions
- tcg/riscv/tcg-target.c.inc   | 16 ++++----
+      tcg/arm: Check alignment for ldrd and strd
- tcg/s390/tcg-target.c.inc    | 22 +++++-----
+      tcg/arm: Support unaligned access for softmmu
- tcg/sparc/tcg-target.c.inc   | 21 ++++------
+      tcg/arm: Reserve a register for guest_base
- tcg/tci/tcg-target.c.inc     |  3 +-
+      tcg/arm: Support raising sigbus for user-only
-files changed, 244 insertions(+), 217 deletions(-)
+      tcg/mips: Support unaligned access for user-only
       tcg/mips: Support unaligned access for softmmu
       tcg/sparc: Use tcg_out_movi_imm13 in tcg_out_addsub2_i64
       tcg/sparc: Split out tcg_out_movi_imm32
       tcg/sparc: Add scratch argument to tcg_out_movi_int
       tcg/sparc: Improve code gen for shifted 32-bit constants
       tcg/sparc: Convert patch_reloc to return bool
       tcg/sparc: Use the constant pool for 64-bit constants
       tcg/sparc: Add tcg_out_jmpl_const for better tail calls
       tcg/sparc: Support unaligned access for user-only
       tests/tcg/multiarch: Add sigbus.c
+WANG Xuerui (2):
+      tcg/loongarch64: Fix fallout from recent MO_Q renaming
+      tcg/loongarch64: Support raising sigbus for user-only
+ linux-user/include/host/aarch64/host-signal.h     |  16 +-
+ linux-user/include/host/alpha/host-signal.h       |  14 +-
+ linux-user/include/host/arm/host-signal.h         |  14 +-
+ linux-user/include/host/i386/host-signal.h        |  14 +-
+ linux-user/include/host/loongarch64/host-signal.h |  14 +-
+ linux-user/include/host/mips/host-signal.h        |  14 +-
+ linux-user/include/host/ppc/host-signal.h         |  14 +-
+ linux-user/include/host/riscv/host-signal.h       |  14 +-
+ linux-user/include/host/s390/host-signal.h        |  14 +-
+ linux-user/include/host/sparc/host-signal.h       |  63 ----
+ linux-user/include/host/sparc64/host-signal.h     |  65 +++-
+ linux-user/include/host/x86_64/host-signal.h      |  14 +-
+ tcg/aarch64/tcg-target.h                          |   2 -
+ tcg/arm/tcg-target.h                              |   6 +-
+ tcg/i386/tcg-target.h                             |   2 -
+ tcg/loongarch64/tcg-target.h                      |   2 -
+ tcg/mips/tcg-target.h                             |   2 -
+ tcg/ppc/tcg-target.h                              |   2 -
+ tcg/riscv/tcg-target.h                            |   2 -
+ tcg/s390x/tcg-target.h                            |   2 -
+ accel/tcg/cpu-exec.c                              |   3 +-
+ accel/tcg/cputlb.c                                |   9 +
+ linux-user/signal.c                               |  22 +-
+ softmmu/cpus.c                                    |   7 +-
+ tcg/tci.c                                         |  20 +-
+ tests/tcg/multiarch/sigbus.c                      |  68 ++++
+ tcg/aarch64/tcg-target.c.inc                      |  91 ++++-
+ tcg/arm/tcg-target.c.inc                          | 410 +++++++++-------------
+ tcg/i386/tcg-target.c.inc                         | 103 +++++-
+ tcg/loongarch64/tcg-target.c.inc                  |  73 +++-
+ tcg/mips/tcg-target.c.inc                         | 387 ++++++++++++++++++--
+ tcg/ppc/tcg-target.c.inc                          |  98 +++++-
+ tcg/riscv/tcg-target.c.inc                        |  63 +++-
+ tcg/s390x/tcg-target.c.inc                        |  59 +++-
+ tcg/sparc/tcg-target.c.inc                        | 348 +++++++++++++++---
+ common-user/host/sparc64/safe-syscall.inc.S       |   5 +-
+files changed, 1561 insertions(+), 495 deletions(-)
+ delete mode 100644 linux-user/include/host/sparc/host-signal.h
+ create mode 100644 tests/tcg/multiarch/sigbus.c

-New patch
+[PULL 01/34] common-user/host/sparc64: Fix safe_syscall_base
+Use the "retl" instead of "ret" instruction alias, since we
+do not allocate a register window in this function.
+Fix the offset to the first stacked parameter, which lies
+beyond the register window save area.
+Fixes: 95c021dac835 ("linux-user/host/sparc64: Add safe-syscall.inc.S")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ common-user/host/sparc64/safe-syscall.inc.S | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/common-user/host/sparc64/safe-syscall.inc.S b/common-user/host/sparc64/safe-syscall.inc.S
+index XXXXXXX..XXXXXXX 100644
+--- a/common-user/host/sparc64/safe-syscall.inc.S
++++ b/common-user/host/sparc64/safe-syscall.inc.S
+@@ -XXX,XX +XXX,XX @@
+         .type   safe_syscall_end, @function
+ #define STACK_BIAS  2047
+-#define PARAM(N)    STACK_BIAS + N*8
++#define WINDOW_SIZE 16 * 8
++#define PARAM(N)    STACK_BIAS + WINDOW_SIZE + N * 8
+         /*
+          * This is the entry point for making a system call. The calling
+@@ -XXX,XX +XXX,XX @@ safe_syscall_end:
+         /* code path for having successfully executed the syscall */
+         bcs,pn  %xcc, 1f
+          nop
+-        ret
++        retl
+          nop
+         /* code path when we didn't execute the syscall */
+--
+.25.1

-New patch
+[PULL 02/34] linux-user: Introduce host_signal_mask
+Do not directly access the uc_sigmask member.
 This is preparation for a sparc64 fix.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  linux-user/include/host/aarch64/host-signal.h  |  5 +++++
  linux-user/include/host/alpha/host-signal.h    |  5 +++++
  linux-user/include/host/arm/host-signal.h      |  5 +++++
  linux-user/include/host/i386/host-signal.h     |  5 +++++
  .../include/host/loongarch64/host-signal.h     |  5 +++++
  linux-user/include/host/mips/host-signal.h     |  5 +++++
  linux-user/include/host/ppc/host-signal.h      |  5 +++++
  linux-user/include/host/riscv/host-signal.h    |  5 +++++
  linux-user/include/host/s390/host-signal.h     |  5 +++++
  linux-user/include/host/sparc/host-signal.h    |  5 +++++
  linux-user/include/host/x86_64/host-signal.h   |  5 +++++
  linux-user/signal.c                            | 18 ++++++++----------
 files changed, 63 insertions(+), 10 deletions(-)
 diff --git a/linux-user/include/host/aarch64/host-signal.h b/linux-user/include/host/aarch64/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/aarch64/host-signal.h
 +++ b/linux-user/include/host/aarch64/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.pc = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      struct _aarch64_ctx *hdr;
 diff --git a/linux-user/include/host/alpha/host-signal.h b/linux-user/include/host/alpha/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/alpha/host-signal.h
 +++ b/linux-user/include/host/alpha/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.sc_pc = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      uint32_t *pc = (uint32_t *)host_signal_pc(uc);
 diff --git a/linux-user/include/host/arm/host-signal.h b/linux-user/include/host/arm/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/arm/host-signal.h
 +++ b/linux-user/include/host/arm/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.arm_pc = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      /*
 diff --git a/linux-user/include/host/i386/host-signal.h b/linux-user/include/host/i386/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/i386/host-signal.h
 +++ b/linux-user/include/host/i386/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.gregs[REG_EIP] = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
 diff --git a/linux-user/include/host/loongarch64/host-signal.h b/linux-user/include/host/loongarch64/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/loongarch64/host-signal.h
 +++ b/linux-user/include/host/loongarch64/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.__pc = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      const uint32_t *pinsn = (const uint32_t *)host_signal_pc(uc);
 diff --git a/linux-user/include/host/mips/host-signal.h b/linux-user/include/host/mips/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/mips/host-signal.h
 +++ b/linux-user/include/host/mips/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.pc = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  #if defined(__misp16) || defined(__mips_micromips)
  #error "Unsupported encoding"
  #endif
 diff --git a/linux-user/include/host/ppc/host-signal.h b/linux-user/include/host/ppc/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/ppc/host-signal.h
 +++ b/linux-user/include/host/ppc/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.regs->nip = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      return uc->uc_mcontext.regs->trap != 0x400
 diff --git a/linux-user/include/host/riscv/host-signal.h b/linux-user/include/host/riscv/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/riscv/host-signal.h
 +++ b/linux-user/include/host/riscv/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.__gregs[REG_PC] = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      /*
 diff --git a/linux-user/include/host/s390/host-signal.h b/linux-user/include/host/s390/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/s390/host-signal.h
 +++ b/linux-user/include/host/s390/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.psw.addr = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      uint16_t *pinsn = (uint16_t *)host_signal_pc(uc);
 diff --git a/linux-user/include/host/sparc/host-signal.h b/linux-user/include/host/sparc/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/sparc/host-signal.h
 +++ b/linux-user/include/host/sparc/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
  #endif
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      uint32_t insn = *(uint32_t *)host_signal_pc(uc);
 diff --git a/linux-user/include/host/x86_64/host-signal.h b/linux-user/include/host/x86_64/host-signal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/include/host/x86_64/host-signal.h
 +++ b/linux-user/include/host/x86_64/host-signal.h
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
      uc->uc_mcontext.gregs[REG_RIP] = pc;
  }
 +static inline void *host_signal_mask(ucontext_t *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
  static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
  {
      return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
 diff --git a/linux-user/signal.c b/linux-user/signal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/signal.c
 +++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
      int guest_sig;
      uintptr_t pc = 0;
      bool sync_sig = false;
 +    void *sigmask = host_signal_mask(uc);
      /*
       * Non-spoofed SIGSEGV and SIGBUS are synchronous, and need special
@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
              if (info->si_code == SEGV_ACCERR && h2g_valid(host_addr)) {
                  /* If this was a write to a TB protected page, restart. */
                  if (is_write &&
 -                    handle_sigsegv_accerr_write(cpu, &uc->uc_sigmask,
 -                                                pc, guest_addr)) {
 +                    handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) {
                      return;
                  }
@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
                  }
              }
 -            sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
 +            sigprocmask(SIG_SETMASK, sigmask, NULL);
              cpu_loop_exit_sigsegv(cpu, guest_addr, access_type, maperr, pc);
          } else {
 -            sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
 +            sigprocmask(SIG_SETMASK, sigmask, NULL);
              if (info->si_code == BUS_ADRALN) {
                  cpu_loop_exit_sigbus(cpu, guest_addr, access_type, pc);
              }
@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
       * now and it getting out to the main loop. Signals will be
       * unblocked again in process_pending_signals().
       *
 -     * WARNING: we cannot use sigfillset() here because the uc_sigmask
 +     * WARNING: we cannot use sigfillset() here because the sigmask
       * field is a kernel sigset_t, which is much smaller than the
       * libc sigset_t which sigfillset() operates on. Using sigfillset()
       * would write 0xff bytes off the end of the structure and trash
       * data on the struct.
 -     * We can't use sizeof(uc->uc_sigmask) either, because the libc
 -     * headers define the struct field with the wrong (too large) type.
       */
 -    memset(&uc->uc_sigmask, 0xff, SIGSET_T_SIZE);
 -    sigdelset(&uc->uc_sigmask, SIGSEGV);
 -    sigdelset(&uc->uc_sigmask, SIGBUS);
 +    memset(sigmask, 0xff, SIGSET_T_SIZE);
 +    sigdelset(sigmask, SIGSEGV);
 +    sigdelset(sigmask, SIGBUS);
      /* interrupt the virtual CPU as soon as possible */
      cpu_exit(thread_cpu);
 --
 .25.1

-New patch
+[PULL 03/34] linux-user: Introduce host_sigcontext
+Do not directly access ucontext_t as the third signal parameter.
+This is preparation for a sparc64 fix.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/include/host/aarch64/host-signal.h     | 13 ++++++++-----
+ linux-user/include/host/alpha/host-signal.h       | 11 +++++++----
+ linux-user/include/host/arm/host-signal.h         | 11 +++++++----
+ linux-user/include/host/i386/host-signal.h        | 11 +++++++----
+ linux-user/include/host/loongarch64/host-signal.h | 11 +++++++----
+ linux-user/include/host/mips/host-signal.h        | 11 +++++++----
+ linux-user/include/host/ppc/host-signal.h         | 11 +++++++----
+ linux-user/include/host/riscv/host-signal.h       | 11 +++++++----
+ linux-user/include/host/s390/host-signal.h        | 11 +++++++----
+ linux-user/include/host/sparc/host-signal.h       | 11 +++++++----
+ linux-user/include/host/x86_64/host-signal.h      | 11 +++++++----
+ linux-user/signal.c                               |  4 ++--
+files changed, 80 insertions(+), 47 deletions(-)
+diff --git a/linux-user/include/host/aarch64/host-signal.h b/linux-user/include/host/aarch64/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/aarch64/host-signal.h
++++ b/linux-user/include/host/aarch64/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef AARCH64_HOST_SIGNAL_H
+ #define AARCH64_HOST_SIGNAL_H
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
+ /* Pre-3.16 kernel headers don't have these, so provide fallback definitions */
+ #ifndef ESR_MAGIC
+ #define ESR_MAGIC 0x45535201
+@@ -XXX,XX +XXX,XX @@ struct esr_context {
+ };
+ #endif
+-static inline struct _aarch64_ctx *first_ctx(ucontext_t *uc)
++static inline struct _aarch64_ctx *first_ctx(host_sigcontext *uc)
+ {
+     return (struct _aarch64_ctx *)&uc->uc_mcontext.__reserved;
+ }
+@@ -XXX,XX +XXX,XX @@ static inline struct _aarch64_ctx *next_ctx(struct _aarch64_ctx *hdr)
+     return (struct _aarch64_ctx *)((char *)hdr + hdr->size);
+ }
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.pc;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.pc = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     struct _aarch64_ctx *hdr;
+     uint32_t insn;
+diff --git a/linux-user/include/host/alpha/host-signal.h b/linux-user/include/host/alpha/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/alpha/host-signal.h
++++ b/linux-user/include/host/alpha/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ALPHA_HOST_SIGNAL_H
+ #define ALPHA_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.sc_pc;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.sc_pc = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     uint32_t *pc = (uint32_t *)host_signal_pc(uc);
+     uint32_t insn = *pc;
+diff --git a/linux-user/include/host/arm/host-signal.h b/linux-user/include/host/arm/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/arm/host-signal.h
++++ b/linux-user/include/host/arm/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ARM_HOST_SIGNAL_H
+ #define ARM_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.arm_pc;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.arm_pc = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     /*
+      * In the FSR, bit 11 is WnR, assuming a v6 or
+diff --git a/linux-user/include/host/i386/host-signal.h b/linux-user/include/host/i386/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/i386/host-signal.h
++++ b/linux-user/include/host/i386/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef I386_HOST_SIGNAL_H
+ #define I386_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.gregs[REG_EIP];
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.gregs[REG_EIP] = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
+         && (uc->uc_mcontext.gregs[REG_ERR] & 0x2);
+diff --git a/linux-user/include/host/loongarch64/host-signal.h b/linux-user/include/host/loongarch64/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/loongarch64/host-signal.h
++++ b/linux-user/include/host/loongarch64/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef LOONGARCH64_HOST_SIGNAL_H
+ #define LOONGARCH64_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.__pc;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.__pc = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     const uint32_t *pinsn = (const uint32_t *)host_signal_pc(uc);
+     uint32_t insn = pinsn[0];
+diff --git a/linux-user/include/host/mips/host-signal.h b/linux-user/include/host/mips/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/mips/host-signal.h
++++ b/linux-user/include/host/mips/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef MIPS_HOST_SIGNAL_H
+ #define MIPS_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.pc;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.pc = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+@@ -XXX,XX +XXX,XX @@ static inline void *host_signal_mask(ucontext_t *uc)
+ #error "Unsupported encoding"
+ #endif
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     uint32_t insn = *(uint32_t *)host_signal_pc(uc);
+diff --git a/linux-user/include/host/ppc/host-signal.h b/linux-user/include/host/ppc/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/ppc/host-signal.h
++++ b/linux-user/include/host/ppc/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef PPC_HOST_SIGNAL_H
+ #define PPC_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.regs->nip;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.regs->nip = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.regs->trap != 0x400
+         && (uc->uc_mcontext.regs->dsisr & 0x02000000);
+diff --git a/linux-user/include/host/riscv/host-signal.h b/linux-user/include/host/riscv/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/riscv/host-signal.h
++++ b/linux-user/include/host/riscv/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef RISCV_HOST_SIGNAL_H
+ #define RISCV_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.__gregs[REG_PC];
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.__gregs[REG_PC] = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     /*
+      * Detect store by reading the instruction at the program counter.
+diff --git a/linux-user/include/host/s390/host-signal.h b/linux-user/include/host/s390/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/s390/host-signal.h
++++ b/linux-user/include/host/s390/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef S390_HOST_SIGNAL_H
+ #define S390_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.psw.addr;
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.psw.addr = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     uint16_t *pinsn = (uint16_t *)host_signal_pc(uc);
+diff --git a/linux-user/include/host/sparc/host-signal.h b/linux-user/include/host/sparc/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/sparc/host-signal.h
++++ b/linux-user/include/host/sparc/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef SPARC_HOST_SIGNAL_H
+ #define SPARC_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+ #ifdef __arch64__
+     return uc->uc_mcontext.mc_gregs[MC_PC];
+@@ -XXX,XX +XXX,XX @@ static inline uintptr_t host_signal_pc(ucontext_t *uc)
+ #endif
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+ #ifdef __arch64__
+     uc->uc_mcontext.mc_gregs[MC_PC] = pc;
+@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+ #endif
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     uint32_t insn = *(uint32_t *)host_signal_pc(uc);
+diff --git a/linux-user/include/host/x86_64/host-signal.h b/linux-user/include/host/x86_64/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/x86_64/host-signal.h
++++ b/linux-user/include/host/x86_64/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef X86_64_HOST_SIGNAL_H
+ #define X86_64_HOST_SIGNAL_H
+-static inline uintptr_t host_signal_pc(ucontext_t *uc)
++/* The third argument to a SA_SIGINFO handler is ucontext_t. */
++typedef ucontext_t host_sigcontext;
++
++static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.gregs[REG_RIP];
+ }
+-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+ {
+     uc->uc_mcontext.gregs[REG_RIP] = pc;
+ }
+-static inline void *host_signal_mask(ucontext_t *uc)
++static inline void *host_signal_mask(host_sigcontext *uc)
+ {
+     return &uc->uc_sigmask;
+ }
+-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
++static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+ {
+     return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
+         && (uc->uc_mcontext.gregs[REG_ERR] & 0x2);
+diff --git a/linux-user/signal.c b/linux-user/signal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/signal.c
++++ b/linux-user/signal.c
+@@ -XXX,XX +XXX,XX @@ void queue_signal(CPUArchState *env, int sig, int si_type,
+ /* Adjust the signal context to rewind out of safe-syscall if we're in it */
+ static inline void rewind_if_in_safe_syscall(void *puc)
+ {
+-    ucontext_t *uc = (ucontext_t *)puc;
++    host_sigcontext *uc = (host_sigcontext *)puc;
+     uintptr_t pcreg = host_signal_pc(uc);
+     if (pcreg > (uintptr_t)safe_syscall_start
+@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
+     CPUState *cpu = env_cpu(env);
+     TaskState *ts = cpu->opaque;
+     target_siginfo_t tinfo;
+-    ucontext_t *uc = puc;
++    host_sigcontext *uc = puc;
+     struct emulated_sigtable *k;
+     int guest_sig;
+     uintptr_t pc = 0;
+--
+.25.1

-[PULL 06/11] tcg: Remove TCGOpDef.used
+[PULL 04/34] linux-user: Move sparc/host-signal.h to sparc64/host-signal.h
-The last user of this field disappeared in f69d277ece4.
+We do not support sparc32 as a host, so there's no point in
 sparc64 redirecting to sparc.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h | 3 ---
+ linux-user/include/host/sparc/host-signal.h   | 71 -------------------
-file changed, 3 deletions(-)
+ linux-user/include/host/sparc64/host-signal.h | 64 ++++++++++++++++-
 files changed, 63 insertions(+), 72 deletions(-)
  delete mode 100644 linux-user/include/host/sparc/host-signal.h
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/linux-user/include/host/sparc/host-signal.h b/linux-user/include/host/sparc/host-signal.h
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/linux-user/include/host/sparc/host-signal.h
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -/*
 - * host-signal.h: signal info dependent on the host architecture
 - *
 - * Copyright (c) 2003-2005 Fabrice Bellard
 - * Copyright (c) 2021 Linaro Limited
 - *
 - * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
 - * See the COPYING file in the top-level directory.
 - */
 -
 -#ifndef SPARC_HOST_SIGNAL_H
 -#define SPARC_HOST_SIGNAL_H
 -
 -/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
 -typedef ucontext_t host_sigcontext;
 -
 -static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 -{
 -#ifdef __arch64__
 -    return uc->uc_mcontext.mc_gregs[MC_PC];
 -#else
 -    return uc->uc_mcontext.gregs[REG_PC];
 -#endif
 -}
 -
 -static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 -{
 -#ifdef __arch64__
 -    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
 -#else
 -    uc->uc_mcontext.gregs[REG_PC] = pc;
 -#endif
 -}
 -
 -static inline void *host_signal_mask(host_sigcontext *uc)
 -{
 -    return &uc->uc_sigmask;
 -}
 -
 -static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 -{
 -    uint32_t insn = *(uint32_t *)host_signal_pc(uc);
 -
 -    if ((insn >> 30) == 3) {
 -        switch ((insn >> 19) & 0x3f) {
 -        case 0x05: /* stb */
 -        case 0x15: /* stba */
 -        case 0x06: /* sth */
 -        case 0x16: /* stha */
 -        case 0x04: /* st */
 -        case 0x14: /* sta */
 -        case 0x07: /* std */
 -        case 0x17: /* stda */
 -        case 0x0e: /* stx */
 -        case 0x1e: /* stxa */
 -        case 0x24: /* stf */
 -        case 0x34: /* stfa */
 -        case 0x27: /* stdf */
 -        case 0x37: /* stdfa */
 -        case 0x26: /* stqf */
 -        case 0x36: /* stqfa */
 -        case 0x25: /* stfsr */
 -        case 0x3c: /* casa */
 -        case 0x3e: /* casxa */
 -            return true;
 -        }
 -    }
 -    return false;
 -}
 -
 -#endif
 diff --git a/linux-user/include/host/sparc64/host-signal.h b/linux-user/include/host/sparc64/host-signal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/linux-user/include/host/sparc64/host-signal.h
-+++ b/include/tcg/tcg.h
++++ b/linux-user/include/host/sparc64/host-signal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
+@@ -1 +1,63 @@
-     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
+-#include "../sparc/host-signal.h"
-     uint8_t flags;
++/*
-     TCGArgConstraint *args_ct;
++ * host-signal.h: signal info dependent on the host architecture
--#if defined(CONFIG_DEBUG_TCG)
++ *
--    int used;
++ * Copyright (c) 2003-2005 Fabrice Bellard
--#endif
++ * Copyright (c) 2021 Linaro Limited
- } TCGOpDef;
++ *
++ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- extern TCGOpDef tcg_op_defs[];
++ * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef SPARC64_HOST_SIGNAL_H
 +#define SPARC64_HOST_SIGNAL_H
 +
 +/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
 +typedef ucontext_t host_sigcontext;
 +
 +static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 +{
 +    return uc->uc_mcontext.mc_gregs[MC_PC];
 +}
 +
 +static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 +{
 +    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
 +}
 +
 +static inline void *host_signal_mask(host_sigcontext *uc)
 +{
 +    return &uc->uc_sigmask;
 +}
 +
 +static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 +{
 +    uint32_t insn = *(uint32_t *)host_signal_pc(uc);
 +
 +    if ((insn >> 30) == 3) {
 +        switch ((insn >> 19) & 0x3f) {
 +        case 0x05: /* stb */
 +        case 0x15: /* stba */
 +        case 0x06: /* sth */
 +        case 0x16: /* stha */
 +        case 0x04: /* st */
 +        case 0x14: /* sta */
 +        case 0x07: /* std */
 +        case 0x17: /* stda */
 +        case 0x0e: /* stx */
 +        case 0x1e: /* stxa */
 +        case 0x24: /* stf */
 +        case 0x34: /* stfa */
 +        case 0x27: /* stdf */
 +        case 0x37: /* stdfa */
 +        case 0x26: /* stqf */
 +        case 0x36: /* stqfa */
 +        case 0x25: /* stfsr */
 +        case 0x3c: /* casa */
 +        case 0x3e: /* casxa */
 +            return true;
 +        }
 +    }
 +    return false;
 +}
 +
 +#endif
 --
 .25.1

-New patch
+[PULL 05/34] linux-user/include/host/sparc64: Fix host_sigcontext
+Sparc64 is unique on linux in *not* passing ucontext_t as
+the third argument to a SA_SIGINFO handler.  It passes the
+old struct sigcontext instead.
+Set both pc and npc in host_signal_set_pc.
+Fixes: 8b5bd461935b ("linux-user/host/sparc: Populate host_signal.h")
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/include/host/sparc64/host-signal.h | 17 +++++++++--------
+file changed, 9 insertions(+), 8 deletions(-)
+diff --git a/linux-user/include/host/sparc64/host-signal.h b/linux-user/include/host/sparc64/host-signal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/include/host/sparc64/host-signal.h
++++ b/linux-user/include/host/sparc64/host-signal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef SPARC64_HOST_SIGNAL_H
+ #define SPARC64_HOST_SIGNAL_H
+-/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
+-typedef ucontext_t host_sigcontext;
++/* The third argument to a SA_SIGINFO handler is struct sigcontext.  */
++typedef struct sigcontext host_sigcontext;
+-static inline uintptr_t host_signal_pc(host_sigcontext *uc)
++static inline uintptr_t host_signal_pc(host_sigcontext *sc)
+ {
+-    return uc->uc_mcontext.mc_gregs[MC_PC];
++    return sc->sigc_regs.tpc;
+ }
+-static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
++static inline void host_signal_set_pc(host_sigcontext *sc, uintptr_t pc)
+ {
+-    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
++    sc->sigc_regs.tpc = pc;
++    sc->sigc_regs.tnpc = pc + 4;
+ }
+-static inline void *host_signal_mask(host_sigcontext *uc)
++static inline void *host_signal_mask(host_sigcontext *sc)
+ {
+-    return &uc->uc_sigmask;
++    return &sc->sigc_mask;
+ }
+ static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+--
+.25.1

-New patch
+[PULL 06/34] accel/tcg: Optimize jump cache flush during tlb range flush
+From: Idan Horowitz <idan.horowitz@gmail.com>
+When the length of the range is large enough, clearing the whole cache is
+faster than iterating over the (possibly extremely large) set of pages
+contained in the range.
+This mimics the pre-existing similar optimization done on the flush of the
+tlb itself.
+Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Message-Id: <20220110164754.1066025-1-idan.horowitz@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cputlb.c | 9 +++++++++
+file changed, 9 insertions(+)
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
+     }
+     qemu_spin_unlock(&env_tlb(env)->c.lock);
++    /*
++     * If the length is larger than the jump cache size, then it will take
++     * longer to clear each entry individually than it will to clear it all.
++     */
++    if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
++        cpu_tb_jmp_cache_clear(cpu);
++        return;
++    }
++
+     for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
+         tb_flush_jmp_cache(cpu, d.addr + i);
+     }
+--
+.25.1

-New patch
+[PULL 07/34] softmmu/cpus: Check if the cpu work list is empty atomically
+From: Idan Horowitz <idan.horowitz@gmail.com>
+Instead of taking the lock of the cpu work list in order to check if it's
+empty, we can just read the head pointer atomically. This decreases
+cpu_work_list_empty's share from 5% to 1.3% in a profile of icount-enabled
+aarch64-softmmu.
+Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Message-Id: <20220114004358.299534-1-idan.horowitz@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ softmmu/cpus.c | 7 +------
+file changed, 1 insertion(+), 6 deletions(-)
+diff --git a/softmmu/cpus.c b/softmmu/cpus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/cpus.c
++++ b/softmmu/cpus.c
+@@ -XXX,XX +XXX,XX @@ bool cpu_is_stopped(CPUState *cpu)
+ bool cpu_work_list_empty(CPUState *cpu)
+ {
+-    bool ret;
+-
+-    qemu_mutex_lock(&cpu->work_mutex);
+-    ret = QSIMPLEQ_EMPTY(&cpu->work_list);
+-    qemu_mutex_unlock(&cpu->work_mutex);
+-    return ret;
++    return QSIMPLEQ_EMPTY_ATOMIC(&cpu->work_list);
+ }
+ bool cpu_thread_is_idle(CPUState *cpu)
+--
+.25.1

-New patch
+[PULL 08/34] replay: use CF_NOIRQ for special exception-replaying TB
+From: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
+Commit aff0e204cb1f1c036a496c94c15f5dfafcd9b4b4 introduced CF_NOIRQ usage,
+but one case was forgotten. Record/replay uses one special TB which is not
+really executed, but used to cause a correct exception in replay mode.
+This patch adds CF_NOIRQ flag for such block.
+Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <164362834054.1754532.7678416881159817273.stgit@pasha-ThinkPad-X280>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cpu-exec.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cpu-exec.c
++++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
+         if (replay_has_exception()
+             && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0) {
+             /* Execute just one insn to trigger exception pending in the log */
+-            cpu->cflags_next_tb = (curr_cflags(cpu) & ~CF_USE_ICOUNT) | 1;
++            cpu->cflags_next_tb = (curr_cflags(cpu) & ~CF_USE_ICOUNT)
++                | CF_NOIRQ | 1;
+         }
+ #endif
+         return false;
+--
+.25.1

-New patch
+[PULL 09/34] tcg/loongarch64: Fix fallout from recent MO_Q renaming
+From: WANG Xuerui <git@xen0n.name>
+Apparently we were left behind; just renaming MO_Q to MO_UQ is enough.
+Fixes: fc313c64345453c7 ("exec/memop: Adding signedness to quad definitions")
+Signed-off-by: WANG Xuerui <git@xen0n.name>
+Message-Id: <20220206162106.1092364-1-i.qemu@xen0n.name>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/loongarch64/tcg-target.c.inc | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/loongarch64/tcg-target.c.inc
++++ b/tcg/loongarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_indexed(TCGContext *s, TCGReg rd, TCGReg rj,
+     case MO_SL:
+         tcg_out_opc_ldx_w(s, rd, rj, rk);
+         break;
+-    case MO_Q:
++    case MO_UQ:
+         tcg_out_opc_ldx_d(s, rd, rj, rk);
+         break;
+     default:
+--
+.25.1

-[PULL 07/11] tcg/i386: Fix dupi for avx2 32-bit hosts
+[PULL 10/34] tcg/i386: Support raising sigbus for user-only
-The previous change wrongly stated that 32-bit avx2 should have
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 used VPBROADCASTW.  But that's a 16-bit broadcast and we want a
 -bit broadcast.
 Fixes: 7b60ef3264e
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/i386/tcg-target.c.inc | 2 +-
+ tcg/i386/tcg-target.h     |   2 -
-file changed, 1 insertion(+), 1 deletion(-)
+ tcg/i386/tcg-target.c.inc | 103 ++++++++++++++++++++++++++++++++++++--
 files changed, 98 insertions(+), 7 deletions(-)
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ static inline void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
+ #define TCG_TARGET_HAS_MEMORY_BSWAP  have_movbe
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_NEED_POOL_LABELS
+ #endif
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type,
+@@ -XXX,XX +XXX,XX @@
-         new_pool_label(s, arg, R_386_PC32, s->code_ptr - 4, -4);
+  * THE SOFTWARE.
-     } else {
+  */
-         if (have_avx2) {
--            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTW + vex_l, ret);
++#include "../tcg-ldst.c.inc"
-+            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTD + vex_l, ret);
+ #include "../tcg-pool.c.inc"
-         } else {
-             tcg_out_vex_modrm_pool(s, OPC_VBROADCASTSS, ret);
+ #ifdef CONFIG_DEBUG_TCG
-         }
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
  #define OPC_VZEROUPPER  (0x77 | P_EXT)
  #define OPC_XCHG_ax_r32    (0x90)
 -#define OPC_GRP3_Ev    (0xf7)
 -#define OPC_GRP5    (0xff)
 +#define OPC_GRP3_Eb     (0xf6)
 +#define OPC_GRP3_Ev     (0xf7)
 +#define OPC_GRP5        (0xff)
  #define OPC_GRP14       (0x73 | P_EXT | P_DATA16)
  /* Group 1 opcode extensions for 0x80-0x83.
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
  #define SHIFT_SAR 7
  /* Group 3 opcode extensions for 0xf6, 0xf7.  To be used with OPC_GRP3.  */
 +#define EXT3_TESTi 0
  #define EXT3_NOT   2
  #define EXT3_NEG   3
  #define EXT3_MUL   4
@@ -XXX,XX +XXX,XX @@ static void tcg_out_nopn(TCGContext *s, int n)
  }
  #if defined(CONFIG_SOFTMMU)
 -#include "../tcg-ldst.c.inc"
 -
  /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
   *                                     int mmu_idx, uintptr_t ra)
   */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
      return true;
  }
 -#elif TCG_TARGET_REG_BITS == 32
 +#else
 +
 +static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
 +                                   TCGReg addrhi, unsigned a_bits)
 +{
 +    unsigned a_mask = (1 << a_bits) - 1;
 +    TCGLabelQemuLdst *label;
 +
 +    /*
 +     * We are expecting a_bits to max out at 7, so we can usually use testb.
 +     * For i686, we have to use testl for %esi/%edi.
 +     */
 +    if (a_mask <= 0xff && (TCG_TARGET_REG_BITS == 64 || addrlo < 4)) {
 +        tcg_out_modrm(s, OPC_GRP3_Eb | P_REXB_RM, EXT3_TESTi, addrlo);
 +        tcg_out8(s, a_mask);
 +    } else {
 +        tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_TESTi, addrlo);
 +        tcg_out32(s, a_mask);
 +    }
 +
 +    /* jne slow_path */
 +    tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
 +
 +    label = new_ldst_label(s);
 +    label->is_ld = is_ld;
 +    label->addrlo_reg = addrlo;
 +    label->addrhi_reg = addrhi;
 +    label->raddr = tcg_splitwx_to_rx(s->code_ptr + 4);
 +    label->label_ptr[0] = s->code_ptr;
 +
 +    s->code_ptr += 4;
 +}
 +
 +static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    /* resolve label address */
 +    tcg_patch32(l->label_ptr[0], s->code_ptr - l->label_ptr[0] - 4);
 +
 +    if (TCG_TARGET_REG_BITS == 32) {
 +        int ofs = 0;
 +
 +        tcg_out_st(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP, ofs);
 +        ofs += 4;
 +
 +        tcg_out_st(s, TCG_TYPE_I32, l->addrlo_reg, TCG_REG_ESP, ofs);
 +        ofs += 4;
 +        if (TARGET_LONG_BITS == 64) {
 +            tcg_out_st(s, TCG_TYPE_I32, l->addrhi_reg, TCG_REG_ESP, ofs);
 +            ofs += 4;
 +        }
 +
 +        tcg_out_pushi(s, (uintptr_t)l->raddr);
 +    } else {
 +        tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
 +                    l->addrlo_reg);
 +        tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
 +
 +        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RAX, (uintptr_t)l->raddr);
 +        tcg_out_push(s, TCG_REG_RAX);
 +    }
 +
 +    /* "Tail call" to the helper, with the return address back inline. */
 +    tcg_out_jmp(s, (const void *)(l->is_ld ? helper_unaligned_ld
 +                                  : helper_unaligned_st));
 +    return true;
 +}
 +
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    return tcg_out_fail_alignment(s, l);
 +}
 +
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    return tcg_out_fail_alignment(s, l);
 +}
 +
 +#if TCG_TARGET_REG_BITS == 32
  # define x86_guest_base_seg     0
  # define x86_guest_base_index   -1
  # define x86_guest_base_offset  guest_base
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
      return 0;
  }
  # endif
 +#endif
  #endif /* SOFTMMU */
  static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
  #if defined(CONFIG_SOFTMMU)
      int mem_index;
      tcg_insn_unit *label_ptr[2];
 +#else
 +    unsigned a_bits;
  #endif
      datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
      add_qemu_ldst_label(s, true, is64, oi, datalo, datahi, addrlo, addrhi,
                          s->code_ptr, label_ptr);
  #else
 +    a_bits = get_alignment_bits(opc);
 +    if (a_bits) {
 +        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
 +    }
 +
      tcg_out_qemu_ld_direct(s, datalo, datahi, addrlo, x86_guest_base_index,
                             x86_guest_base_offset, x86_guest_base_seg,
                             is64, opc);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
  #if defined(CONFIG_SOFTMMU)
      int mem_index;
      tcg_insn_unit *label_ptr[2];
 +#else
 +    unsigned a_bits;
  #endif
      datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
      add_qemu_ldst_label(s, false, is64, oi, datalo, datahi, addrlo, addrhi,
                          s->code_ptr, label_ptr);
  #else
 +    a_bits = get_alignment_bits(opc);
 +    if (a_bits) {
 +        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
 +    }
 +
      tcg_out_qemu_st_direct(s, datalo, datahi, addrlo, x86_guest_base_index,
                             x86_guest_base_offset, x86_guest_base_seg, opc);
  #endif
 --
 .25.1

-[PULL 10/11] tcg: Remove TCG_TARGET_HAS_cmp_vec
+[PULL 11/34] tcg/aarch64: Support raising sigbus for user-only
-The cmp_vec opcode is mandatory; this symbol is unused.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.h | 1 -
+ tcg/aarch64/tcg-target.h     |  2 -
- tcg/i386/tcg-target.h    | 1 -
+ tcg/aarch64/tcg-target.c.inc | 91 +++++++++++++++++++++++++++++-------
- tcg/ppc/tcg-target.h     | 1 -
+files changed, 74 insertions(+), 19 deletions(-)
 files changed, 3 deletions(-)
 diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.h
 +++ b/tcg/aarch64/tcg-target.h
 @@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_shi_vec          1
- #define TCG_TARGET_HAS_shs_vec          0
+ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
- #define TCG_TARGET_HAS_shv_vec          1
--#define TCG_TARGET_HAS_cmp_vec          1
+-#ifdef CONFIG_SOFTMMU
- #define TCG_TARGET_HAS_mul_vec          1
+ #define TCG_TARGET_NEED_LDST_LABELS
- #define TCG_TARGET_HAS_sat_vec          1
+-#endif
- #define TCG_TARGET_HAS_minmax_vec       1
+ #define TCG_TARGET_NEED_POOL_LABELS
-diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
  #endif /* AARCH64_TCG_TARGET_H */
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.h
+--- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/i386/tcg-target.h
++++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
+@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_shi_vec          1
+  * See the COPYING file in the top-level directory for details.
- #define TCG_TARGET_HAS_shs_vec          1
+  */
- #define TCG_TARGET_HAS_shv_vec          have_avx2
--#define TCG_TARGET_HAS_cmp_vec          1
++#include "../tcg-ldst.c.inc"
- #define TCG_TARGET_HAS_mul_vec          1
+ #include "../tcg-pool.c.inc"
- #define TCG_TARGET_HAS_sat_vec          1
+ #include "qemu/bitops.h"
- #define TCG_TARGET_HAS_minmax_vec       1
-diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-index XXXXXXX..XXXXXXX 100644
+     I3404_ANDI      = 0x12000000,
---- a/tcg/ppc/tcg-target.h
+     I3404_ORRI      = 0x32000000,
-+++ b/tcg/ppc/tcg-target.h
+     I3404_EORI      = 0x52000000,
-@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
++    I3404_ANDSI     = 0x72000000,
- #define TCG_TARGET_HAS_shi_vec          0
- #define TCG_TARGET_HAS_shs_vec          0
+     /* Move wide immediate instructions.  */
- #define TCG_TARGET_HAS_shv_vec          1
+     I3405_MOVN      = 0x12800000,
--#define TCG_TARGET_HAS_cmp_vec          1
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_goto_long(TCGContext *s, const tcg_insn_unit *target)
- #define TCG_TARGET_HAS_mul_vec          1
+     if (offset == sextract64(offset, 0, 26)) {
- #define TCG_TARGET_HAS_sat_vec          1
+         tcg_out_insn(s, 3206, B, offset);
- #define TCG_TARGET_HAS_minmax_vec       1
+     } else {
 -        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, (intptr_t)target);
 -        tcg_out_insn(s, 3207, BR, TCG_REG_TMP);
 +        /* Choose X9 as a call-clobbered non-LR temporary. */
 +        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_X9, (intptr_t)target);
 +        tcg_out_insn(s, 3207, BR, TCG_REG_X9);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_cltz(TCGContext *s, TCGType ext, TCGReg d,
      }
  }
 -#ifdef CONFIG_SOFTMMU
 -#include "../tcg-ldst.c.inc"
 +static void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
 +{
 +    ptrdiff_t offset = tcg_pcrel_diff(s, target);
 +    tcg_debug_assert(offset == sextract64(offset, 0, 21));
 +    tcg_out_insn(s, 3406, ADR, rd, offset);
 +}
 +#ifdef CONFIG_SOFTMMU
  /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
   *                                     MemOpIdx oi, uintptr_t ra)
   */
@@ -XXX,XX +XXX,XX @@ static void * const qemu_st_helpers[MO_SIZE + 1] = {
  #endif
  };
 -static inline void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
 -{
 -    ptrdiff_t offset = tcg_pcrel_diff(s, target);
 -    tcg_debug_assert(offset == sextract64(offset, 0, 21));
 -    tcg_out_insn(s, 3406, ADR, rd, offset);
 -}
 -
  static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
  {
      MemOpIdx oi = lb->oi;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
      tcg_out_insn(s, 3202, B_C, TCG_COND_NE, 0);
  }
 +#else
 +static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
 +                                   unsigned a_bits)
 +{
 +    unsigned a_mask = (1 << a_bits) - 1;
 +    TCGLabelQemuLdst *label = new_ldst_label(s);
 +
 +    label->is_ld = is_ld;
 +    label->addrlo_reg = addr_reg;
 +
 +    /* tst addr, #mask */
 +    tcg_out_logicali(s, I3404_ANDSI, 0, TCG_REG_XZR, addr_reg, a_mask);
 +
 +    label->label_ptr[0] = s->code_ptr;
 +
 +    /* b.ne slow_path */
 +    tcg_out_insn(s, 3202, B_C, TCG_COND_NE, 0);
 +
 +    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
 +}
 +
 +static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    if (!reloc_pc19(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
 +        return false;
 +    }
 +
 +    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_X1, l->addrlo_reg);
 +    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
 +
 +    /* "Tail call" to the helper, with the return address back inline. */
 +    tcg_out_adr(s, TCG_REG_LR, l->raddr);
 +    tcg_out_goto_long(s, (const void *)(l->is_ld ? helper_unaligned_ld
 +                                        : helper_unaligned_st));
 +    return true;
 +}
 +
 +static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    return tcg_out_fail_alignment(s, l);
 +}
 +
 +static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 +{
 +    return tcg_out_fail_alignment(s, l);
 +}
  #endif /* CONFIG_SOFTMMU */
  static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                     TCGReg data_r, TCGReg addr_r,
                                     TCGType otype, TCGReg off_r)
  {
 -    /* Byte swapping is left to middle-end expansion. */
 -    tcg_debug_assert((memop & MO_BSWAP) == 0);
 -
      switch (memop & MO_SSIZE) {
      case MO_UB:
          tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                     TCGReg data_r, TCGReg addr_r,
                                     TCGType otype, TCGReg off_r)
  {
 -    /* Byte swapping is left to middle-end expansion. */
 -    tcg_debug_assert((memop & MO_BSWAP) == 0);
 -
      switch (memop & MO_SIZE) {
      case MO_8:
          tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
  {
      MemOp memop = get_memop(oi);
      const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
 +
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((memop & MO_BSWAP) == 0);
 +
  #ifdef CONFIG_SOFTMMU
      unsigned mem_index = get_mmuidx(oi);
      tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
      add_qemu_ldst_label(s, true, oi, ext, data_reg, addr_reg,
                          s->code_ptr, label_ptr);
  #else /* !CONFIG_SOFTMMU */
 +    unsigned a_bits = get_alignment_bits(memop);
 +    if (a_bits) {
 +        tcg_out_test_alignment(s, true, addr_reg, a_bits);
 +    }
      if (USE_GUEST_BASE) {
          tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
                                 TCG_REG_GUEST_BASE, otype, addr_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
  {
      MemOp memop = get_memop(oi);
      const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
 +
 +    /* Byte swapping is left to middle-end expansion. */
 +    tcg_debug_assert((memop & MO_BSWAP) == 0);
 +
  #ifdef CONFIG_SOFTMMU
      unsigned mem_index = get_mmuidx(oi);
      tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
      add_qemu_ldst_label(s, false, oi, (memop & MO_SIZE)== MO_64,
                          data_reg, addr_reg, s->code_ptr, label_ptr);
  #else /* !CONFIG_SOFTMMU */
 +    unsigned a_bits = get_alignment_bits(memop);
 +    if (a_bits) {
 +        tcg_out_test_alignment(s, false, addr_reg, a_bits);
 +    }
      if (USE_GUEST_BASE) {
          tcg_out_qemu_st_direct(s, memop, data_reg,
                                 TCG_REG_GUEST_BASE, otype, addr_reg);
 --
 .25.1

-New patch
+[PULL 12/34] tcg/ppc: Support raising sigbus for user-only
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/ppc/tcg-target.h     |  2 -
+ tcg/ppc/tcg-target.c.inc | 98 ++++++++++++++++++++++++++++++++++++----
+files changed, 90 insertions(+), 10 deletions(-)
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.h
++++ b/tcg/ppc/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+ #define TCG_TARGET_DEFAULT_MO (0)
+ #define TCG_TARGET_HAS_MEMORY_BSWAP     1
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_NEED_POOL_LABELS
+ #endif
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+ #include "elf.h"
+ #include "../tcg-pool.c.inc"
++#include "../tcg-ldst.c.inc"
+ /*
+  * Standardize on the _CALL_FOO symbols used by GCC:
+@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
+     }
+ }
+-static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
++static void tcg_out_call_int(TCGContext *s, int lk,
++                             const tcg_insn_unit *target)
+ {
+ #ifdef _CALL_AIX
+     /* Look through the descriptor.  If the branch is in range, and we
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
+     if (in_range_b(diff) && toc == (uint32_t)toc) {
+         tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP1, toc);
+-        tcg_out_b(s, LK, tgt);
++        tcg_out_b(s, lk, tgt);
+     } else {
+         /* Fold the low bits of the constant into the addresses below.  */
+         intptr_t arg = (intptr_t)target;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
+         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R0, TCG_REG_TMP1, ofs);
+         tcg_out32(s, MTSPR | RA(TCG_REG_R0) | CTR);
+         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_REG_TMP1, ofs + SZP);
+-        tcg_out32(s, BCCTR | BO_ALWAYS | LK);
++        tcg_out32(s, BCCTR | BO_ALWAYS | lk);
+     }
+ #elif defined(_CALL_ELF) && _CALL_ELF == 2
+     intptr_t diff;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
+     diff = tcg_pcrel_diff(s, target);
+     if (in_range_b(diff)) {
+-        tcg_out_b(s, LK, target);
++        tcg_out_b(s, lk, target);
+     } else {
+         tcg_out32(s, MTSPR | RS(TCG_REG_R12) | CTR);
+-        tcg_out32(s, BCCTR | BO_ALWAYS | LK);
++        tcg_out32(s, BCCTR | BO_ALWAYS | lk);
+     }
+ #else
+-    tcg_out_b(s, LK, target);
++    tcg_out_b(s, lk, target);
+ #endif
+ }
++static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
++{
++    tcg_out_call_int(s, LK, target);
++}
++
+ static const uint32_t qemu_ldx_opc[(MO_SSIZE + MO_BSWAP) + 1] = {
+     [MO_UB] = LBZX,
+     [MO_UW] = LHZX,
+@@ -XXX,XX +XXX,XX @@ static const uint32_t qemu_exts_opc[4] = {
+ };
+ #if defined (CONFIG_SOFTMMU)
+-#include "../tcg-ldst.c.inc"
+-
+ /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
+  *                                 int mmu_idx, uintptr_t ra)
+  */
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     tcg_out_b(s, 0, lb->raddr);
+     return true;
+ }
++#else
++
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
++                                   TCGReg addrhi, unsigned a_bits)
++{
++    unsigned a_mask = (1 << a_bits) - 1;
++    TCGLabelQemuLdst *label = new_ldst_label(s);
++
++    label->is_ld = is_ld;
++    label->addrlo_reg = addrlo;
++    label->addrhi_reg = addrhi;
++
++    /* We are expecting a_bits to max out at 7, much lower than ANDI. */
++    tcg_debug_assert(a_bits < 16);
++    tcg_out32(s, ANDI | SAI(addrlo, TCG_REG_R0, a_mask));
++
++    label->label_ptr[0] = s->code_ptr;
++    tcg_out32(s, BC | BI(0, CR_EQ) | BO_COND_FALSE | LK);
++
++    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    if (!reloc_pc14(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
++        return false;
++    }
++
++    if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
++        TCGReg arg = TCG_REG_R4;
++#ifdef TCG_TARGET_CALL_ALIGN_ARGS
++        arg |= 1;
++#endif
++        if (l->addrlo_reg != arg) {
++            tcg_out_mov(s, TCG_TYPE_I32, arg, l->addrhi_reg);
++            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, l->addrlo_reg);
++        } else if (l->addrhi_reg != arg + 1) {
++            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, l->addrlo_reg);
++            tcg_out_mov(s, TCG_TYPE_I32, arg, l->addrhi_reg);
++        } else {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R0, arg);
++            tcg_out_mov(s, TCG_TYPE_I32, arg, arg + 1);
++            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, TCG_REG_R0);
++        }
++    } else {
++        tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R4, l->addrlo_reg);
++    }
++    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R3, TCG_AREG0);
++
++    /* "Tail call" to the helper, with the return address back inline. */
++    tcg_out_call_int(s, 0, (const void *)(l->is_ld ? helper_unaligned_ld
++                                          : helper_unaligned_st));
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
+ #endif /* SOFTMMU */
+ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+ #ifdef CONFIG_SOFTMMU
+     int mem_index;
+     tcg_insn_unit *label_ptr;
++#else
++    unsigned a_bits;
+ #endif
+     datalo = *args++;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+     rbase = TCG_REG_R3;
+ #else  /* !CONFIG_SOFTMMU */
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
++    }
+     rbase = guest_base ? TCG_GUEST_BASE_REG : 0;
+     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+         tcg_out_ext32u(s, TCG_REG_TMP1, addrlo);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+ #ifdef CONFIG_SOFTMMU
+     int mem_index;
+     tcg_insn_unit *label_ptr;
++#else
++    unsigned a_bits;
+ #endif
+     datalo = *args++;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+     rbase = TCG_REG_R3;
+ #else  /* !CONFIG_SOFTMMU */
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
++    }
+     rbase = guest_base ? TCG_GUEST_BASE_REG : 0;
+     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+         tcg_out_ext32u(s, TCG_REG_TMP1, addrlo);
+--
+.25.1

-New patch
+[PULL 13/34] tcg/riscv: Support raising sigbus for user-only
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/riscv/tcg-target.h     |  2 --
+ tcg/riscv/tcg-target.c.inc | 63 ++++++++++++++++++++++++++++++++++++--
+files changed, 61 insertions(+), 4 deletions(-)
+diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/riscv/tcg-target.h
++++ b/tcg/riscv/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+ #define TCG_TARGET_DEFAULT_MO (0)
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_NEED_POOL_LABELS
+ #define TCG_TARGET_HAS_MEMORY_BSWAP 0
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/riscv/tcg-target.c.inc
++++ b/tcg/riscv/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+  * THE SOFTWARE.
+  */
++#include "../tcg-ldst.c.inc"
+ #include "../tcg-pool.c.inc"
+ #ifdef CONFIG_DEBUG_TCG
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
+  */
+ #if defined(CONFIG_SOFTMMU)
+-#include "../tcg-ldst.c.inc"
+-
+ /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
+  *                                     MemOpIdx oi, uintptr_t ra)
+  */
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+     tcg_out_goto(s, l->raddr);
+     return true;
+ }
++#else
++
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
++                                   unsigned a_bits)
++{
++    unsigned a_mask = (1 << a_bits) - 1;
++    TCGLabelQemuLdst *l = new_ldst_label(s);
++
++    l->is_ld = is_ld;
++    l->addrlo_reg = addr_reg;
++
++    /* We are expecting a_bits to max out at 7, so we can always use andi. */
++    tcg_debug_assert(a_bits < 12);
++    tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_TMP1, addr_reg, a_mask);
++
++    l->label_ptr[0] = s->code_ptr;
++    tcg_out_opc_branch(s, OPC_BNE, TCG_REG_TMP1, TCG_REG_ZERO, 0);
++
++    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    /* resolve label address */
++    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
++        return false;
++    }
++
++    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
++    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
++
++    /* tail call, with the return address back inline. */
++    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RA, (uintptr_t)l->raddr);
++    tcg_out_call_int(s, (const void *)(l->is_ld ? helper_unaligned_ld
++                                       : helper_unaligned_st), true);
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
+ #endif /* CONFIG_SOFTMMU */
+ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[1];
++#else
++    unsigned a_bits;
+ #endif
+     TCGReg base = TCG_REG_TMP0;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+         tcg_out_ext32u(s, base, addr_regl);
+         addr_regl = base;
+     }
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, true, addr_regl, a_bits);
++    }
+     if (guest_base != 0) {
+         tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
+     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[1];
++#else
++    unsigned a_bits;
+ #endif
+     TCGReg base = TCG_REG_TMP0;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+         tcg_out_ext32u(s, base, addr_regl);
+         addr_regl = base;
+     }
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, false, addr_regl, a_bits);
++    }
+     if (guest_base != 0) {
+         tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
+     }
+--
+.25.1

-New patch
+[PULL 14/34] tcg/s390x: Support raising sigbus for user-only
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/s390x/tcg-target.h     |  2 --
+ tcg/s390x/tcg-target.c.inc | 59 ++++++++++++++++++++++++++++++++++++--
+files changed, 57 insertions(+), 4 deletions(-)
+diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.h
++++ b/tcg/s390x/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ static inline void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
+     /* no need to flush icache explicitly */
+ }
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_NEED_POOL_LABELS
+ #endif
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.c.inc
++++ b/tcg/s390x/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+ #error "unsupported code generation mode"
+ #endif
++#include "../tcg-ldst.c.inc"
+ #include "../tcg-pool.c.inc"
+ #include "elf.h"
+@@ -XXX,XX +XXX,XX @@ typedef enum S390Opcode {
+     RI_OIHL     = 0xa509,
+     RI_OILH     = 0xa50a,
+     RI_OILL     = 0xa50b,
++    RI_TMLL     = 0xa701,
+     RIE_CGIJ    = 0xec7c,
+     RIE_CGRJ    = 0xec64,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
+ }
+ #if defined(CONFIG_SOFTMMU)
+-#include "../tcg-ldst.c.inc"
+-
+ /* We're expecting to use a 20-bit negative offset on the tlb memory ops.  */
+ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) > 0);
+ QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 19));
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     return true;
+ }
+ #else
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld,
++                                   TCGReg addrlo, unsigned a_bits)
++{
++    unsigned a_mask = (1 << a_bits) - 1;
++    TCGLabelQemuLdst *l = new_ldst_label(s);
++
++    l->is_ld = is_ld;
++    l->addrlo_reg = addrlo;
++
++    /* We are expecting a_bits to max out at 7, much lower than TMLL. */
++    tcg_debug_assert(a_bits < 16);
++    tcg_out_insn(s, RI, TMLL, addrlo, a_mask);
++
++    tcg_out16(s, RI_BRC | (7 << 4)); /* CC in {1,2,3} */
++    l->label_ptr[0] = s->code_ptr;
++    s->code_ptr += 1;
++
++    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    if (!patch_reloc(l->label_ptr[0], R_390_PC16DBL,
++                     (intptr_t)tcg_splitwx_to_rx(s->code_ptr), 2)) {
++        return false;
++    }
++
++    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R3, l->addrlo_reg);
++    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
++
++    /* "Tail call" to the helper, with the return address back inline. */
++    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R14, (uintptr_t)l->raddr);
++    tgen_gotoi(s, S390_CC_ALWAYS, (const void *)(l->is_ld ? helper_unaligned_ld
++                                                 : helper_unaligned_st));
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
+ static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
+                                   TCGReg *index_reg, tcg_target_long *disp)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
+ #else
+     TCGReg index_reg;
+     tcg_target_long disp;
++    unsigned a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, true, addr_reg, a_bits);
++    }
+     tcg_prepare_user_ldst(s, &addr_reg, &index_reg, &disp);
+     tcg_out_qemu_ld_direct(s, opc, data_reg, addr_reg, index_reg, disp);
+ #endif
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
+ #else
+     TCGReg index_reg;
+     tcg_target_long disp;
++    unsigned a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, false, addr_reg, a_bits);
++    }
+     tcg_prepare_user_ldst(s, &addr_reg, &index_reg, &disp);
+     tcg_out_qemu_st_direct(s, opc, data_reg, addr_reg, index_reg, disp);
+ #endif
+--
+.25.1

-New patch
+[PULL 15/34] tcg/tci: Support raising sigbus for user-only
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/tci.c | 20 ++++++++++++++------
+file changed, 14 insertions(+), 6 deletions(-)
+diff --git a/tcg/tci.c b/tcg/tci.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/tci.c
++++ b/tcg/tci.c
+@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+                             MemOpIdx oi, const void *tb_ptr)
+ {
+-    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
++    MemOp mop = get_memop(oi);
+     uintptr_t ra = (uintptr_t)tb_ptr;
+ #ifdef CONFIG_SOFTMMU
+-    switch (mop) {
++    switch (mop & (MO_BSWAP | MO_SSIZE)) {
+     case MO_UB:
+         return helper_ret_ldub_mmu(env, taddr, oi, ra);
+     case MO_SB:
+@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+     }
+ #else
+     void *haddr = g2h(env_cpu(env), taddr);
++    unsigned a_mask = (1u << get_alignment_bits(mop)) - 1;
+     uint64_t ret;
+     set_helper_retaddr(ra);
+-    switch (mop) {
++    if (taddr & a_mask) {
++        helper_unaligned_ld(env, taddr);
++    }
++    switch (mop & (MO_BSWAP | MO_SSIZE)) {
+     case MO_UB:
+         ret = ldub_p(haddr);
+         break;
+@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
+ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+                         MemOpIdx oi, const void *tb_ptr)
+ {
+-    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
++    MemOp mop = get_memop(oi);
+     uintptr_t ra = (uintptr_t)tb_ptr;
+ #ifdef CONFIG_SOFTMMU
+-    switch (mop) {
++    switch (mop & (MO_BSWAP | MO_SIZE)) {
+     case MO_UB:
+         helper_ret_stb_mmu(env, taddr, val, oi, ra);
+         break;
+@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
+     }
+ #else
+     void *haddr = g2h(env_cpu(env), taddr);
++    unsigned a_mask = (1u << get_alignment_bits(mop)) - 1;
+     set_helper_retaddr(ra);
+-    switch (mop) {
++    if (taddr & a_mask) {
++        helper_unaligned_st(env, taddr);
++    }
++    switch (mop & (MO_BSWAP | MO_SIZE)) {
+     case MO_UB:
+         stb_p(haddr, val);
+         break;
+--
+.25.1

-New patch
+[PULL 16/34] tcg/loongarch64: Support raising sigbus for user-only
+From: WANG Xuerui <git@xen0n.name>
+Signed-off-by: WANG Xuerui <git@xen0n.name>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20220106134238.3936163-1-git@xen0n.name>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/loongarch64/tcg-target.h     |  2 -
+ tcg/loongarch64/tcg-target.c.inc | 71 +++++++++++++++++++++++++++++++-
+files changed, 69 insertions(+), 4 deletions(-)
+diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/loongarch64/tcg-target.h
++++ b/tcg/loongarch64/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+ #define TCG_TARGET_DEFAULT_MO (0)
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_HAS_MEMORY_BSWAP 0
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/loongarch64/tcg-target.c.inc
++++ b/tcg/loongarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+  * THE SOFTWARE.
+  */
++#include "../tcg-ldst.c.inc"
++
+ #ifdef CONFIG_DEBUG_TCG
+ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+     "zero",
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
+  */
+ #if defined(CONFIG_SOFTMMU)
+-#include "../tcg-ldst.c.inc"
+-
+ /*
+  * helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
+  *                                     MemOpIdx oi, uintptr_t ra)
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+     return tcg_out_goto(s, l->raddr);
+ }
++#else
++
++/*
++ * Alignment helpers for user-mode emulation
++ */
++
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
++                                   unsigned a_bits)
++{
++    TCGLabelQemuLdst *l = new_ldst_label(s);
++
++    l->is_ld = is_ld;
++    l->addrlo_reg = addr_reg;
++
++    /*
++     * Without micro-architecture details, we don't know which of bstrpick or
++     * andi is faster, so use bstrpick as it's not constrained by imm field
++     * width. (Not to say alignments >= 2^12 are going to happen any time
++     * soon, though)
++     */
++    tcg_out_opc_bstrpick_d(s, TCG_REG_TMP1, addr_reg, 0, a_bits - 1);
++
++    l->label_ptr[0] = s->code_ptr;
++    tcg_out_opc_bne(s, TCG_REG_TMP1, TCG_REG_ZERO, 0);
++
++    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    /* resolve label address */
++    if (!reloc_br_sk16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
++        return false;
++    }
++
++    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
++    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
++
++    /* tail call, with the return address back inline. */
++    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RA, (uintptr_t)l->raddr);
++    tcg_out_call_int(s, (const void *)(l->is_ld ? helper_unaligned_ld
++                                       : helper_unaligned_st), true);
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
+ #endif /* CONFIG_SOFTMMU */
+ /*
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[1];
++#else
++    unsigned a_bits;
+ #endif
+     TCGReg base;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
+                         data_regl, addr_regl,
+                         s->code_ptr, label_ptr);
+ #else
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, true, addr_regl, a_bits);
++    }
+     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
+     TCGReg guest_base_reg = USE_GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_ZERO;
+     tcg_out_qemu_ld_indexed(s, data_regl, base, guest_base_reg, opc, type);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[1];
++#else
++    unsigned a_bits;
+ #endif
+     TCGReg base;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
+                         data_regl, addr_regl,
+                         s->code_ptr, label_ptr);
+ #else
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, false, addr_regl, a_bits);
++    }
+     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
+     TCGReg guest_base_reg = USE_GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_ZERO;
+     tcg_out_qemu_st_indexed(s, data_regl, base, guest_base_reg, opc);
+--
+.25.1

-New patch
+[PULL 17/34] tcg/arm: Drop support for armv4 and armv5 hosts
+Support for unaligned accesses is difficult for pre-v6 hosts.
+While debian still builds for armv4, we cannot use a compile
+time test, so test the architecture at runtime and error out.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.c.inc | 5 +++++
+file changed, 5 insertions(+)
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
+         if (pl != NULL && pl[0] == 'v' && pl[1] >= '4' && pl[1] <= '9') {
+             arm_arch = pl[1] - '0';
+         }
++
++        if (arm_arch < 6) {
++            error_report("TCG: ARMv%d is unsupported; exiting", arm_arch);
++            exit(EXIT_FAILURE);
++        }
+     }
+     tcg_target_available_regs[TCG_TYPE_I32] = ALL_GENERAL_REGS;
+--
+.25.1

-New patch
+[PULL 18/34] tcg/arm: Remove use_armv5t_instructions
+This is now always true, since we require armv6.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.h     |  3 +--
+ tcg/arm/tcg-target.c.inc | 35 ++++++-----------------------------
+files changed, 7 insertions(+), 31 deletions(-)
+diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.h
++++ b/tcg/arm/tcg-target.h
+@@ -XXX,XX +XXX,XX @@
+ extern int arm_arch;
+-#define use_armv5t_instructions (__ARM_ARCH >= 5 || arm_arch >= 5)
+ #define use_armv6_instructions  (__ARM_ARCH >= 6 || arm_arch >= 6)
+ #define use_armv7_instructions  (__ARM_ARCH >= 7 || arm_arch >= 7)
+@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
+ #define TCG_TARGET_HAS_eqv_i32          0
+ #define TCG_TARGET_HAS_nand_i32         0
+ #define TCG_TARGET_HAS_nor_i32          0
+-#define TCG_TARGET_HAS_clz_i32          use_armv5t_instructions
++#define TCG_TARGET_HAS_clz_i32          1
+ #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
+ #define TCG_TARGET_HAS_ctpop_i32        0
+ #define TCG_TARGET_HAS_deposit_i32      use_armv7_instructions
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_b_reg(TCGContext *s, ARMCond cond, TCGReg rn)
+      * Unless the C portion of QEMU is compiled as thumb, we don't need
+      * true BX semantics; merely a branch to an address held in a register.
+      */
+-    if (use_armv5t_instructions) {
+-        tcg_out_bx_reg(s, cond, rn);
+-    } else {
+-        tcg_out_mov_reg(s, cond, TCG_REG_PC, rn);
+-    }
++    tcg_out_bx_reg(s, cond, rn);
+ }
+ static void tcg_out_dat_imm(TCGContext *s, ARMCond cond, ARMInsn opc,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_goto(TCGContext *s, ARMCond cond, const tcg_insn_unit *addr)
+     }
+     /* LDR is interworking from v5t. */
+-    if (arm_mode || use_armv5t_instructions) {
+-        tcg_out_movi_pool(s, cond, TCG_REG_PC, addri);
+-        return;
+-    }
+-
+-    /* else v4t */
+-    tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
+-    tcg_out_bx_reg(s, COND_AL, TCG_REG_TMP);
++    tcg_out_movi_pool(s, cond, TCG_REG_PC, addri);
+ }
+ /*
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *addr)
+     if (disp - 8 < 0x02000000 && disp - 8 >= -0x02000000) {
+         if (arm_mode) {
+             tcg_out_bl_imm(s, COND_AL, disp);
+-            return;
+-        }
+-        if (use_armv5t_instructions) {
++        } else {
+             tcg_out_blx_imm(s, disp);
+-            return;
+         }
++        return;
+     }
+-    if (use_armv5t_instructions) {
+-        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
+-        tcg_out_blx_reg(s, COND_AL, TCG_REG_TMP);
+-    } else if (arm_mode) {
+-        /* ??? Know that movi_pool emits exactly 1 insn.  */
+-        tcg_out_mov_reg(s, COND_AL, TCG_REG_R14, TCG_REG_PC);
+-        tcg_out_movi_pool(s, COND_AL, TCG_REG_PC, addri);
+-    } else {
+-        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
+-        tcg_out_mov_reg(s, COND_AL, TCG_REG_R14, TCG_REG_PC);
+-        tcg_out_bx_reg(s, COND_AL, TCG_REG_TMP);
+-    }
++    tcg_out_movi32(s, COND_AL, TCG_REG_TMP, addri);
++    tcg_out_blx_reg(s, COND_AL, TCG_REG_TMP);
+ }
+ static void tcg_out_goto_label(TCGContext *s, ARMCond cond, TCGLabel *l)
+--
+.25.1

-New patch
+[PULL 19/34] tcg/arm: Remove use_armv6_instructions
+This is now always true, since we require armv6.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.h     |   1 -
+ tcg/arm/tcg-target.c.inc | 192 ++++++---------------------------------
+files changed, 27 insertions(+), 166 deletions(-)
+diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.h
++++ b/tcg/arm/tcg-target.h
+@@ -XXX,XX +XXX,XX @@
+ extern int arm_arch;
+-#define use_armv6_instructions  (__ARM_ARCH >= 6 || arm_arch >= 6)
+ #define use_armv7_instructions  (__ARM_ARCH >= 7 || arm_arch >= 7)
+ #undef TCG_TARGET_STACK_GROWSUP
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
+ static void tcg_out_mul32(TCGContext *s, ARMCond cond, TCGReg rd,
+                           TCGReg rn, TCGReg rm)
+ {
+-    /* if ArchVersion() < 6 && d == n then UNPREDICTABLE;  */
+-    if (!use_armv6_instructions && rd == rn) {
+-        if (rd == rm) {
+-            /* rd == rn == rm; copy an input to tmp first.  */
+-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
+-            rm = rn = TCG_REG_TMP;
+-        } else {
+-            rn = rm;
+-            rm = rd;
+-        }
+-    }
+     /* mul */
+     tcg_out32(s, (cond << 28) | 0x90 | (rd << 16) | (rm << 8) | rn);
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mul32(TCGContext *s, ARMCond cond, TCGReg rd,
+ static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
+                             TCGReg rd1, TCGReg rn, TCGReg rm)
+ {
+-    /* if ArchVersion() < 6 && (dHi == n || dLo == n) then UNPREDICTABLE;  */
+-    if (!use_armv6_instructions && (rd0 == rn || rd1 == rn)) {
+-        if (rd0 == rm || rd1 == rm) {
+-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
+-            rn = TCG_REG_TMP;
+-        } else {
+-            TCGReg t = rn;
+-            rn = rm;
+-            rm = t;
+-        }
+-    }
+     /* umull */
+     tcg_out32(s, (cond << 28) | 0x00800090 |
+               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
+ static void tcg_out_smull32(TCGContext *s, ARMCond cond, TCGReg rd0,
+                             TCGReg rd1, TCGReg rn, TCGReg rm)
+ {
+-    /* if ArchVersion() < 6 && (dHi == n || dLo == n) then UNPREDICTABLE;  */
+-    if (!use_armv6_instructions && (rd0 == rn || rd1 == rn)) {
+-        if (rd0 == rm || rd1 == rm) {
+-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
+-            rn = TCG_REG_TMP;
+-        } else {
+-            TCGReg t = rn;
+-            rn = rm;
+-            rm = t;
+-        }
+-    }
+     /* smull */
+     tcg_out32(s, (cond << 28) | 0x00c00090 |
+               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_udiv(TCGContext *s, ARMCond cond,
+ static void tcg_out_ext8s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ {
+-    if (use_armv6_instructions) {
+-        /* sxtb */
+-        tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
+-    } else {
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rn, SHIFT_IMM_LSL(24));
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rd, SHIFT_IMM_ASR(24));
+-    }
++    /* sxtb */
++    tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
+ }
+ static void __attribute__((unused))
+@@ -XXX,XX +XXX,XX @@ tcg_out_ext8u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ static void tcg_out_ext16s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ {
+-    if (use_armv6_instructions) {
+-        /* sxth */
+-        tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
+-    } else {
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rn, SHIFT_IMM_LSL(16));
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rd, SHIFT_IMM_ASR(16));
+-    }
++    /* sxth */
++    tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
+ }
+ static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ {
+-    if (use_armv6_instructions) {
+-        /* uxth */
+-        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
+-    } else {
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rn, SHIFT_IMM_LSL(16));
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rd, SHIFT_IMM_LSR(16));
+-    }
++    /* uxth */
++    tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
+ }
+ static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
+                             TCGReg rd, TCGReg rn, int flags)
+ {
+-    if (use_armv6_instructions) {
+-        if (flags & TCG_BSWAP_OS) {
+-            /* revsh */
+-            tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
+-            return;
+-        }
+-
+-        /* rev16 */
+-        tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
+-        if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+-            /* uxth */
+-            tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
+-        }
++    if (flags & TCG_BSWAP_OS) {
++        /* revsh */
++        tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
+         return;
+     }
+-    if (flags == 0) {
+-        /*
+-         * For stores, no input or output extension:
+-         *                              rn  = xxAB
+-         * lsr tmp, rn, #8              tmp = 0xxA
+-         * and tmp, tmp, #0xff          tmp = 000A
+-         * orr rd, tmp, rn, lsl #8      rd  = xABA
+-         */
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSR(8));
+-        tcg_out_dat_imm(s, cond, ARITH_AND, TCG_REG_TMP, TCG_REG_TMP, 0xff);
+-        tcg_out_dat_reg(s, cond, ARITH_ORR,
+-                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSL(8));
+-        return;
++    /* rev16 */
++    tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
++    if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
++        /* uxth */
++        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
+     }
+-
+-    /*
+-     * Byte swap, leaving the result at the top of the register.
+-     * We will then shift down, zero or sign-extending.
+-     */
+-    if (flags & TCG_BSWAP_IZ) {
+-        /*
+-         *                              rn  = 00AB
+-         * ror tmp, rn, #8              tmp = B00A
+-         * orr tmp, tmp, tmp, lsl #16   tmp = BA00
+-         */
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_ROR(8));
+-        tcg_out_dat_reg(s, cond, ARITH_ORR,
+-                        TCG_REG_TMP, TCG_REG_TMP, TCG_REG_TMP,
+-                        SHIFT_IMM_LSL(16));
+-    } else {
+-        /*
+-         *                              rn  = xxAB
+-         * and tmp, rn, #0xff00         tmp = 00A0
+-         * lsl tmp, tmp, #8             tmp = 0A00
+-         * orr tmp, tmp, rn, lsl #24    tmp = BA00
+-         */
+-        tcg_out_dat_rI(s, cond, ARITH_AND, TCG_REG_TMP, rn, 0xff00, 1);
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSL(8));
+-        tcg_out_dat_reg(s, cond, ARITH_ORR,
+-                        TCG_REG_TMP, TCG_REG_TMP, rn, SHIFT_IMM_LSL(24));
+-    }
+-    tcg_out_dat_reg(s, cond, ARITH_MOV, rd, 0, TCG_REG_TMP,
+-                    (flags & TCG_BSWAP_OS
+-                     ? SHIFT_IMM_ASR(8) : SHIFT_IMM_LSR(8)));
+ }
+ static void tcg_out_bswap32(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
+ {
+-    if (use_armv6_instructions) {
+-        /* rev */
+-        tcg_out32(s, 0x06bf0f30 | (cond << 28) | (rd << 12) | rn);
+-    } else {
+-        tcg_out_dat_reg(s, cond, ARITH_EOR,
+-                        TCG_REG_TMP, rn, rn, SHIFT_IMM_ROR(16));
+-        tcg_out_dat_imm(s, cond, ARITH_BIC,
+-                        TCG_REG_TMP, TCG_REG_TMP, 0xff | 0x800);
+-        tcg_out_dat_reg(s, cond, ARITH_MOV,
+-                        rd, 0, rn, SHIFT_IMM_ROR(8));
+-        tcg_out_dat_reg(s, cond, ARITH_EOR,
+-                        rd, rd, TCG_REG_TMP, SHIFT_IMM_LSR(8));
+-    }
++    /* rev */
++    tcg_out32(s, 0x06bf0f30 | (cond << 28) | (rd << 12) | rn);
+ }
+ static void tcg_out_deposit(TCGContext *s, ARMCond cond, TCGReg rd,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
+ {
+     if (use_armv7_instructions) {
+         tcg_out32(s, INSN_DMB_ISH);
+-    } else if (use_armv6_instructions) {
++    } else {
+         tcg_out32(s, INSN_DMB_MCR);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_arg_reg64(TCGContext *s, TCGReg argreg,
+     if (argreg & 1) {
+         argreg++;
+     }
+-    if (use_armv6_instructions && argreg >= 4
+-        && (arglo & 1) == 0 && arghi == arglo + 1) {
++    if (argreg >= 4 && (arglo & 1) == 0 && arghi == arglo + 1) {
+         tcg_out_strd_8(s, COND_AL, arglo,
+                        TCG_REG_CALL_STACK, (argreg - 4) * 4);
+         return argreg + 2;
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
+                    : offsetof(CPUTLBEntry, addr_write));
+     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
+-    int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
+-    int table_off = fast_off + offsetof(CPUTLBDescFast, table);
+     unsigned s_bits = opc & MO_SIZE;
+     unsigned a_bits = get_alignment_bits(opc);
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+     }
+     /* Load env_tlb(env)->f[mmu_idx].{mask,table} into {r0,r1}.  */
+-    if (use_armv6_instructions) {
+-        tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
+-    } else {
+-        tcg_out_ld(s, TCG_TYPE_I32, TCG_REG_R0, TCG_AREG0, mask_off);
+-        tcg_out_ld(s, TCG_TYPE_I32, TCG_REG_R1, TCG_AREG0, table_off);
+-    }
++    tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
+     /* Extract the tlb index from the address into R0.  */
+     tcg_out_dat_reg(s, COND_AL, ARITH_AND, TCG_REG_R0, TCG_REG_R0, addrlo,
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+      * Load the tlb comparator into R2/R3 and the fast path addend into R1.
+      */
+     if (cmp_off == 0) {
+-        if (use_armv6_instructions && TARGET_LONG_BITS == 64) {
++        if (TARGET_LONG_BITS == 64) {
+             tcg_out_ldrd_rwb(s, COND_AL, TCG_REG_R2, TCG_REG_R1, TCG_REG_R0);
+         } else {
+             tcg_out_ld32_rwb(s, COND_AL, TCG_REG_R2, TCG_REG_R1, TCG_REG_R0);
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+     } else {
+         tcg_out_dat_reg(s, COND_AL, ARITH_ADD,
+                         TCG_REG_R1, TCG_REG_R1, TCG_REG_R0, 0);
+-        if (use_armv6_instructions && TARGET_LONG_BITS == 64) {
++        if (TARGET_LONG_BITS == 64) {
+             tcg_out_ldrd_8(s, COND_AL, TCG_REG_R2, TCG_REG_R1, cmp_off);
+         } else {
+             tcg_out_ld32_12(s, COND_AL, TCG_REG_R2, TCG_REG_R1, cmp_off);
+         }
+     }
+-    if (!use_armv6_instructions && TARGET_LONG_BITS == 64) {
+-        tcg_out_ld32_12(s, COND_AL, TCG_REG_R3, TCG_REG_R1, cmp_off + 4);
+-    }
+     /* Load the tlb addend.  */
+     tcg_out_ld32_12(s, COND_AL, TCG_REG_R1, TCG_REG_R1,
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     TCGReg argreg, datalo, datahi;
+     MemOpIdx oi = lb->oi;
+     MemOp opc = get_memop(oi);
+-    void *func;
+     if (!reloc_pc24(lb->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+         return false;
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     argreg = tcg_out_arg_imm32(s, argreg, oi);
+     argreg = tcg_out_arg_reg32(s, argreg, TCG_REG_R14);
+-    /* For armv6 we can use the canonical unsigned helpers and minimize
+-       icache usage.  For pre-armv6, use the signed helpers since we do
+-       not have a single insn sign-extend.  */
+-    if (use_armv6_instructions) {
+-        func = qemu_ld_helpers[opc & MO_SIZE];
+-    } else {
+-        func = qemu_ld_helpers[opc & MO_SSIZE];
+-        if (opc & MO_SIGN) {
+-            opc = MO_UL;
+-        }
+-    }
+-    tcg_out_call(s, func);
++    /* Use the canonical unsigned helpers and minimize icache usage. */
++    tcg_out_call(s, qemu_ld_helpers[opc & MO_SIZE]);
+     datalo = lb->datalo_reg;
+     datahi = lb->datahi_reg;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
+         break;
+     case MO_UQ:
+         /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU && use_armv6_instructions
++        if (USING_SOFTMMU
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
+         } else if (datalo != addend) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
+         break;
+     case MO_UQ:
+         /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU && use_armv6_instructions
++        if (USING_SOFTMMU
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
+         } else if (datalo == addrlo) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
+         break;
+     case MO_64:
+         /* Avoid strd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU && use_armv6_instructions
++        if (USING_SOFTMMU
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
+         } else {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
+         break;
+     case MO_64:
+         /* Avoid strd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU && use_armv6_instructions
++        if (USING_SOFTMMU
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
+         } else {
+--
+.25.1

-New patch
+[PULL 20/34] tcg/arm: Check alignment for ldrd and strd
+We will shortly allow the use of unaligned memory accesses,
+and these require proper alignment.  Use get_alignment_bits
+to verify and remove USING_SOFTMMU.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.c.inc | 23 ++++++++---------------
+file changed, 8 insertions(+), 15 deletions(-)
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ bool use_idiv_instructions;
+ bool use_neon_instructions;
+ #endif
+-/* ??? Ought to think about changing CONFIG_SOFTMMU to always defined.  */
+-#ifdef CONFIG_SOFTMMU
+-# define USING_SOFTMMU 1
+-#else
+-# define USING_SOFTMMU 0
+-#endif
+-
+ #ifdef CONFIG_DEBUG_TCG
+ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+     "%r0",  "%r1",  "%r2",  "%r3",  "%r4",  "%r5",  "%r6",  "%r7",
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
+         tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
+         break;
+     case MO_UQ:
+-        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU
++        /* LDRD requires alignment; double-check that. */
++        if (get_alignment_bits(opc) >= MO_64
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
+         } else if (datalo != addend) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
+         tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
+         break;
+     case MO_UQ:
+-        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU
++        /* LDRD requires alignment; double-check that. */
++        if (get_alignment_bits(opc) >= MO_64
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
+         } else if (datalo == addrlo) {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
+         tcg_out_st32_r(s, cond, datalo, addrlo, addend);
+         break;
+     case MO_64:
+-        /* Avoid strd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU
++        /* STRD requires alignment; double-check that. */
++        if (get_alignment_bits(opc) >= MO_64
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
+         } else {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
+         tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
+         break;
+     case MO_64:
+-        /* Avoid strd for user-only emulation, to handle unaligned.  */
+-        if (USING_SOFTMMU
++        /* STRD requires alignment; double-check that. */
++        if (get_alignment_bits(opc) >= MO_64
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
+             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
+         } else {
+--
+.25.1

-New patch
+[PULL 21/34] tcg/arm: Support unaligned access for softmmu
+From armv6, the architecture supports unaligned accesses.
+All we need to do is perform the correct alignment check
+in tcg_out_tlb_read.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.c.inc | 41 ++++++++++++++++++++--------------------
+file changed, 21 insertions(+), 20 deletions(-)
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
+                    : offsetof(CPUTLBEntry, addr_write));
+     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
+-    unsigned s_bits = opc & MO_SIZE;
+-    unsigned a_bits = get_alignment_bits(opc);
+-
+-    /*
+-     * We don't support inline unaligned acceses, but we can easily
+-     * support overalignment checks.
+-     */
+-    if (a_bits < s_bits) {
+-        a_bits = s_bits;
+-    }
++    unsigned s_mask = (1 << (opc & MO_SIZE)) - 1;
++    unsigned a_mask = (1 << get_alignment_bits(opc)) - 1;
++    TCGReg t_addr;
+     /* Load env_tlb(env)->f[mmu_idx].{mask,table} into {r0,r1}.  */
+     tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
+@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
+     /*
+      * Check alignment, check comparators.
+-     * Do this in no more than 3 insns.  Use MOVW for v7, if possible,
++     * Do this in 2-4 insns.  Use MOVW for v7, if possible,
+      * to reduce the number of sequential conditional instructions.
+      * Almost all guests have at least 4k pages, which means that we need
+      * to clear at least 9 bits even for an 8-byte memory, which means it
+      * isn't worth checking for an immediate operand for BIC.
++     *
++     * For unaligned accesses, test the page of the last unit of alignment.
++     * This leaves the least significant alignment bits unchanged, and of
++     * course must be zero.
+      */
++    t_addr = addrlo;
++    if (a_mask < s_mask) {
++        t_addr = TCG_REG_R0;
++        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, t_addr,
++                        addrlo, s_mask - a_mask);
++    }
+     if (use_armv7_instructions && TARGET_PAGE_BITS <= 16) {
+-        tcg_target_ulong mask = ~(TARGET_PAGE_MASK | ((1 << a_bits) - 1));
+-
+-        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, mask);
++        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, ~(TARGET_PAGE_MASK | a_mask));
+         tcg_out_dat_reg(s, COND_AL, ARITH_BIC, TCG_REG_TMP,
+-                        addrlo, TCG_REG_TMP, 0);
++                        t_addr, TCG_REG_TMP, 0);
+         tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0, TCG_REG_R2, TCG_REG_TMP, 0);
+     } else {
+-        if (a_bits) {
+-            tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo,
+-                            (1 << a_bits) - 1);
++        if (a_mask) {
++            tcg_debug_assert(a_mask <= 0xff);
++            tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo, a_mask);
+         }
+-        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0, addrlo,
++        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0, t_addr,
+                         SHIFT_IMM_LSR(TARGET_PAGE_BITS));
+-        tcg_out_dat_reg(s, (a_bits ? COND_EQ : COND_AL), ARITH_CMP,
++        tcg_out_dat_reg(s, (a_mask ? COND_EQ : COND_AL), ARITH_CMP,
+, TCG_REG_R2, TCG_REG_TMP,
+                         SHIFT_IMM_LSL(TARGET_PAGE_BITS));
+     }
+--
+.25.1

-[PULL 04/11] tcg: Remove TCG_CT_REG
+[PULL 22/34] tcg/arm: Reserve a register for guest_base
-This wasn't actually used for anything, really.  All variable
+Reserve a register for the guest_base using aarch64 for reference.
-operands must accept registers, and which are indicated by the
+By doing so, we do not have to recompute it for every memory load.
 set in TCGArgConstraint.regs.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h            |  1 -
+ tcg/arm/tcg-target.c.inc | 39 ++++++++++++++++++++++++++++-----------
- tcg/tcg.c                    | 15 ++++-----------
+file changed, 28 insertions(+), 11 deletions(-)
  tcg/aarch64/tcg-target.c.inc |  3 ---
  tcg/arm/tcg-target.c.inc     |  3 ---
  tcg/i386/tcg-target.c.inc    | 11 -----------
  tcg/mips/tcg-target.c.inc    |  3 ---
  tcg/ppc/tcg-target.c.inc     |  5 -----
  tcg/riscv/tcg-target.c.inc   |  2 --
  tcg/s390/tcg-target.c.inc    |  4 ----
  tcg/sparc/tcg-target.c.inc   |  5 -----
  tcg/tci/tcg-target.c.inc     |  1 -
 files changed, 4 insertions(+), 49 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
-+++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
- #define TCG_CT_ALIAS  0x80
- #define TCG_CT_IALIAS 0x40
- #define TCG_CT_NEWREG 0x20 /* output requires a new register */
--#define TCG_CT_REG    0x01
- #define TCG_CT_CONST  0x02 /* any constant of register size */
- typedef struct TCGArgConstraint {
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
- /* we give more priority to constraints with less registers */
- static int get_constraint_priority(const TCGOpDef *def, int k)
- {
--    const TCGArgConstraint *arg_ct;
-+    const TCGArgConstraint *arg_ct = &def->args_ct[k];
-+    int n;
--    int i, n;
--    arg_ct = &def->args_ct[k];
-     if (arg_ct->ct & TCG_CT_ALIAS) {
-         /* an alias is equivalent to a single register */
-         n = 1;
-     } else {
--        if (!(arg_ct->ct & TCG_CT_REG))
--            return 0;
--        n = 0;
--        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
--            if (tcg_regset_test_reg(arg_ct->regs, i))
--                n++;
--        }
-+        n = ctpop64(arg_ct->regs);
-     }
-     return TCG_TARGET_NB_REGS - n + 1;
- }
-@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
-                         int oarg = *ct_str - '0';
-                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
-                         tcg_debug_assert(oarg < def->nb_oargs);
--                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
-+                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
-                         /* TCG_CT_ALIAS is for the output arguments.
-                            The input is tagged with TCG_CT_IALIAS. */
-                         def->args_ct[i] = def->args_ct[oarg];
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
- {
-     switch (*ct_str++) {
-     case 'r': /* general registers */
--        ct->ct |= TCG_CT_REG;
-         ct->regs |= 0xffffffffu;
-         break;
-     case 'w': /* advsimd registers */
--        ct->ct |= TCG_CT_REG;
-         ct->regs |= 0xffffffff00000000ull;
-         break;
-     case 'l': /* qemu_ld / qemu_st address, data_reg */
--        ct->ct |= TCG_CT_REG;
-         ct->regs = 0xffffffffu;
- #ifdef CONFIG_SOFTMMU
-         /* x0 and x1 will be overwritten when reading the tlb entry,
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[2] = {
-         break;
+ #define TCG_REG_TMP  TCG_REG_R12
-     case 'r':
+ #define TCG_VEC_TMP  TCG_REG_Q15
--        ct->ct |= TCG_CT_REG;
++#ifndef CONFIG_SOFTMMU
-         ct->regs = 0xffff;
++#define TCG_REG_GUEST_BASE  TCG_REG_R11
-         break;
++#endif
-     /* qemu_ld address */
+ typedef enum {
-     case 'l':
+     COND_EQ = 0x0,
--        ct->ct |= TCG_CT_REG;
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
-         ct->regs = 0xffff;
- #ifdef CONFIG_SOFTMMU
+ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
-         /* r0-r2,lr will be overwritten when reading the tlb entry,
+                                   TCGReg datalo, TCGReg datahi,
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+-                                  TCGReg addrlo, TCGReg addend)
++                                  TCGReg addrlo, TCGReg addend,
-     /* qemu_st address & data */
++                                  bool scratch_addend)
      case 's':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
-     switch(*ct_str++) {
+     /* Byte swapping is left to middle-end expansion. */
-     case 'a':
+     tcg_debug_assert((opc & MO_BSWAP) == 0);
--        ct->ct |= TCG_CT_REG;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
-         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
+         if (get_alignment_bits(opc) >= MO_64
-         break;
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
-     case 'b':
+             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
--        ct->ct |= TCG_CT_REG;
+-        } else if (datalo != addend) {
-         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
++        } else if (scratch_addend) {
-         break;
+             tcg_out_ld32_rwb(s, COND_AL, datalo, addend, addrlo);
-     case 'c':
+             tcg_out_ld32_12(s, COND_AL, datahi, addend, 4);
--        ct->ct |= TCG_CT_REG;
+         } else {
-         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
-         break;
+     label_ptr = s->code_ptr;
-     case 'd':
+     tcg_out_bl_imm(s, COND_NE, 0);
--        ct->ct |= TCG_CT_REG;
-         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
+-    tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, addend);
-         break;
++    tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, addend, true);
-     case 'S':
--        ct->ct |= TCG_CT_REG;
+     add_qemu_ldst_label(s, true, oi, datalo, datahi, addrlo, addrhi,
-         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
+                         s->code_ptr, label_ptr);
-         break;
+ #else /* !CONFIG_SOFTMMU */
-     case 'D':
+     if (guest_base) {
--        ct->ct |= TCG_CT_REG;
+-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, guest_base);
-         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
+-        tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, TCG_REG_TMP);
-         break;
++        tcg_out_qemu_ld_index(s, opc, datalo, datahi,
-     case 'q':
++                              addrlo, TCG_REG_GUEST_BASE, false);
-         /* A register that can be used as a byte operand.  */
+     } else {
--        ct->ct |= TCG_CT_REG;
+         tcg_out_qemu_ld_direct(s, opc, datalo, datahi, addrlo);
-         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+     }
-         break;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
-     case 'Q':
-         /* A register with an addressable second byte (e.g. %ah).  */
+ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
--        ct->ct |= TCG_CT_REG;
+                                   TCGReg datalo, TCGReg datahi,
-         ct->regs = 0xf;
+-                                  TCGReg addrlo, TCGReg addend)
-         break;
++                                  TCGReg addrlo, TCGReg addend,
-     case 'r':
++                                  bool scratch_addend)
          /* A general register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          break;
      case 'x':
          /* A vector register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
          tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
-     switch(*ct_str++) {
+     /* Byte swapping is left to middle-end expansion. */
-     case 'r':
+     tcg_debug_assert((opc & MO_BSWAP) == 0);
--        ct->ct |= TCG_CT_REG;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
-         ct->regs = 0xffffffff;
+         if (get_alignment_bits(opc) >= MO_64
-         break;
+             && (datalo & 1) == 0 && datahi == datalo + 1) {
-     case 'L': /* qemu_ld input arg constraint */
+             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
--        ct->ct |= TCG_CT_REG;
+-        } else {
-         ct->regs = 0xffffffff;
++        } else if (scratch_addend) {
-         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
+             tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
- #if defined(CONFIG_SOFTMMU)
+             tcg_out_st32_12(s, cond, datahi, addend, 4);
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
++        } else {
- #endif
++            tcg_out_dat_reg(s, cond, ARITH_ADD, TCG_REG_TMP,
-         break;
++                            addend, addrlo, SHIFT_IMM_LSL(0));
-     case 'S': /* qemu_st constraint */
++            tcg_out_st32_12(s, cond, datalo, TCG_REG_TMP, 0);
--        ct->ct |= TCG_CT_REG;
++            tcg_out_st32_12(s, cond, datahi, TCG_REG_TMP, 4);
-         ct->regs = 0xffffffff;
+         }
          tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'v':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':                  /* all registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'R':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
          tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
+     mem_index = get_mmuidx(oi);
+     addend = tcg_out_tlb_read(s, addrlo, addrhi, opc, mem_index, 0);
+-    tcg_out_qemu_st_index(s, COND_EQ, opc, datalo, datahi, addrlo, addend);
++    tcg_out_qemu_st_index(s, COND_EQ, opc, datalo, datahi,
++                          addrlo, addend, true);
+     /* The conditional call must come last, as we're going to return here.  */
+     label_ptr = s->code_ptr;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
+                         s->code_ptr, label_ptr);
+ #else /* !CONFIG_SOFTMMU */
+     if (guest_base) {
+-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, guest_base);
+-        tcg_out_qemu_st_index(s, COND_AL, opc, datalo,
+-                              datahi, addrlo, TCG_REG_TMP);
++        tcg_out_qemu_st_index(s, COND_AL, opc, datalo, datahi,
++                              addrlo, TCG_REG_GUEST_BASE, false);
+     } else {
+         tcg_out_qemu_st_direct(s, opc, datalo, datahi, addrlo);
+     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
+     tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
++#ifndef CONFIG_SOFTMMU
++    if (guest_base) {
++        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_GUEST_BASE, guest_base);
++        tcg_regset_set_reg(s->reserved_regs, TCG_REG_GUEST_BASE);
++    }
++#endif
++
+     tcg_out_b_reg(s, COND_AL, tcg_target_call_iarg_regs[1]);
+     /*
 --
 .25.1

-New patch
+[PULL 23/34] tcg/arm: Support raising sigbus for user-only
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/arm/tcg-target.h     |  2 -
+ tcg/arm/tcg-target.c.inc | 83 +++++++++++++++++++++++++++++++++++++++-
+files changed, 81 insertions(+), 4 deletions(-)
+diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.h
++++ b/tcg/arm/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
+ /* not defined -- call should be eliminated at compile time */
+ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #define TCG_TARGET_NEED_POOL_LABELS
+ #endif
+diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/arm/tcg-target.c.inc
++++ b/tcg/arm/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "elf.h"
++#include "../tcg-ldst.c.inc"
+ #include "../tcg-pool.c.inc"
+ int arm_arch = __ARM_ARCH;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vldst(TCGContext *s, ARMInsn insn,
+ }
+ #ifdef CONFIG_SOFTMMU
+-#include "../tcg-ldst.c.inc"
+-
+ /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
+  *                                     int mmu_idx, uintptr_t ra)
+  */
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+     tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & MO_SIZE]);
+     return true;
+ }
++#else
++
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
++                                   TCGReg addrhi, unsigned a_bits)
++{
++    unsigned a_mask = (1 << a_bits) - 1;
++    TCGLabelQemuLdst *label = new_ldst_label(s);
++
++    label->is_ld = is_ld;
++    label->addrlo_reg = addrlo;
++    label->addrhi_reg = addrhi;
++
++    /* We are expecting a_bits to max out at 7, and can easily support 8. */
++    tcg_debug_assert(a_mask <= 0xff);
++    /* tst addr, #mask */
++    tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo, a_mask);
++
++    /* blne slow_path */
++    label->label_ptr[0] = s->code_ptr;
++    tcg_out_bl_imm(s, COND_NE, 0);
++
++    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    if (!reloc_pc24(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
++        return false;
++    }
++
++    if (TARGET_LONG_BITS == 64) {
++        /* 64-bit target address is aligned into R2:R3. */
++        if (l->addrhi_reg != TCG_REG_R2) {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, l->addrlo_reg);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, l->addrhi_reg);
++        } else if (l->addrlo_reg != TCG_REG_R3) {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, l->addrhi_reg);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, l->addrlo_reg);
++        } else {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R1, TCG_REG_R2);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, TCG_REG_R3);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, TCG_REG_R1);
++        }
++    } else {
++        tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R1, l->addrlo_reg);
++    }
++    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R0, TCG_AREG0);
++
++    /*
++     * Tail call to the helper, with the return address back inline,
++     * just for the clarity of the debugging traceback -- the helper
++     * cannot return.  We have used BLNE to arrive here, so LR is
++     * already set.
++     */
++    tcg_out_goto(s, COND_AL, (const void *)
++                 (l->is_ld ? helper_unaligned_ld : helper_unaligned_st));
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
+ #endif /* SOFTMMU */
+ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
+     int mem_index;
+     TCGReg addend;
+     tcg_insn_unit *label_ptr;
++#else
++    unsigned a_bits;
+ #endif
+     datalo = *args++;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
+     add_qemu_ldst_label(s, true, oi, datalo, datahi, addrlo, addrhi,
+                         s->code_ptr, label_ptr);
+ #else /* !CONFIG_SOFTMMU */
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
++    }
+     if (guest_base) {
+         tcg_out_qemu_ld_index(s, opc, datalo, datahi,
+                               addrlo, TCG_REG_GUEST_BASE, false);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
+     int mem_index;
+     TCGReg addend;
+     tcg_insn_unit *label_ptr;
++#else
++    unsigned a_bits;
+ #endif
+     datalo = *args++;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
+     add_qemu_ldst_label(s, false, oi, datalo, datahi, addrlo, addrhi,
+                         s->code_ptr, label_ptr);
+ #else /* !CONFIG_SOFTMMU */
++    a_bits = get_alignment_bits(opc);
++    if (a_bits) {
++        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
++    }
+     if (guest_base) {
+         tcg_out_qemu_st_index(s, COND_AL, opc, datalo, datahi,
+                               addrlo, TCG_REG_GUEST_BASE, false);
+--
+.25.1

-New patch
+[PULL 24/34] tcg/mips: Support unaligned access for user-only
+This is kinda sorta the opposite of the other tcg hosts, where
+we get (normal) alignment checks for free with host SIGBUS and
+need to add code to support unaligned accesses.
+Fortunately, the ISA contains pairs of instructions that are
+used to implement unaligned memory accesses.  Use them.
+Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/mips/tcg-target.h     |   2 -
+ tcg/mips/tcg-target.c.inc | 334 +++++++++++++++++++++++++++++++++++++-
+files changed, 328 insertions(+), 8 deletions(-)
+diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.h
++++ b/tcg/mips/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
+ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
+     QEMU_ERROR("code path is reachable");
+-#ifdef CONFIG_SOFTMMU
+ #define TCG_TARGET_NEED_LDST_LABELS
+-#endif
+ #endif
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/mips/tcg-target.c.inc
++++ b/tcg/mips/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@
+  * THE SOFTWARE.
+  */
++#include "../tcg-ldst.c.inc"
++
+ #ifdef HOST_WORDS_BIGENDIAN
+ # define MIPS_BE  1
+ #else
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     OPC_ORI      = 015 << 26,
+     OPC_XORI     = 016 << 26,
+     OPC_LUI      = 017 << 26,
++    OPC_BNEL     = 025 << 26,
++    OPC_BNEZALC_R6 = 030 << 26,
+     OPC_DADDIU   = 031 << 26,
++    OPC_LDL      = 032 << 26,
++    OPC_LDR      = 033 << 26,
+     OPC_LB       = 040 << 26,
+     OPC_LH       = 041 << 26,
++    OPC_LWL      = 042 << 26,
+     OPC_LW       = 043 << 26,
+     OPC_LBU      = 044 << 26,
+     OPC_LHU      = 045 << 26,
++    OPC_LWR      = 046 << 26,
+     OPC_LWU      = 047 << 26,
+     OPC_SB       = 050 << 26,
+     OPC_SH       = 051 << 26,
++    OPC_SWL      = 052 << 26,
+     OPC_SW       = 053 << 26,
++    OPC_SDL      = 054 << 26,
++    OPC_SDR      = 055 << 26,
++    OPC_SWR      = 056 << 26,
+     OPC_LD       = 067 << 26,
+     OPC_SD       = 077 << 26,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
+ }
+ #if defined(CONFIG_SOFTMMU)
+-#include "../tcg-ldst.c.inc"
+-
+ static void * const qemu_ld_helpers[(MO_SSIZE | MO_BSWAP) + 1] = {
+     [MO_UB]   = helper_ret_ldub_mmu,
+     [MO_SB]   = helper_ret_ldsb_mmu,
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+     tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
+     return true;
+ }
+-#endif
++
++#else
++
++static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
++                                   TCGReg addrhi, unsigned a_bits)
++{
++    unsigned a_mask = (1 << a_bits) - 1;
++    TCGLabelQemuLdst *l = new_ldst_label(s);
++
++    l->is_ld = is_ld;
++    l->addrlo_reg = addrlo;
++    l->addrhi_reg = addrhi;
++
++    /* We are expecting a_bits to max out at 7, much lower than ANDI. */
++    tcg_debug_assert(a_bits < 16);
++    tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, addrlo, a_mask);
++
++    l->label_ptr[0] = s->code_ptr;
++    if (use_mips32r6_instructions) {
++        tcg_out_opc_br(s, OPC_BNEZALC_R6, TCG_REG_ZERO, TCG_TMP0);
++    } else {
++        tcg_out_opc_br(s, OPC_BNEL, TCG_TMP0, TCG_REG_ZERO);
++        tcg_out_nop(s);
++    }
++
++    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
++}
++
++static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    void *target;
++
++    if (!reloc_pc16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
++        return false;
++    }
++
++    if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
++        /* A0 is env, A1 is skipped, A2:A3 is the uint64_t address. */
++        TCGReg a2 = MIPS_BE ? l->addrhi_reg : l->addrlo_reg;
++        TCGReg a3 = MIPS_BE ? l->addrlo_reg : l->addrhi_reg;
++
++        if (a3 != TCG_REG_A2) {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, a2);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, a3);
++        } else if (a2 != TCG_REG_A3) {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, a3);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, a2);
++        } else {
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_TMP0, TCG_REG_A2);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, TCG_REG_A3);
++            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, TCG_TMP0);
++        }
++    } else {
++        tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
++    }
++    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
++
++    /*
++     * Tail call to the helper, with the return address back inline.
++     * We have arrived here via BNEL, so $31 is already set.
++     */
++    target = (l->is_ld ? helper_unaligned_ld : helper_unaligned_st);
++    tcg_out_call_int(s, target, true);
++    return true;
++}
++
++static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++
++static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
++{
++    return tcg_out_fail_alignment(s, l);
++}
++#endif /* SOFTMMU */
+ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+                                    TCGReg base, MemOp opc, bool is_64)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+     }
+ }
++static void __attribute__((unused))
++tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
++                                    TCGReg base, MemOp opc, bool is_64)
++{
++    const MIPSInsn lw1 = MIPS_BE ? OPC_LWL : OPC_LWR;
++    const MIPSInsn lw2 = MIPS_BE ? OPC_LWR : OPC_LWL;
++    const MIPSInsn ld1 = MIPS_BE ? OPC_LDL : OPC_LDR;
++    const MIPSInsn ld2 = MIPS_BE ? OPC_LDR : OPC_LDL;
++
++    bool sgn = (opc & MO_SIGN);
++
++    switch (opc & (MO_SSIZE | MO_BSWAP)) {
++    case MO_SW | MO_BE:
++    case MO_UW | MO_BE:
++        tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP0, base, 0);
++        tcg_out_opc_imm(s, OPC_LBU, lo, base, 1);
++        if (use_mips32r2_instructions) {
++            tcg_out_opc_bf(s, OPC_INS, lo, TCG_TMP0, 31, 8);
++        } else {
++            tcg_out_opc_sa(s, OPC_SLL, TCG_TMP0, TCG_TMP0, 8);
++            tcg_out_opc_reg(s, OPC_OR, lo, TCG_TMP0, TCG_TMP1);
++        }
++        break;
++
++    case MO_SW | MO_LE:
++    case MO_UW | MO_LE:
++        if (use_mips32r2_instructions && lo != base) {
++            tcg_out_opc_imm(s, OPC_LBU, lo, base, 0);
++            tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP0, base, 1);
++            tcg_out_opc_bf(s, OPC_INS, lo, TCG_TMP0, 31, 8);
++        } else {
++            tcg_out_opc_imm(s, OPC_LBU, TCG_TMP0, base, 0);
++            tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP1, base, 1);
++            tcg_out_opc_sa(s, OPC_SLL, TCG_TMP1, TCG_TMP1, 8);
++            tcg_out_opc_reg(s, OPC_OR, lo, TCG_TMP0, TCG_TMP1);
++        }
++        break;
++
++    case MO_SL:
++    case MO_UL:
++        tcg_out_opc_imm(s, lw1, lo, base, 0);
++        tcg_out_opc_imm(s, lw2, lo, base, 3);
++        if (TCG_TARGET_REG_BITS == 64 && is_64 && !sgn) {
++            tcg_out_ext32u(s, lo, lo);
++        }
++        break;
++
++    case MO_UL | MO_BSWAP:
++    case MO_SL | MO_BSWAP:
++        if (use_mips32r2_instructions) {
++            tcg_out_opc_imm(s, lw1, lo, base, 0);
++            tcg_out_opc_imm(s, lw2, lo, base, 3);
++            tcg_out_bswap32(s, lo, lo,
++                            TCG_TARGET_REG_BITS == 64 && is_64
++                            ? (sgn ? TCG_BSWAP_OS : TCG_BSWAP_OZ) : 0);
++        } else {
++            const tcg_insn_unit *subr =
++                (TCG_TARGET_REG_BITS == 64 && is_64 && !sgn
++                 ? bswap32u_addr : bswap32_addr);
++
++            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0);
++            tcg_out_bswap_subr(s, subr);
++            /* delay slot */
++            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 3);
++            tcg_out_mov(s, is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32, lo, TCG_TMP3);
++        }
++        break;
++
++    case MO_UQ:
++        if (TCG_TARGET_REG_BITS == 64) {
++            tcg_out_opc_imm(s, ld1, lo, base, 0);
++            tcg_out_opc_imm(s, ld2, lo, base, 7);
++        } else {
++            tcg_out_opc_imm(s, lw1, MIPS_BE ? hi : lo, base, 0 + 0);
++            tcg_out_opc_imm(s, lw2, MIPS_BE ? hi : lo, base, 0 + 3);
++            tcg_out_opc_imm(s, lw1, MIPS_BE ? lo : hi, base, 4 + 0);
++            tcg_out_opc_imm(s, lw2, MIPS_BE ? lo : hi, base, 4 + 3);
++        }
++        break;
++
++    case MO_UQ | MO_BSWAP:
++        if (TCG_TARGET_REG_BITS == 64) {
++            if (use_mips32r2_instructions) {
++                tcg_out_opc_imm(s, ld1, lo, base, 0);
++                tcg_out_opc_imm(s, ld2, lo, base, 7);
++                tcg_out_bswap64(s, lo, lo);
++            } else {
++                tcg_out_opc_imm(s, ld1, TCG_TMP0, base, 0);
++                tcg_out_bswap_subr(s, bswap64_addr);
++                /* delay slot */
++                tcg_out_opc_imm(s, ld2, TCG_TMP0, base, 7);
++                tcg_out_mov(s, TCG_TYPE_I64, lo, TCG_TMP3);
++            }
++        } else if (use_mips32r2_instructions) {
++            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0 + 0);
++            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 0 + 3);
++            tcg_out_opc_imm(s, lw1, TCG_TMP1, base, 4 + 0);
++            tcg_out_opc_imm(s, lw2, TCG_TMP1, base, 4 + 3);
++            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP0, 0, TCG_TMP0);
++            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP1, 0, TCG_TMP1);
++            tcg_out_opc_sa(s, OPC_ROTR, MIPS_BE ? lo : hi, TCG_TMP0, 16);
++            tcg_out_opc_sa(s, OPC_ROTR, MIPS_BE ? hi : lo, TCG_TMP1, 16);
++        } else {
++            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0 + 0);
++            tcg_out_bswap_subr(s, bswap32_addr);
++            /* delay slot */
++            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 0 + 3);
++            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 4 + 0);
++            tcg_out_mov(s, TCG_TYPE_I32, MIPS_BE ? lo : hi, TCG_TMP3);
++            tcg_out_bswap_subr(s, bswap32_addr);
++            /* delay slot */
++            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 4 + 3);
++            tcg_out_mov(s, TCG_TYPE_I32, MIPS_BE ? hi : lo, TCG_TMP3);
++        }
++        break;
++
++    default:
++        g_assert_not_reached();
++    }
++}
++
+ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+ {
+     TCGReg addr_regl, addr_regh __attribute__((unused));
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[2];
++#else
++    unsigned a_bits, s_bits;
+ #endif
+     TCGReg base = TCG_REG_A0;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+     } else {
+         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
+     }
+-    tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
++    a_bits = get_alignment_bits(opc);
++    s_bits = opc & MO_SIZE;
++    /*
++     * R6 removes the left/right instructions but requires the
++     * system to support misaligned memory accesses.
++     */
++    if (use_mips32r6_instructions) {
++        if (a_bits) {
++            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
++        }
++        tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
++    } else {
++        if (a_bits && a_bits != s_bits) {
++            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
++        }
++        if (a_bits >= s_bits) {
++            tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
++        } else {
++            tcg_out_qemu_ld_unalign(s, data_regl, data_regh, base, opc, is_64);
++        }
++    }
+ #endif
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
+     }
+ }
++static void __attribute__((unused))
++tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
++                                    TCGReg base, MemOp opc)
++{
++    const MIPSInsn sw1 = MIPS_BE ? OPC_SWL : OPC_SWR;
++    const MIPSInsn sw2 = MIPS_BE ? OPC_SWR : OPC_SWL;
++    const MIPSInsn sd1 = MIPS_BE ? OPC_SDL : OPC_SDR;
++    const MIPSInsn sd2 = MIPS_BE ? OPC_SDR : OPC_SDL;
++
++    /* Don't clutter the code below with checks to avoid bswapping ZERO.  */
++    if ((lo | hi) == 0) {
++        opc &= ~MO_BSWAP;
++    }
++
++    switch (opc & (MO_SIZE | MO_BSWAP)) {
++    case MO_16 | MO_BE:
++        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, lo, 8);
++        tcg_out_opc_imm(s, OPC_SB, TCG_TMP0, base, 0);
++        tcg_out_opc_imm(s, OPC_SB, lo, base, 1);
++        break;
++
++    case MO_16 | MO_LE:
++        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, lo, 8);
++        tcg_out_opc_imm(s, OPC_SB, lo, base, 0);
++        tcg_out_opc_imm(s, OPC_SB, TCG_TMP0, base, 1);
++        break;
++
++    case MO_32 | MO_BSWAP:
++        tcg_out_bswap32(s, TCG_TMP3, lo, 0);
++        lo = TCG_TMP3;
++        /* fall through */
++    case MO_32:
++        tcg_out_opc_imm(s, sw1, lo, base, 0);
++        tcg_out_opc_imm(s, sw2, lo, base, 3);
++        break;
++
++    case MO_64 | MO_BSWAP:
++        if (TCG_TARGET_REG_BITS == 64) {
++            tcg_out_bswap64(s, TCG_TMP3, lo);
++            lo = TCG_TMP3;
++        } else if (use_mips32r2_instructions) {
++            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP0, 0, MIPS_BE ? hi : lo);
++            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP1, 0, MIPS_BE ? lo : hi);
++            tcg_out_opc_sa(s, OPC_ROTR, TCG_TMP0, TCG_TMP0, 16);
++            tcg_out_opc_sa(s, OPC_ROTR, TCG_TMP1, TCG_TMP1, 16);
++            hi = MIPS_BE ? TCG_TMP0 : TCG_TMP1;
++            lo = MIPS_BE ? TCG_TMP1 : TCG_TMP0;
++        } else {
++            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi, 0);
++            tcg_out_opc_imm(s, sw1, TCG_TMP3, base, 0 + 0);
++            tcg_out_opc_imm(s, sw2, TCG_TMP3, base, 0 + 3);
++            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo, 0);
++            tcg_out_opc_imm(s, sw1, TCG_TMP3, base, 4 + 0);
++            tcg_out_opc_imm(s, sw2, TCG_TMP3, base, 4 + 3);
++            break;
++        }
++        /* fall through */
++    case MO_64:
++        if (TCG_TARGET_REG_BITS == 64) {
++            tcg_out_opc_imm(s, sd1, lo, base, 0);
++            tcg_out_opc_imm(s, sd2, lo, base, 7);
++        } else {
++            tcg_out_opc_imm(s, sw1, MIPS_BE ? hi : lo, base, 0 + 0);
++            tcg_out_opc_imm(s, sw2, MIPS_BE ? hi : lo, base, 0 + 3);
++            tcg_out_opc_imm(s, sw1, MIPS_BE ? lo : hi, base, 4 + 0);
++            tcg_out_opc_imm(s, sw2, MIPS_BE ? lo : hi, base, 4 + 3);
++        }
++        break;
++
++    default:
++        tcg_abort();
++    }
++}
+ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+ {
+     TCGReg addr_regl, addr_regh __attribute__((unused));
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+     MemOp opc;
+ #if defined(CONFIG_SOFTMMU)
+     tcg_insn_unit *label_ptr[2];
++#else
++    unsigned a_bits, s_bits;
+ #endif
+     TCGReg base = TCG_REG_A0;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+                         data_regl, data_regh, addr_regl, addr_regh,
+                         s->code_ptr, label_ptr);
+ #else
+-    base = TCG_REG_A0;
+     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+         tcg_out_ext32u(s, base, addr_regl);
+         addr_regl = base;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
+     } else {
+         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
+     }
+-    tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
++    a_bits = get_alignment_bits(opc);
++    s_bits = opc & MO_SIZE;
++    /*
++     * R6 removes the left/right instructions but requires the
++     * system to support misaligned memory accesses.
++     */
++    if (use_mips32r6_instructions) {
++        if (a_bits) {
++            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
++        }
++        tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
++    } else {
++        if (a_bits && a_bits != s_bits) {
++            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
++        }
++        if (a_bits >= s_bits) {
++            tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
++        } else {
++            tcg_out_qemu_st_unalign(s, data_regl, data_regh, base, opc);
++        }
++    }
+ #endif
+ }
+--
+.25.1

-[PULL 01/11] tcg: Adjust simd_desc size encoding
+[PULL 25/34] tcg/mips: Support unaligned access for softmmu
-With larger vector sizes, it turns out oprsz == maxsz, and we only
+We can use the routines just added for user-only to emit
-need to represent mismatch for oprsz <= 32.  We do, however, need
+unaligned accesses in softmmu mode too.
-to represent larger oprsz and do so without reducing SIMD_DATA_BITS.
+Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
-Reduce the size of the oprsz field and increase the maxsz field.
+Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
 Steal the oprsz value of 24 to indicate equality with maxsz.
 Tested-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
+ tcg/mips/tcg-target.c.inc | 91 ++++++++++++++++++++++-----------------
- tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
+file changed, 51 insertions(+), 40 deletions(-)
-files changed, 52 insertions(+), 21 deletions(-)
+diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-gvec-desc.h
+--- a/tcg/mips/tcg-target.c.inc
-+++ b/include/tcg/tcg-gvec-desc.h
++++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
- #ifndef TCG_TCG_GVEC_DESC_H
+                              tcg_insn_unit *label_ptr[2], bool is_load)
- #define TCG_TCG_GVEC_DESC_H
+ {
+     MemOp opc = get_memop(oi);
--/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
+-    unsigned s_bits = opc & MO_SIZE;
--#define SIMD_OPRSZ_SHIFT   0
+     unsigned a_bits = get_alignment_bits(opc);
--#define SIMD_OPRSZ_BITS    5
++    unsigned s_bits = opc & MO_SIZE;
-+/*
++    unsigned a_mask = (1 << a_bits) - 1;
-+ * This configuration allows MAXSZ to represent 2048 bytes, and
++    unsigned s_mask = (1 << s_bits) - 1;
-+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+     int mem_index = get_mmuidx(oi);
-+ *
+     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
-+ * Encode this with:
+     int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
-+ *   0, 1, 3 -> 8, 16, 32
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
-+ *   2       -> maxsz
+     int add_off = offsetof(CPUTLBEntry, addend);
-+ *
+     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
-+ * This steals the input that would otherwise map to 24 to match maxsz.
+                    : offsetof(CPUTLBEntry, addr_write));
-+ */
+-    target_ulong mask;
-+#define SIMD_MAXSZ_SHIFT   0
++    target_ulong tlb_mask;
-+#define SIMD_MAXSZ_BITS    8
+     /* Load tlb_mask[mmu_idx] and tlb_table[mmu_idx].  */
--#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
+     tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_AREG0, mask_off);
--#define SIMD_MAXSZ_BITS    5
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
-+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+     /* Add the tlb_table pointer, creating the CPUTLBEntry address in TMP3.  */
-+#define SIMD_OPRSZ_BITS    2
+     tcg_out_opc_reg(s, ALIAS_PADD, TCG_TMP3, TCG_TMP3, TCG_TMP1);
--#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+-    /* We don't currently support unaligned accesses.
-+#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
+-       We could do so with mips32r6.  */
- #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
+-    if (a_bits < s_bits) {
+-        a_bits = s_bits;
- /* Create a descriptor from components.  */
+-    }
  uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 -/* Extract the operation size from a descriptor.  */
 -static inline intptr_t simd_oprsz(uint32_t desc)
 -{
 -    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
 -}
 -
- /* Extract the max vector size from a descriptor.  */
+-    /* Mask the page bits, keeping the alignment bits to compare against.  */
- static inline intptr_t simd_maxsz(uint32_t desc)
+-    mask = (target_ulong)TARGET_PAGE_MASK | ((1 << a_bits) - 1);
- {
+-
--    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
+     /* Load the (low-half) tlb comparator.  */
-+    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
+     if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-+}
+-        tcg_out_ld(s, TCG_TYPE_I32, TCG_TMP0, TCG_TMP3, cmp_off + LO_OFF);
-+
+-        tcg_out_movi(s, TCG_TYPE_I32, TCG_TMP1, mask);
-+/* Extract the operation size from a descriptor.  */
++        tcg_out_ldst(s, OPC_LW, TCG_TMP0, TCG_TMP3, cmp_off + LO_OFF);
-+static inline intptr_t simd_oprsz(uint32_t desc)
+     } else {
-+{
+         tcg_out_ldst(s, (TARGET_LONG_BITS == 64 ? OPC_LD
-+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+                          : TCG_TARGET_REG_BITS == 64 ? OPC_LWU : OPC_LW),
-+    intptr_t o = f * 8 + 8;
+                      TCG_TMP0, TCG_TMP3, cmp_off);
-+    intptr_t m = simd_maxsz(desc);
+-        tcg_out_movi(s, TCG_TYPE_TL, TCG_TMP1, mask);
-+    return f == 2 ? m : o;
+-        /* No second compare is required here;
- }
+-           load the tlb addend for the fast path.  */
+-        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
- /* Extract the operation-specific data from a descriptor.  */
+     }
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
+     /* Zero extend a 32-bit guest address for a 64-bit host. */
---- a/tcg/tcg-op-gvec.c
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
-+++ b/tcg/tcg-op-gvec.c
+         tcg_out_ext32u(s, base, addrl);
-@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
+         addrl = base;
-    of the operand offsets so that we can check them all at once.  */
+     }
- static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
+-    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
  {
 -    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
 -    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
 -    tcg_debug_assert(oprsz > 0);
 -    tcg_debug_assert(oprsz <= maxsz);
 -    tcg_debug_assert((oprsz & opr_align) == 0);
 +    uint32_t max_align;
 +
 +    switch (oprsz) {
 +    case 8:
 +    case 16:
 +    case 32:
 +        tcg_debug_assert(oprsz <= maxsz);
 +        break;
 +    default:
 +        tcg_debug_assert(oprsz == maxsz);
 +        break;
 +    }
 +    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
 +
 +    max_align = maxsz >= 16 ? 15 : 7;
      tcg_debug_assert((maxsz & max_align) == 0);
      tcg_debug_assert((ofs & max_align) == 0);
  }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
  {
      uint32_t desc = 0;
 -    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
 -    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
 -    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 +    check_size_align(oprsz, maxsz, 0);
 +    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
      oprsz = (oprsz / 8) - 1;
      maxsz = (maxsz / 8) - 1;
 +
 +    /*
-+     * We have just asserted in check_size_align that either
++     * Mask the page bits, keeping the alignment bits to compare against.
-+     * oprsz is {8,16,32} or matches maxsz.  Encode the final
++     * For unaligned accesses, compare against the end of the access to
-+     * case with '2', as that would otherwise map to 24.
++     * verify that it does not cross a page boundary.
 +     */
-+    if (oprsz == maxsz) {
++    tlb_mask = (target_ulong)TARGET_PAGE_MASK | a_mask;
-+        oprsz = 2;
++    tcg_out_movi(s, TCG_TYPE_I32, TCG_TMP1, tlb_mask);
 +    if (a_mask >= s_mask) {
 +        tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
 +    } else {
 +        tcg_out_opc_imm(s, ALIAS_PADDI, TCG_TMP2, addrl, s_mask - a_mask);
 +        tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, TCG_TMP2);
 +    }
 +
-     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
++    if (TCG_TARGET_REG_BITS >= TARGET_LONG_BITS) {
-     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
++        /* Load the tlb addend for the fast path.  */
-     desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
++        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
 +    }
      label_ptr[0] = s->code_ptr;
      tcg_out_opc_br(s, OPC_BNE, TCG_TMP1, TCG_TMP0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
      /* Load and test the high half tlb comparator.  */
      if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
          /* delay slot */
 -        tcg_out_ld(s, TCG_TYPE_I32, TCG_TMP0, TCG_TMP3, cmp_off + HI_OFF);
 +        tcg_out_ldst(s, OPC_LW, TCG_TMP0, TCG_TMP3, cmp_off + HI_OFF);
          /* Load the tlb addend for the fast path.  */
          tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
      }
  }
 -static void __attribute__((unused))
 -tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
 +static void tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
                                      TCGReg base, MemOp opc, bool is_64)
  {
      const MIPSInsn lw1 = MIPS_BE ? OPC_LWL : OPC_LWR;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
  #if defined(CONFIG_SOFTMMU)
      tcg_insn_unit *label_ptr[2];
  #else
 -    unsigned a_bits, s_bits;
  #endif
 +    unsigned a_bits, s_bits;
      TCGReg base = TCG_REG_A0;
      data_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
      addr_regh = (TCG_TARGET_REG_BITS < TARGET_LONG_BITS ? *args++ : 0);
      oi = *args++;
      opc = get_memop(oi);
 +    a_bits = get_alignment_bits(opc);
 +    s_bits = opc & MO_SIZE;
 +    /*
 +     * R6 removes the left/right instructions but requires the
 +     * system to support misaligned memory accesses.
 +     */
  #if defined(CONFIG_SOFTMMU)
      tcg_out_tlb_load(s, base, addr_regl, addr_regh, oi, label_ptr, 1);
 -    tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
 +    if (use_mips32r6_instructions || a_bits >= s_bits) {
 +        tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
 +    } else {
 +        tcg_out_qemu_ld_unalign(s, data_regl, data_regh, base, opc, is_64);
 +    }
      add_qemu_ldst_label(s, 1, oi,
                          (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                          data_regl, data_regh, addr_regl, addr_regh,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
      } else {
          tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
      }
 -    a_bits = get_alignment_bits(opc);
 -    s_bits = opc & MO_SIZE;
 -    /*
 -     * R6 removes the left/right instructions but requires the
 -     * system to support misaligned memory accesses.
 -     */
      if (use_mips32r6_instructions) {
          if (a_bits) {
              tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
      }
  }
 -static void __attribute__((unused))
 -tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
 +static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
                                      TCGReg base, MemOp opc)
  {
      const MIPSInsn sw1 = MIPS_BE ? OPC_SWL : OPC_SWR;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
      MemOp opc;
  #if defined(CONFIG_SOFTMMU)
      tcg_insn_unit *label_ptr[2];
 -#else
 -    unsigned a_bits, s_bits;
  #endif
 +    unsigned a_bits, s_bits;
      TCGReg base = TCG_REG_A0;
      data_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
      addr_regh = (TCG_TARGET_REG_BITS < TARGET_LONG_BITS ? *args++ : 0);
      oi = *args++;
      opc = get_memop(oi);
 +    a_bits = get_alignment_bits(opc);
 +    s_bits = opc & MO_SIZE;
 +    /*
 +     * R6 removes the left/right instructions but requires the
 +     * system to support misaligned memory accesses.
 +     */
  #if defined(CONFIG_SOFTMMU)
      tcg_out_tlb_load(s, base, addr_regl, addr_regh, oi, label_ptr, 0);
 -    tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
 +    if (use_mips32r6_instructions || a_bits >= s_bits) {
 +        tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
 +    } else {
 +        tcg_out_qemu_st_unalign(s, data_regl, data_regh, base, opc);
 +    }
      add_qemu_ldst_label(s, 0, oi,
                          (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                          data_regl, data_regh, addr_regl, addr_regh,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
      } else {
          tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
      }
 -    a_bits = get_alignment_bits(opc);
 -    s_bits = opc & MO_SIZE;
 -    /*
 -     * R6 removes the left/right instructions but requires the
 -     * system to support misaligned memory accesses.
 -     */
      if (use_mips32r6_instructions) {
          if (a_bits) {
              tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
 --
 .25.1

-New patch
+[PULL 26/34] tcg/sparc: Use tcg_out_movi_imm13 in tcg_out_addsub2_i64
+When BH is constant, it is constrained to 11 bits for use in MOVCC.
+For the cases in which we must load the constant BH into a register,
+we do not need the full logic of tcg_out_movi; we can use the simpler
+function for emitting a 13 bit constant.
+This eliminates the only case in which TCG_REG_T2 was passed to
+tcg_out_movi, which will shortly become invalid.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/sparc/tcg-target.c.inc | 10 +++++++---
+file changed, 7 insertions(+), 3 deletions(-)
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc/tcg-target.c.inc
++++ b/tcg/sparc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
+     if (use_vis3_instructions && !is_sub) {
+         /* Note that ADDXC doesn't accept immediates.  */
+         if (bhconst && bh != 0) {
+-           tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_T2, bh);
++           tcg_out_movi_imm13(s, TCG_REG_T2, bh);
+            bh = TCG_REG_T2;
+         }
+         tcg_out_arith(s, rh, ah, bh, ARITH_ADDXC);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
+         tcg_out_movcc(s, TCG_COND_GEU, MOVCC_XCC, rh, ah, 0);
+     }
+     } else {
+-        /* Otherwise adjust BH as if there is carry into T2 ... */
++        /*
++         * Otherwise adjust BH as if there is carry into T2.
++         * Note that constant BH is constrained to 11 bits for the MOVCC,
++         * so the adjustment fits 12 bits.
++         */
+         if (bhconst) {
+-            tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_T2, bh + (is_sub ? -1 : 1));
++            tcg_out_movi_imm13(s, TCG_REG_T2, bh + (is_sub ? -1 : 1));
+         } else {
+             tcg_out_arithi(s, TCG_REG_T2, bh, 1,
+                            is_sub ? ARITH_SUB : ARITH_ADD);
+--
+.25.1

-[PULL 05/11] tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
+[PULL 27/34] tcg/sparc: Split out tcg_out_movi_imm32
-These are easier to set and test when they have their own fields.
+Handle 32-bit constants with a separate function, so that
-Reduce the size of alias_index and sort_index to 4 bits, which is
+tcg_out_movi_int does not need to recurse.  This slightly
-sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
+rearranges the order of tests for small constants, but
-constants within the ct field.
+produces the same output.
-Move all initialization to allocation time, rather than init
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 individual fields in process_op_defs.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h | 14 +++++++-------
+ tcg/sparc/tcg-target.c.inc | 36 +++++++++++++++++++++---------------
- tcg/tcg.c         | 28 ++++++++++++----------------
+file changed, 21 insertions(+), 15 deletions(-)
 files changed, 19 insertions(+), 23 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/tcg/sparc/tcg-target.c.inc
-+++ b/include/tcg/tcg.h
++++ b/tcg/sparc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_imm13(TCGContext *s, TCGReg ret, int32_t arg)
- void tcg_dump_info(void);
+     tcg_out_arithi(s, ret, TCG_REG_G0, arg, ARITH_OR);
- void tcg_dump_op_count(void);
+ }
--#define TCG_CT_ALIAS  0x80
++static void tcg_out_movi_imm32(TCGContext *s, TCGReg ret, int32_t arg)
--#define TCG_CT_IALIAS 0x40
++{
--#define TCG_CT_NEWREG 0x20 /* output requires a new register */
++    if (check_fit_i32(arg, 13)) {
--#define TCG_CT_CONST  0x02 /* any constant of register size */
++        /* A 13-bit constant sign-extended to 64-bits.  */
-+#define TCG_CT_CONST  1 /* any constant of register size */
++        tcg_out_movi_imm13(s, ret, arg);
++    } else {
- typedef struct TCGArgConstraint {
++        /* A 32-bit constant zero-extended to 64 bits.  */
--    uint16_t ct;
++        tcg_out_sethi(s, ret, arg);
--    uint8_t alias_index;
++        if (arg & 0x3ff) {
--    uint8_t sort_index;
++            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
-+    unsigned ct : 16;
++        }
-+    unsigned alias_index : 4;
++    }
-+    unsigned sort_index : 4;
++}
-+    bool oalias : 1;
++
-+    bool ialias : 1;
+ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
-+    bool newreg : 1;
+                              tcg_target_long arg, bool in_prologue)
-     TCGRegSet regs;
+ {
- } TCGArgConstraint;
+     tcg_target_long hi, lo = (int32_t)arg;
+     tcg_target_long test, lsb;
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
+-    /* Make sure we test 32-bit constants for imm13 properly.  */
---- a/tcg/tcg.c
+-    if (type == TCG_TYPE_I32) {
-+++ b/tcg/tcg.c
+-        arg = lo;
-@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
++    /* A 32-bit constant, or 32-bit zero-extended to 64-bits.  */
-         total_args += n;
++    if (type == TCG_TYPE_I32 || arg == (uint32_t)arg) {
 +        tcg_out_movi_imm32(s, ret, arg);
 +        return;
      }
--    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+     /* A 13-bit constant sign-extended to 64-bits.  */
-+    args_ct = g_new0(TCGArgConstraint, total_args);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
+         }
-     for(op = 0; op < NB_OPS; op++) {
+     }
-         def = &tcg_op_defs[op];
-@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
+-    /* A 32-bit constant, or 32-bit zero-extended to 64-bits.  */
-     const TCGArgConstraint *arg_ct = &def->args_ct[k];
+-    if (type == TCG_TYPE_I32 || arg == (uint32_t)arg) {
-     int n;
+-        tcg_out_sethi(s, ret, arg);
+-        if (arg & 0x3ff) {
--    if (arg_ct->ct & TCG_CT_ALIAS) {
+-            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
-+    if (arg_ct->oalias) {
+-        }
-         /* an alias is equivalent to a single register */
+-        return;
-         n = 1;
+-    }
 -
      /* A 32-bit constant sign-extended to 64-bits.  */
      if (arg == lo) {
          tcg_out_sethi(s, ret, ~arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
      /* A 64-bit constant decomposed into 2 32-bit pieces.  */
      if (check_fit_i32(lo, 13)) {
          hi = (arg - lo) >> 32;
 -        tcg_out_movi(s, TCG_TYPE_I32, ret, hi);
 +        tcg_out_movi_imm32(s, ret, hi);
          tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
          tcg_out_arithi(s, ret, ret, lo, ARITH_ADD);
      } else {
-@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
+         hi = arg >> 32;
-             /* Incomplete TCGTargetOpDef entry. */
+-        tcg_out_movi(s, TCG_TYPE_I32, ret, hi);
-             tcg_debug_assert(ct_str != NULL);
+-        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_T2, lo);
++        tcg_out_movi_imm32(s, ret, hi);
--            def->args_ct[i].regs = 0;
++        tcg_out_movi_imm32(s, TCG_REG_T2, lo);
--            def->args_ct[i].ct = 0;
+         tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
-             while (*ct_str != '\0') {
+         tcg_out_arith(s, ret, ret, TCG_REG_T2, ARITH_OR);
-                 switch(*ct_str) {
+     }
                  case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
                          tcg_debug_assert(def->args_ct[oarg].regs != 0);
 -                        /* TCG_CT_ALIAS is for the output arguments.
 -                           The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 -                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
 +                        /* The output sets oalias.  */
 +                        def->args_ct[oarg].oalias = true;
                          def->args_ct[oarg].alias_index = i;
 -                        def->args_ct[i].ct |= TCG_CT_IALIAS;
 +                        /* The input sets ialias. */
 +                        def->args_ct[i].ialias = true;
                          def->args_ct[i].alias_index = oarg;
                      }
                      ct_str++;
                      break;
                  case '&':
 -                    def->args_ct[i].ct |= TCG_CT_NEWREG;
 +                    def->args_ct[i].newreg = true;
                      ct_str++;
                      break;
                  case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      set = *pset;
                      set &= ct->regs;
 -                    if (ct->ct & TCG_CT_IALIAS) {
 +                    if (ct->ialias) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          }
          i_preferred_regs = o_preferred_regs = 0;
 -        if (arg_ct->ct & TCG_CT_IALIAS) {
 +        if (arg_ct->ialias) {
              o_preferred_regs = op->output_pref[arg_ct->alias_index];
              if (ts->fixed_reg) {
                  /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
                          i2 = def->args_ct[nb_oargs + k2].sort_index;
 -                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
 -                            reg == new_args[i2]) {
 +                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                              goto allocate_in_reg;
                          }
                      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              /* ENV should not be modified.  */
              tcg_debug_assert(!ts->fixed_reg);
 -            if ((arg_ct->ct & TCG_CT_ALIAS)
 -                && !const_args[arg_ct->alias_index]) {
 +            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
 -            } else if (arg_ct->ct & TCG_CT_NEWREG) {
 +            } else if (arg_ct->newreg) {
                  reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
 --
 .25.1

-New patch
+[PULL 28/34] tcg/sparc: Add scratch argument to tcg_out_movi_int
+This will allow us to control exactly what scratch register is
+used for loading the constant.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/sparc/tcg-target.c.inc | 15 +++++++++------
+file changed, 9 insertions(+), 6 deletions(-)
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc/tcg-target.c.inc
++++ b/tcg/sparc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_imm32(TCGContext *s, TCGReg ret, int32_t arg)
+ }
+ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
+-                             tcg_target_long arg, bool in_prologue)
++                             tcg_target_long arg, bool in_prologue,
++                             TCGReg scratch)
+ {
+     tcg_target_long hi, lo = (int32_t)arg;
+     tcg_target_long test, lsb;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
+     } else {
+         hi = arg >> 32;
+         tcg_out_movi_imm32(s, ret, hi);
+-        tcg_out_movi_imm32(s, TCG_REG_T2, lo);
++        tcg_out_movi_imm32(s, scratch, lo);
+         tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
+-        tcg_out_arith(s, ret, ret, TCG_REG_T2, ARITH_OR);
++        tcg_out_arith(s, ret, ret, scratch, ARITH_OR);
+     }
+ }
+ static void tcg_out_movi(TCGContext *s, TCGType type,
+                          TCGReg ret, tcg_target_long arg)
+ {
+-    tcg_out_movi_int(s, type, ret, arg, false);
++    tcg_debug_assert(ret != TCG_REG_T2);
++    tcg_out_movi_int(s, type, ret, arg, false, TCG_REG_T2);
+ }
+ static void tcg_out_ldst_rr(TCGContext *s, TCGReg data, TCGReg a1,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
+     } else {
+         uintptr_t desti = (uintptr_t)dest;
+         tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
+-                         desti & ~0xfff, in_prologue);
++                         desti & ~0xfff, in_prologue, TCG_REG_O7);
+         tcg_out_arithi(s, TCG_REG_O7, TCG_REG_T1, desti & 0xfff, JMPL);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
+ #ifndef CONFIG_SOFTMMU
+     if (guest_base != 0) {
+-        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG, guest_base, true);
++        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG,
++                         guest_base, true, TCG_REG_T1);
+         tcg_regset_set_reg(s->reserved_regs, TCG_GUEST_BASE_REG);
+     }
+ #endif
+--
+.25.1

-[PULL 03/11] tcg: Move sorted_args into TCGArgConstraint.sort_index
+[PULL 29/34] tcg/sparc: Improve code gen for shifted 32-bit constants
-This uses an existing hole in the TCGArgConstraint structure
+We had code for checking for 13 and 21-bit shifted constants,
-and will be convenient for keeping the data in one place.
+but we can do better and allow 32-bit shifted constants.
 This is still 2 insns shorter than the full 64-bit sequence.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h |  2 +-
+ tcg/sparc/tcg-target.c.inc | 12 ++++++------
- tcg/tcg.c         | 35 +++++++++++++++++------------------
+file changed, 6 insertions(+), 6 deletions(-)
 files changed, 18 insertions(+), 19 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/tcg/sparc/tcg-target.c.inc
-+++ b/include/tcg/tcg.h
++++ b/tcg/sparc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
- typedef struct TCGArgConstraint {
+         return;
      uint16_t ct;
      uint8_t alias_index;
 +    uint8_t sort_index;
      TCGRegSet regs;
  } TCGArgConstraint;
@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
      uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
      uint8_t flags;
      TCGArgConstraint *args_ct;
 -    int *sorted_args;
  #if defined(CONFIG_DEBUG_TCG)
      int used;
  #endif
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
      int op, total_args, n, i;
      TCGOpDef *def;
      TCGArgConstraint *args_ct;
 -    int *sorted_args;
      TCGTemp *ts;
      memset(s, 0, sizeof(*s));
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
      }
-     args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+-    /* A 21-bit constant, shifted.  */
--    sorted_args = g_malloc(sizeof(int) * total_args);
++    /* A 32-bit constant, shifted.  */
+     lsb = ctz64(arg);
-     for(op = 0; op < NB_OPS; op++) {
+     test = (tcg_target_long)arg >> lsb;
-         def = &tcg_op_defs[op];
+-    if (check_fit_tl(test, 13)) {
-         def->args_ct = args_ct;
+-        tcg_out_movi_imm13(s, ret, test);
--        def->sorted_args = sorted_args;
+-        tcg_out_arithi(s, ret, ret, lsb, SHIFT_SLLX);
-         n = def->nb_iargs + def->nb_oargs;
+-        return;
--        sorted_args += n;
+-    } else if (lsb > 10 && test == extract64(test, 0, 21)) {
-         args_ct += n;
++    if (lsb > 10 && test == extract64(test, 0, 21)) {
          tcg_out_sethi(s, ret, test << 10);
          tcg_out_arithi(s, ret, ret, lsb - 10, SHIFT_SLLX);
          return;
 +    } else if (test == (uint32_t)test || test == (int32_t)test) {
 +        tcg_out_movi_int(s, TCG_TYPE_I64, ret, test, in_prologue, scratch);
 +        tcg_out_arithi(s, ret, ret, lsb, SHIFT_SLLX);
 +        return;
      }
-@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
+     /* A 64-bit constant decomposed into 2 32-bit pieces.  */
  /* sort from highest priority to lowest */
  static void sort_constraints(TCGOpDef *def, int start, int n)
  {
 -    int i, j, p1, p2, tmp;
 +    int i, j;
 +    TCGArgConstraint *a = def->args_ct;
 -    for(i = 0; i < n; i++)
 -        def->sorted_args[start + i] = start + i;
 -    if (n <= 1)
 +    for (i = 0; i < n; i++) {
 +        a[start + i].sort_index = start + i;
 +    }
 +    if (n <= 1) {
          return;
 -    for(i = 0; i < n - 1; i++) {
 -        for(j = i + 1; j < n; j++) {
 -            p1 = get_constraint_priority(def, def->sorted_args[start + i]);
 -            p2 = get_constraint_priority(def, def->sorted_args[start + j]);
 +    }
 +    for (i = 0; i < n - 1; i++) {
 +        for (j = i + 1; j < n; j++) {
 +            int p1 = get_constraint_priority(def, a[start + i].sort_index);
 +            int p2 = get_constraint_priority(def, a[start + j].sort_index);
              if (p1 < p2) {
 -                tmp = def->sorted_args[start + i];
 -                def->sorted_args[start + i] = def->sorted_args[start + j];
 -                def->sorted_args[start + j] = tmp;
 +                int tmp = a[start + i].sort_index;
 +                a[start + i].sort_index = a[start + j].sort_index;
 +                a[start + j].sort_index = tmp;
              }
          }
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
      for (k = 0; k < nb_iargs; k++) {
          TCGRegSet i_preferred_regs, o_preferred_regs;
 -        i = def->sorted_args[nb_oargs + k];
 +        i = def->args_ct[nb_oargs + k].sort_index;
          arg = op->args[i];
          arg_ct = &def->args_ct[i];
          ts = arg_temp(arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      int k2, i2;
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
 -                        i2 = def->sorted_args[nb_oargs + k2];
 +                        i2 = def->args_ct[nb_oargs + k2].sort_index;
                          if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
                              reg == new_args[i2]) {
                              goto allocate_in_reg;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          /* satisfy the output constraints */
          for(k = 0; k < nb_oargs; k++) {
 -            i = def->sorted_args[k];
 +            i = def->args_ct[k].sort_index;
              arg = op->args[i];
              arg_ct = &def->args_ct[i];
              ts = arg_temp(arg);
 --
 .25.1

-[PULL 02/11] tcg: Drop union from TCGArgConstraint
+[PULL 30/34] tcg/sparc: Convert patch_reloc to return bool
-The union is unused; let "regs" appear in the main structure
+Since 7ecd02a06f8, if patch_reloc fails we restart translation
-without the "u.regs" wrapping.
+with a smaller TB.  SPARC had its function signature changed,
 but not the logic.  Replace assert with return false.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h            |  4 +---
+ tcg/sparc/tcg-target.c.inc | 8 ++++++--
- tcg/tcg.c                    | 22 +++++++++++-----------
+file changed, 6 insertions(+), 2 deletions(-)
  tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
  tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
  tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
  tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
  tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
  tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
  tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
  tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
  tcg/tci/tcg-target.c.inc     |  2 +-
 files changed, 91 insertions(+), 93 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
-+++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
- typedef struct TCGArgConstraint {
-     uint16_t ct;
-     uint8_t alias_index;
--    union {
--        TCGRegSet regs;
--    } u;
-+    TCGRegSet regs;
- } TCGArgConstraint;
- #define TCG_MAX_OP_ARGS 16
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
-             return 0;
-         n = 0;
-         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
--            if (tcg_regset_test_reg(arg_ct->u.regs, i))
-+            if (tcg_regset_test_reg(arg_ct->regs, i))
-                 n++;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
-             /* Incomplete TCGTargetOpDef entry. */
-             tcg_debug_assert(ct_str != NULL);
--            def->args_ct[i].u.regs = 0;
-+            def->args_ct[i].regs = 0;
-             def->args_ct[i].ct = 0;
-             while (*ct_str != '\0') {
-                 switch(*ct_str) {
-@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
-                     pset = la_temp_pref(ts);
-                     set = *pset;
--                    set &= ct->u.regs;
-+                    set &= ct->regs;
-                     if (ct->ct & TCG_CT_IALIAS) {
-                         set &= op->output_pref[ct->alias_index];
-                     }
-                     /* If the combination is not possible, restart.  */
-                     if (set == 0) {
--                        set = ct->u.regs;
-+                        set = ct->regs;
-                     }
-                     *pset = set;
-                 }
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
-         return;
-     }
--    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
--    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
-+    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
-+    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
-     /* Allocate the output register now.  */
-     if (ots->val_type != TEMP_VAL_REG) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-             }
-         }
--        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
-+        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
-         reg = ts->reg;
--        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
-+        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
-             /* nothing to do : the constraint is satisfied */
-         } else {
-         allocate_in_reg:
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-                and move the temporary register into it */
-             temp_load(s, ts, tcg_target_available_regs[ts->type],
-                       i_allocated_regs, 0);
--            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
-+            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
-                                 o_preferred_regs, ts->indirect_base);
-             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
-                 /*
-@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
-                 && !const_args[arg_ct->alias_index]) {
-                 reg = new_args[arg_ct->alias_index];
-             } else if (arg_ct->ct & TCG_CT_NEWREG) {
--                reg = tcg_reg_alloc(s, arg_ct->u.regs,
-+                reg = tcg_reg_alloc(s, arg_ct->regs,
-                                     i_allocated_regs | o_allocated_regs,
-                                     op->output_pref[k], ts->indirect_base);
-             } else {
--                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
-+                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
-                                     op->output_pref[k], ts->indirect_base);
-             }
-             tcg_regset_set_reg(o_allocated_regs, reg);
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch (*ct_str++) {
-     case 'r': /* general registers */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs |= 0xffffffffu;
-+        ct->regs |= 0xffffffffu;
-         break;
-     case 'w': /* advsimd registers */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs |= 0xffffffff00000000ull;
-+        ct->regs |= 0xffffffff00000000ull;
-         break;
-     case 'l': /* qemu_ld / qemu_st address, data_reg */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffffu;
-+        ct->regs = 0xffffffffu;
- #ifdef CONFIG_SOFTMMU
-         /* x0 and x1 will be overwritten when reading the tlb entry,
-            and x2, and x3 for helper args, better to avoid using them. */
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
- #endif
-         break;
-     case 'A': /* Valid for arithmetic immediate (positive or negative).  */
-diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/arm/tcg-target.c.inc
-+++ b/tcg/arm/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     case 'r':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffff;
-+        ct->regs = 0xffff;
-         break;
-     /* qemu_ld address */
-     case 'l':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffff;
-+        ct->regs = 0xffff;
- #ifdef CONFIG_SOFTMMU
-         /* r0-r2,lr will be overwritten when reading the tlb entry,
-            so don't use these. */
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
- #endif
-         break;
-     /* qemu_st address & data */
-     case 's':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffff;
-+        ct->regs = 0xffff;
-         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
-            and r0-r1 doing the byte swapping, so don't use these. */
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
- #if defined(CONFIG_SOFTMMU)
-         /* Avoid clashes with registers being used for helper args */
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
- #if TARGET_LONG_BITS == 64
-         /* Avoid clashes with registers being used for helper args */
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
- #endif
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
- #endif
-         break;
-diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/i386/tcg-target.c.inc
-+++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch(*ct_str++) {
-     case 'a':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
-         break;
-     case 'b':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
-         break;
-     case 'c':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
-         break;
-     case 'd':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
-         break;
-     case 'S':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
-         break;
-     case 'D':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
-+        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
-         break;
-     case 'q':
-         /* A register that can be used as a byte operand.  */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
-+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
-         break;
-     case 'Q':
-         /* A register with an addressable second byte (e.g. %ah).  */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xf;
-+        ct->regs = 0xf;
-         break;
-     case 'r':
-         /* A general register.  */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs |= ALL_GENERAL_REGS;
-+        ct->regs |= ALL_GENERAL_REGS;
-         break;
-     case 'W':
-         /* With TZCNT/LZCNT, we can have operand-size as an input.  */
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     case 'x':
-         /* A vector register.  */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs |= ALL_VECTOR_REGS;
-+        ct->regs |= ALL_VECTOR_REGS;
-         break;
-         /* qemu_ld/st address constraint */
-     case 'L':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
-+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
-         break;
-     case 'e':
-diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/mips/tcg-target.c.inc
-+++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch(*ct_str++) {
-     case 'r':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
-+        ct->regs = 0xffffffff;
-         break;
-     case 'L': /* qemu_ld input arg constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
-+        ct->regs = 0xffffffff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
- #if defined(CONFIG_SOFTMMU)
-         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
-         }
- #endif
-         break;
-     case 'S': /* qemu_st constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
-+        ct->regs = 0xffffffff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
- #if defined(CONFIG_SOFTMMU)
-         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
-         } else {
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
-         }
- #endif
-         break;
-diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/ppc/tcg-target.c.inc
-+++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch (*ct_str++) {
-     case 'A': case 'B': case 'C': case 'D':
-         ct->ct |= TCG_CT_REG;
--        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
-+        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
-         break;
-     case 'r':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
-+        ct->regs = 0xffffffff;
-         break;
-     case 'v':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff00000000ull;
-+        ct->regs = 0xffffffff00000000ull;
-         break;
-     case 'L':                   /* qemu_ld constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-+        ct->regs = 0xffffffff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
- #ifdef CONFIG_SOFTMMU
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
- #endif
-         break;
-     case 'S':                   /* qemu_st constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-+        ct->regs = 0xffffffff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
- #ifdef CONFIG_SOFTMMU
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
- #endif
-         break;
-     case 'I':
-diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.c.inc
-+++ b/tcg/riscv/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch (*ct_str++) {
-     case 'r':
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
-+        ct->regs = 0xffffffff;
-         break;
-     case 'L':
-         /* qemu_ld/qemu_st constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
-+        ct->regs = 0xffffffff;
-         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
- #if defined(CONFIG_SOFTMMU)
--        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
--        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
--        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
--        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
--        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
-+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
-+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
-+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
-+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
-+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
- #endif
-         break;
-     case 'I':
-diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.c.inc
-+++ b/tcg/s390/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     switch (*ct_str++) {
-     case 'r':                  /* all registers */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffff;
-+        ct->regs = 0xffff;
-         break;
-     case 'L':                  /* qemu_ld/st constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffff;
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-+        ct->regs = 0xffff;
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
-         break;
-     case 'a':                  /* force R2 for division */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
-+        ct->regs = 0;
-+        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
-         break;
-     case 'b':                  /* force R3 for division */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0;
--        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
-+        ct->regs = 0;
-+        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
-         break;
-     case 'A':
-         ct->ct |= TCG_CT_CONST_S33;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *src_rw, int type,
-     switch (*ct_str++) {
-     case 'r':
+     switch (type) {
-         ct->ct |= TCG_CT_REG;
+     case R_SPARC_WDISP16:
--        ct->u.regs = 0xffffffff;
+-        assert(check_fit_ptr(pcrel >> 2, 16));
-+        ct->regs = 0xffffffff;
++        if (!check_fit_ptr(pcrel >> 2, 16)) {
 +            return false;
 +        }
          insn &= ~INSN_OFF16(-1);
          insn |= INSN_OFF16(pcrel);
          break;
-     case 'R':
+     case R_SPARC_WDISP19:
-         ct->ct |= TCG_CT_REG;
+-        assert(check_fit_ptr(pcrel >> 2, 19));
--        ct->u.regs = ALL_64;
++        if (!check_fit_ptr(pcrel >> 2, 19)) {
-+        ct->regs = ALL_64;
++            return false;
 +        }
          insn &= ~INSN_OFF19(-1);
          insn |= INSN_OFF19(pcrel);
          break;
-     case 'A': /* qemu_ld/st address constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
-+        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
-     reserve_helpers:
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
-         break;
-     case 's': /* qemu_st data 32-bit constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
-+        ct->regs = 0xffffffff;
-         goto reserve_helpers;
-     case 'S': /* qemu_st data 64-bit constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = ALL_64;
-+        ct->regs = ALL_64;
-         goto reserve_helpers;
-     case 'I':
-         ct->ct |= TCG_CT_CONST_S11;
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
-     case 'L':                   /* qemu_ld constraint */
-     case 'S':                   /* qemu_st constraint */
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
-+        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
-         break;
-     default:
-         return NULL;
 --
 .25.1

-[PULL 09/11] tcg/optimize: Fold dup2_vec
+[PULL 31/34] tcg/sparc: Use the constant pool for 64-bit constants
-When the two arguments are identical, this can be reduced to
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 dup_vec or to mov_vec from a tcg_constant_vec.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/optimize.c | 15 +++++++++++++++
+ tcg/sparc/tcg-target.c.inc | 15 +++++++++++++++
 file changed, 15 insertions(+)
-diff --git a/tcg/optimize.c b/tcg/optimize.c
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/optimize.c
+--- a/tcg/sparc/tcg-target.c.inc
-+++ b/tcg/optimize.c
++++ b/tcg/sparc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *src_rw, int type,
-             }
+         insn &= ~INSN_OFF19(-1);
-             goto do_default;
+         insn |= INSN_OFF19(pcrel);
+         break;
-+        case INDEX_op_dup2_vec:
++    case R_SPARC_13:
-+            assert(TCG_TARGET_REG_BITS == 32);
++        if (!check_fit_ptr(value, 13)) {
-+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
++            return false;
-+                tmp = arg_info(op->args[1])->val;
++        }
-+                if (tmp == arg_info(op->args[2])->val) {
++        insn &= ~INSN_IMM13(-1);
-+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
++        insn |= INSN_IMM13(value);
-+                    break;
++        break;
-+                }
+     default:
-+            } else if (args_are_copies(op->args[1], op->args[2])) {
+         g_assert_not_reached();
-+                op->opc = INDEX_op_dup_vec;
+     }
-+                TCGOP_VECE(op) = MO_32;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
-+                nb_iargs = 1;
+         return;
-+            }
+     }
-+            goto do_default;
 +    /* Use the constant pool, if possible. */
 +    if (!in_prologue && USE_REG_TB) {
 +        new_pool_label(s, arg, R_SPARC_13, s->code_ptr,
 +                       tcg_tbrel_diff(s, NULL));
 +        tcg_out32(s, LDX | INSN_RD(ret) | INSN_RS1(TCG_REG_TB));
 +        return;
 +    }
 +
-         CASE_OP_32_64(not):
+     /* A 64-bit constant decomposed into 2 32-bit pieces.  */
-         CASE_OP_32_64(neg):
+     if (check_fit_i32(lo, 13)) {
-         CASE_OP_32_64(ext8s):
+         hi = (arg - lo) >> 32;
 --
 .25.1

-New patch
+[PULL 32/34] tcg/sparc: Add tcg_out_jmpl_const for better tail calls
+Due to mapping changes, we now rarely place the code_gen_buffer
+near the main executable.  Which means that direct calls will
+now rarely be in range.
+So, always use indirect calls for tail calls, which allows us to
+avoid clobbering %o7, and therefore we need not save and restore it.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/sparc/tcg-target.c.inc | 37 +++++++++++++++++++++++--------------
+file changed, 23 insertions(+), 14 deletions(-)
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/sparc/tcg-target.c.inc
++++ b/tcg/sparc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
+     tcg_out_mov(s, TCG_TYPE_I64, rl, tmp);
+ }
++static void tcg_out_jmpl_const(TCGContext *s, const tcg_insn_unit *dest,
++                               bool in_prologue, bool tail_call)
++{
++    uintptr_t desti = (uintptr_t)dest;
++
++    /* Be careful not to clobber %o7 for a tail call. */
++    tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
++                     desti & ~0xfff, in_prologue,
++                     tail_call ? TCG_REG_G2 : TCG_REG_O7);
++    tcg_out_arithi(s, tail_call ? TCG_REG_G0 : TCG_REG_O7,
++                   TCG_REG_T1, desti & 0xfff, JMPL);
++}
++
+ static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
+                                  bool in_prologue)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
+     if (disp == (int32_t)disp) {
+         tcg_out32(s, CALL | (uint32_t)disp >> 2);
+     } else {
+-        uintptr_t desti = (uintptr_t)dest;
+-        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
+-                         desti & ~0xfff, in_prologue, TCG_REG_O7);
+-        tcg_out_arithi(s, TCG_REG_O7, TCG_REG_T1, desti & 0xfff, JMPL);
++        tcg_out_jmpl_const(s, dest, in_prologue, false);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
+         /* Set the retaddr operand.  */
+         tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
+-        /* Set the env operand.  */
+-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O0, TCG_AREG0);
+         /* Tail call.  */
+-        tcg_out_call_nodelay(s, qemu_ld_helpers[i], true);
+-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O7, ra);
++        tcg_out_jmpl_const(s, qemu_ld_helpers[i], true, true);
++        /* delay slot -- set the env argument */
++        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
+     }
+     for (i = 0; i < ARRAY_SIZE(qemu_st_helpers); ++i) {
+@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
+         if (ra >= TCG_REG_O6) {
+             tcg_out_st(s, TCG_TYPE_PTR, TCG_REG_O7, TCG_REG_CALL_STACK,
+                        TCG_TARGET_CALL_STACK_OFFSET);
+-            ra = TCG_REG_G1;
++        } else {
++            tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
+         }
+-        tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
+-        /* Set the env operand.  */
+-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O0, TCG_AREG0);
++
+         /* Tail call.  */
+-        tcg_out_call_nodelay(s, qemu_st_helpers[i], true);
+-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O7, ra);
++        tcg_out_jmpl_const(s, qemu_st_helpers[i], true, true);
++        /* delay slot -- set the env argument */
++        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
+     }
+ }
+ #endif
+--
+.25.1

-[PULL 08/11] tcg: Fix generation of dupi_vec for 32-bit host
+[PULL 33/34] tcg/sparc: Support unaligned access for user-only
-The definition of INDEX_op_dupi_vec is that it operates on
+This is kinda sorta the opposite of the other tcg hosts, where
-units of tcg_target_ulong -- in this case 32 bits.  It does
+we get (normal) alignment checks for free with host SIGBUS and
-not work to use this for a uint64_t value that happens to be
+need to add code to support unaligned accesses.
-small enough to fit in tcg_target_ulong.
+This inline code expansion is somewhat large, but it takes quite
-Fixes: d2fd745fe8b
+a few instructions to make a function call to a helper anyway.
-Fixes: db432672dc5
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-op-vec.c | 12 ++++++++----
+ tcg/sparc/tcg-target.c.inc | 219 +++++++++++++++++++++++++++++++++++--
-file changed, 8 insertions(+), 4 deletions(-)
+file changed, 211 insertions(+), 8 deletions(-)
-diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
+diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-vec.c
+--- a/tcg/sparc/tcg-target.c.inc
-+++ b/tcg/tcg-op-vec.c
++++ b/tcg/sparc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
+@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
+ #define ARITH_ADD  (INSN_OP(2) | INSN_OP3(0x00))
- void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
+ #define ARITH_ADDCC (INSN_OP(2) | INSN_OP3(0x10))
  #define ARITH_AND  (INSN_OP(2) | INSN_OP3(0x01))
 +#define ARITH_ANDCC (INSN_OP(2) | INSN_OP3(0x11))
  #define ARITH_ANDN (INSN_OP(2) | INSN_OP3(0x05))
  #define ARITH_OR   (INSN_OP(2) | INSN_OP3(0x02))
  #define ARITH_ORCC (INSN_OP(2) | INSN_OP3(0x12))
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
          tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
      }
  }
 +#else
 +static const tcg_insn_unit *qemu_unalign_ld_trampoline;
 +static const tcg_insn_unit *qemu_unalign_st_trampoline;
 +
 +static void build_trampolines(TCGContext *s)
 +{
 +    for (int ld = 0; ld < 2; ++ld) {
 +        void *helper;
 +
 +        while ((uintptr_t)s->code_ptr & 15) {
 +            tcg_out_nop(s);
 +        }
 +
 +        if (ld) {
 +            helper = helper_unaligned_ld;
 +            qemu_unalign_ld_trampoline = tcg_splitwx_to_rx(s->code_ptr);
 +        } else {
 +            helper = helper_unaligned_st;
 +            qemu_unalign_st_trampoline = tcg_splitwx_to_rx(s->code_ptr);
 +        }
 +
 +        if (!SPARC64 && TARGET_LONG_BITS == 64) {
 +            /* Install the high part of the address.  */
 +            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
 +        }
 +
 +        /* Tail call.  */
 +        tcg_out_jmpl_const(s, helper, true, true);
 +        /* delay slot -- set the env argument */
 +        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
 +    }
 +}
  #endif
  /* Generate global QEMU prologue and epilogue code */
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
      /* delay slot */
      tcg_out_movi_imm13(s, TCG_REG_O0, 0);
 -#ifdef CONFIG_SOFTMMU
      build_trampolines(s);
 -#endif
  }
  static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
  static const int qemu_ld_opc[(MO_SSIZE | MO_BSWAP) + 1] = {
      [MO_UB]   = LDUB,
      [MO_SB]   = LDSB,
 +    [MO_UB | MO_LE] = LDUB,
 +    [MO_SB | MO_LE] = LDSB,
      [MO_BEUW] = LDUH,
      [MO_BESW] = LDSH,
      [MO_BEUL] = LDUW,
      [MO_BESL] = LDSW,
      [MO_BEUQ] = LDX,
 +    [MO_BESQ] = LDX,
      [MO_LEUW] = LDUH_LE,
      [MO_LESW] = LDSH_LE,
      [MO_LEUL] = LDUW_LE,
      [MO_LESL] = LDSW_LE,
      [MO_LEUQ] = LDX_LE,
 +    [MO_LESQ] = LDX_LE,
  };
  static const int qemu_st_opc[(MO_SIZE | MO_BSWAP) + 1] = {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
                              MemOpIdx oi, bool is_64)
  {
--    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
+     MemOp memop = get_memop(oi);
--        do_dupi_vec(r, MO_32, a);
++    tcg_insn_unit *label_ptr;
--    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
++
-+    if (TCG_TARGET_REG_BITS == 64) {
+ #ifdef CONFIG_SOFTMMU
-         do_dupi_vec(r, MO_64, a);
+     unsigned memi = get_mmuidx(oi);
-+    } else if (a == dup_const(MO_32, a)) {
+     TCGReg addrz, param;
-+        do_dupi_vec(r, MO_32, a);
+     const tcg_insn_unit *func;
-     } else {
+-    tcg_insn_unit *label_ptr;
-         TCGv_i64 c = tcg_const_i64(a);
-         tcg_gen_dup_i64_vec(MO_64, r, c);
+     addrz = tcg_out_tlb_load(s, addr, memi, memop,
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
+                              offsetof(CPUTLBEntry, addr_read));
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
- void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
      *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
  #else
 +    TCGReg index = (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0);
 +    unsigned a_bits = get_alignment_bits(memop);
 +    unsigned s_bits = memop & MO_SIZE;
 +    unsigned t_bits;
 +
      if (SPARC64 && TARGET_LONG_BITS == 32) {
          tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
          addr = TCG_REG_T1;
      }
 -    tcg_out_ldst_rr(s, data, addr,
 -                    (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0),
 +
 +    /*
 +     * Normal case: alignment equal to access size.
 +     */
 +    if (a_bits == s_bits) {
 +        tcg_out_ldst_rr(s, data, addr, index,
 +                        qemu_ld_opc[memop & (MO_BSWAP | MO_SSIZE)]);
 +        return;
 +    }
 +
 +    /*
 +     * Test for at least natural alignment, and assume most accesses
 +     * will be aligned -- perform a straight load in the delay slot.
 +     * This is required to preserve atomicity for aligned accesses.
 +     */
 +    t_bits = MAX(a_bits, s_bits);
 +    tcg_debug_assert(t_bits < 13);
 +    tcg_out_arithi(s, TCG_REG_G0, addr, (1u << t_bits) - 1, ARITH_ANDCC);
 +
 +    /* beq,a,pt %icc, label */
 +    label_ptr = s->code_ptr;
 +    tcg_out_bpcc0(s, COND_E, BPCC_A | BPCC_PT | BPCC_ICC, 0);
 +    /* delay slot */
 +    tcg_out_ldst_rr(s, data, addr, index,
                      qemu_ld_opc[memop & (MO_BSWAP | MO_SSIZE)]);
 +
 +    if (a_bits >= s_bits) {
 +        /*
 +         * Overalignment: A successful alignment test will perform the memory
 +         * operation in the delay slot, and failure need only invoke the
 +         * handler for SIGBUS.
 +         */
 +        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
 +        tcg_out_call_nodelay(s, qemu_unalign_ld_trampoline, false);
 +        /* delay slot -- move to low part of argument reg */
 +        tcg_out_mov_delay(s, arg_low, addr);
 +    } else {
 +        /* Underalignment: load by pieces of minimum alignment. */
 +        int ld_opc, a_size, s_size, i;
 +
 +        /*
 +         * Force full address into T1 early; avoids problems with
 +         * overlap between @addr and @data.
 +         */
 +        tcg_out_arith(s, TCG_REG_T1, addr, index, ARITH_ADD);
 +
 +        a_size = 1 << a_bits;
 +        s_size = 1 << s_bits;
 +        if ((memop & MO_BSWAP) == MO_BE) {
 +            ld_opc = qemu_ld_opc[a_bits | MO_BE | (memop & MO_SIGN)];
 +            tcg_out_ldst(s, data, TCG_REG_T1, 0, ld_opc);
 +            ld_opc = qemu_ld_opc[a_bits | MO_BE];
 +            for (i = a_size; i < s_size; i += a_size) {
 +                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, ld_opc);
 +                tcg_out_arithi(s, data, data, a_size, SHIFT_SLLX);
 +                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
 +            }
 +        } else if (a_bits == 0) {
 +            ld_opc = LDUB;
 +            tcg_out_ldst(s, data, TCG_REG_T1, 0, ld_opc);
 +            for (i = a_size; i < s_size; i += a_size) {
 +                if ((memop & MO_SIGN) && i == s_size - a_size) {
 +                    ld_opc = LDSB;
 +                }
 +                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, ld_opc);
 +                tcg_out_arithi(s, TCG_REG_T2, TCG_REG_T2, i * 8, SHIFT_SLLX);
 +                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
 +            }
 +        } else {
 +            ld_opc = qemu_ld_opc[a_bits | MO_LE];
 +            tcg_out_ldst_rr(s, data, TCG_REG_T1, TCG_REG_G0, ld_opc);
 +            for (i = a_size; i < s_size; i += a_size) {
 +                tcg_out_arithi(s, TCG_REG_T1, TCG_REG_T1, a_size, ARITH_ADD);
 +                if ((memop & MO_SIGN) && i == s_size - a_size) {
 +                    ld_opc = qemu_ld_opc[a_bits | MO_LE | MO_SIGN];
 +                }
 +                tcg_out_ldst_rr(s, TCG_REG_T2, TCG_REG_T1, TCG_REG_G0, ld_opc);
 +                tcg_out_arithi(s, TCG_REG_T2, TCG_REG_T2, i * 8, SHIFT_SLLX);
 +                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
 +            }
 +        }
 +    }
 +
 +    *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
  #endif /* CONFIG_SOFTMMU */
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
                              MemOpIdx oi)
  {
--    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+     MemOp memop = get_memop(oi);
-+    if (vece == MO_64) {
++    tcg_insn_unit *label_ptr;
-+        tcg_gen_dup64i_vec(r, a);
++
  #ifdef CONFIG_SOFTMMU
      unsigned memi = get_mmuidx(oi);
      TCGReg addrz, param;
      const tcg_insn_unit *func;
 -    tcg_insn_unit *label_ptr;
      addrz = tcg_out_tlb_load(s, addr, memi, memop,
                               offsetof(CPUTLBEntry, addr_write));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
      *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
  #else
 +    TCGReg index = (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0);
 +    unsigned a_bits = get_alignment_bits(memop);
 +    unsigned s_bits = memop & MO_SIZE;
 +    unsigned t_bits;
 +
      if (SPARC64 && TARGET_LONG_BITS == 32) {
          tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
          addr = TCG_REG_T1;
      }
 -    tcg_out_ldst_rr(s, data, addr,
 -                    (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0),
 +
 +    /*
 +     * Normal case: alignment equal to access size.
 +     */
 +    if (a_bits == s_bits) {
 +        tcg_out_ldst_rr(s, data, addr, index,
 +                        qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]);
 +        return;
 +    }
 +
 +    /*
 +     * Test for at least natural alignment, and assume most accesses
 +     * will be aligned -- perform a straight store in the delay slot.
 +     * This is required to preserve atomicity for aligned accesses.
 +     */
 +    t_bits = MAX(a_bits, s_bits);
 +    tcg_debug_assert(t_bits < 13);
 +    tcg_out_arithi(s, TCG_REG_G0, addr, (1u << t_bits) - 1, ARITH_ANDCC);
 +
 +    /* beq,a,pt %icc, label */
 +    label_ptr = s->code_ptr;
 +    tcg_out_bpcc0(s, COND_E, BPCC_A | BPCC_PT | BPCC_ICC, 0);
 +    /* delay slot */
 +    tcg_out_ldst_rr(s, data, addr, index,
                      qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]);
 +
 +    if (a_bits >= s_bits) {
 +        /*
 +         * Overalignment: A successful alignment test will perform the memory
 +         * operation in the delay slot, and failure need only invoke the
 +         * handler for SIGBUS.
 +         */
 +        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
 +        tcg_out_call_nodelay(s, qemu_unalign_st_trampoline, false);
 +        /* delay slot -- move to low part of argument reg */
 +        tcg_out_mov_delay(s, arg_low, addr);
 +    } else {
-+        do_dupi_vec(r, MO_REG, dup_const(vece, a));
++        /* Underalignment: store by pieces of minimum alignment. */
-+    }
++        int st_opc, a_size, s_size, i;
 +
 +        /*
 +         * Force full address into T1 early; avoids problems with
 +         * overlap between @addr and @data.
 +         */
 +        tcg_out_arith(s, TCG_REG_T1, addr, index, ARITH_ADD);
 +
 +        a_size = 1 << a_bits;
 +        s_size = 1 << s_bits;
 +        if ((memop & MO_BSWAP) == MO_BE) {
 +            st_opc = qemu_st_opc[a_bits | MO_BE];
 +            for (i = 0; i < s_size; i += a_size) {
 +                TCGReg d = data;
 +                int shift = (s_size - a_size - i) * 8;
 +                if (shift) {
 +                    d = TCG_REG_T2;
 +                    tcg_out_arithi(s, d, data, shift, SHIFT_SRLX);
 +                }
 +                tcg_out_ldst(s, d, TCG_REG_T1, i, st_opc);
 +            }
 +        } else if (a_bits == 0) {
 +            tcg_out_ldst(s, data, TCG_REG_T1, 0, STB);
 +            for (i = 1; i < s_size; i++) {
 +                tcg_out_arithi(s, TCG_REG_T2, data, i * 8, SHIFT_SRLX);
 +                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, STB);
 +            }
 +        } else {
 +            /* Note that ST*A with immediate asi must use indexed address. */
 +            st_opc = qemu_st_opc[a_bits + MO_LE];
 +            tcg_out_ldst_rr(s, data, TCG_REG_T1, TCG_REG_G0, st_opc);
 +            for (i = a_size; i < s_size; i += a_size) {
 +                tcg_out_arithi(s, TCG_REG_T2, data, i * 8, SHIFT_SRLX);
 +                tcg_out_arithi(s, TCG_REG_T1, TCG_REG_T1, a_size, ARITH_ADD);
 +                tcg_out_ldst_rr(s, TCG_REG_T2, TCG_REG_T1, TCG_REG_G0, st_opc);
 +            }
 +        }
 +    }
 +
 +    *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
  #endif /* CONFIG_SOFTMMU */
  }
- void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
 --
 .25.1

-[PULL 11/11] accel/tcg: Fix computing of is_write for MIPS
+[PULL 34/34] tests/tcg/multiarch: Add sigbus.c
-From: Kele Huang <kele.hwang@gmail.com>
+A mostly generic test for unaligned access raising SIGBUS.
-Detect all MIPS store instructions in cpu_signal_handler for all available
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 MIPS versions, and set is_write if encountering such store instructions.
 This fixed the error while dealing with self-modified code for MIPS.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Kele Huang <kele.hwang@gmail.com>
 Signed-off-by: Xu Zou <iwatchnima@gmail.com>
 Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
 [rth: Use uintptr_t for pc to fix n32 build error.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
+ tests/tcg/multiarch/sigbus.c | 68 ++++++++++++++++++++++++++++++++++++
-file changed, 39 insertions(+), 4 deletions(-)
+file changed, 68 insertions(+)
  create mode 100644 tests/tcg/multiarch/sigbus.c
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+diff --git a/tests/tcg/multiarch/sigbus.c b/tests/tcg/multiarch/sigbus.c
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/accel/tcg/user-exec.c
+index XXXXXXX..XXXXXXX
-+++ b/accel/tcg/user-exec.c
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
++++ b/tests/tcg/multiarch/sigbus.c
+@@ -XXX,XX +XXX,XX @@
- #elif defined(__mips__)
++#define _GNU_SOURCE 1
++
-+#if defined(__misp16) || defined(__mips_micromips)
++#include <assert.h>
-+#error "Unsupported encoding"
++#include <stdlib.h>
 +#include <signal.h>
 +#include <endian.h>
 +
 +
 +unsigned long long x = 0x8877665544332211ull;
 +void * volatile p = (void *)&x + 1;
 +
 +void sigbus(int sig, siginfo_t *info, void *uc)
 +{
 +    assert(sig == SIGBUS);
 +    assert(info->si_signo == SIGBUS);
 +#ifdef BUS_ADRALN
 +    assert(info->si_code == BUS_ADRALN);
 +#endif
 +    assert(info->si_addr == p);
 +    exit(EXIT_SUCCESS);
 +}
 +
 +int main()
 +{
 +    struct sigaction sa = {
 +        .sa_sigaction = sigbus,
 +        .sa_flags = SA_SIGINFO
 +    };
 +    int allow_fail = 0;
 +    int tmp;
 +
 +    tmp = sigaction(SIGBUS, &sa, NULL);
 +    assert(tmp == 0);
 +
 +    /*
 +     * Select an operation that's likely to enforce alignment.
 +     * On many guests that support unaligned accesses by default,
 +     * this is often an atomic operation.
 +     */
 +#if defined(__aarch64__)
 +    asm volatile("ldxr %w0,[%1]" : "=r"(tmp) : "r"(p) : "memory");
 +#elif defined(__alpha__)
 +    asm volatile("ldl_l %0,0(%1)" : "=r"(tmp) : "r"(p) : "memory");
 +#elif defined(__arm__)
 +    asm volatile("ldrex %0,[%1]" : "=r"(tmp) : "r"(p) : "memory");
 +#elif defined(__powerpc__)
 +    asm volatile("lwarx %0,0,%1" : "=r"(tmp) : "r"(p) : "memory");
 +#elif defined(__riscv_atomic)
 +    asm volatile("lr.w %0,(%1)" : "=r"(tmp) : "r"(p) : "memory");
 +#else
 +    /* No insn known to fault unaligned -- try for a straight load. */
 +    allow_fail = 1;
 +    tmp = *(volatile int *)p;
 +#endif
 +
- int cpu_signal_handler(int host_signum, void *pinfo,
++    assert(allow_fail);
                         void *puc)
  {
      siginfo_t *info = pinfo;
      ucontext_t *uc = puc;
 -    greg_t pc = uc->uc_mcontext.pc;
 -    int is_write;
 +    uintptr_t pc = uc->uc_mcontext.pc;
 +    uint32_t insn = *(uint32_t *)pc;
 +    int is_write = 0;
 +
-+    /* Detect all store instructions at program counter. */
++    /*
-+    switch((insn >> 26) & 077) {
++     * We didn't see a signal.
-+    case 050: /* SB */
++     * We might as well validate the unaligned load worked.
-+    case 051: /* SH */
++     */
-+    case 052: /* SWL */
++    if (BYTE_ORDER == LITTLE_ENDIAN) {
-+    case 053: /* SW */
++        assert(tmp == 0x55443322);
-+    case 054: /* SDL */
++    } else {
-+    case 055: /* SDR */
++        assert(tmp == 0x77665544);
 +    case 056: /* SWR */
 +    case 070: /* SC */
 +    case 071: /* SWC1 */
 +    case 074: /* SCD */
 +    case 075: /* SDC1 */
 +    case 077: /* SD */
 +#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
 +    case 072: /* SWC2 */
 +    case 076: /* SDC2 */
 +#endif
 +        is_write = 1;
 +        break;
 +    case 023: /* COP1X */
 +        /* Required in all versions of MIPS64 since
 +           MIPS64r1 and subsequent versions of MIPS32r2. */
 +        switch (insn & 077) {
 +        case 010: /* SWXC1 */
 +        case 011: /* SDXC1 */
 +        case 015: /* SUXC1 */
 +            is_write = 1;
 +        }
 +        break;
 +    }
++    return EXIT_SUCCESS;
--    /* XXX: compute is_write */
++}
 -    is_write = 0;
      return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
  }
 --
 .25.1

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20201008

for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:

accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)

----------------------------------------------------------------
Extend maximum gvec vector size
Fix i386 avx2 dupi
Fix mips host user-only write detection
Misc cleanups.

----------------------------------------------------------------
Kele Huang (1):
      accel/tcg: Fix computing of is_write for MIPS

Richard Henderson (10):
      tcg: Adjust simd_desc size encoding
      tcg: Drop union from TCGArgConstraint
      tcg: Move sorted_args into TCGArgConstraint.sort_index
      tcg: Remove TCG_CT_REG
      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
      tcg: Remove TCGOpDef.used
      tcg/i386: Fix dupi for avx2 32-bit hosts
      tcg: Fix generation of dupi_vec for 32-bit host
      tcg/optimize: Fold dup2_vec
      tcg: Remove TCG_TARGET_HAS_cmp_vec

With larger vector sizes, it turns out oprsz == maxsz, and we only
need to represent mismatch for oprsz <= 32.  We do, however, need
to represent larger oprsz and do so without reducing SIMD_DATA_BITS.

Reduce the size of the oprsz field and increase the maxsz field.
Steal the oprsz value of 24 to indicate equality with maxsz.

Tested-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
 tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 2 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-gvec-desc.h
+++ b/include/tcg/tcg-gvec-desc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TCG_TCG_GVEC_DESC_H
 #define TCG_TCG_GVEC_DESC_H
 
-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
-#define SIMD_OPRSZ_SHIFT   0
-#define SIMD_OPRSZ_BITS    5
+/*
+ * This configuration allows MAXSZ to represent 2048 bytes, and
+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+ *
+ * Encode this with:
+ *   0, 1, 3 -> 8, 16, 32
+ *   2       -> maxsz
+ *
+ * This steals the input that would otherwise map to 24 to match maxsz.
+ */
+#define SIMD_MAXSZ_SHIFT   0
+#define SIMD_MAXSZ_BITS    8
 
-#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
-#define SIMD_MAXSZ_BITS    5
+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_OPRSZ_BITS    2
 
-#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
 
 /* Create a descriptor from components.  */
 uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 
-/* Extract the operation size from a descriptor.  */
-static inline intptr_t simd_oprsz(uint32_t desc)
-{
-    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
-}
-
 /* Extract the max vector size from a descriptor.  */
 static inline intptr_t simd_maxsz(uint32_t desc)
 {
-    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
+    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
+}
+
+/* Extract the operation size from a descriptor.  */
+static inline intptr_t simd_oprsz(uint32_t desc)
+{
+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+    intptr_t o = f * 8 + 8;
+    intptr_t m = simd_maxsz(desc);
+    return f == 2 ? m : o;
 }
 
 /* Extract the operation-specific data from a descriptor.  */
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
    of the operand offsets so that we can check them all at once.  */
 static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
 {
-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
-    tcg_debug_assert(oprsz > 0);
-    tcg_debug_assert(oprsz <= maxsz);
-    tcg_debug_assert((oprsz & opr_align) == 0);
+    uint32_t max_align;
+
+    switch (oprsz) {
+    case 8:
+    case 16:
+    case 32:
+        tcg_debug_assert(oprsz <= maxsz);
+        break;
+    default:
+        tcg_debug_assert(oprsz == maxsz);
+        break;
+    }
+    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
+
+    max_align = maxsz >= 16 ? 15 : 7;
     tcg_debug_assert((maxsz & max_align) == 0);
     tcg_debug_assert((ofs & max_align) == 0);
 }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
 {
     uint32_t desc = 0;
 
-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
+    check_size_align(oprsz, maxsz, 0);
+    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 
     oprsz = (oprsz / 8) - 1;
     maxsz = (maxsz / 8) - 1;
+
+    /*
+     * We have just asserted in check_size_align that either
+     * oprsz is {8,16,32} or matches maxsz.  Encode the final
+     * case with '2', as that would otherwise map to 24.
+     */
+    if (oprsz == maxsz) {
+        oprsz = 2;
+    }
+
     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
     desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
-- 
2.25.1

The union is unused; let "regs" appear in the main structure
without the "u.regs" wrapping.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h            |  4 +---
 tcg/tcg.c                    | 22 +++++++++++-----------
 tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
 tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
 tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
 tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
 tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
 tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
 tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
 tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
 tcg/tci/tcg-target.c.inc     |  2 +-
 11 files changed, 91 insertions(+), 93 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 typedef struct TCGArgConstraint {
     uint16_t ct;
     uint8_t alias_index;
-    union {
-        TCGRegSet regs;
-    } u;
+    TCGRegSet regs;
 } TCGArgConstraint;
 
 #define TCG_MAX_OP_ARGS 16
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
             return 0;
         n = 0;
         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->u.regs, i))
+            if (tcg_regset_test_reg(arg_ct->regs, i))
                 n++;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].u.regs = 0;
+            def->args_ct[i].regs = 0;
             def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     pset = la_temp_pref(ts);
                     set = *pset;
 
-                    set &= ct->u.regs;
+                    set &= ct->regs;
                     if (ct->ct & TCG_CT_IALIAS) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
                     if (set == 0) {
-                        set = ct->u.regs;
+                        set = ct->regs;
                     }
                     *pset = set;
                 }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
         return;
     }
 
-    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
-    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
+    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
+    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
 
     /* Allocate the output register now.  */
     if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             }
         }
 
-        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
+        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
         reg = ts->reg;
 
-        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
             /* nothing to do : the constraint is satisfied */
         } else {
         allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                and move the temporary register into it */
             temp_load(s, ts, tcg_target_available_regs[ts->type],
                       i_allocated_regs, 0);
-            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
+            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                 o_preferred_regs, ts->indirect_base);
             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
             } else if (arg_ct->ct & TCG_CT_NEWREG) {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             } else {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             }
             tcg_regset_set_reg(o_allocated_regs, reg);
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r': /* general registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffffu;
+        ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffff00000000ull;
+        ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffffu;
+        ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
            and x2, and x3 for helper args, better to avoid using them. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
 #endif
         break;
     case 'A': /* Valid for arithmetic immediate (positive or negative).  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
            so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
     /* qemu_st address & data */
     case 's':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 #if defined(CONFIG_SOFTMMU)
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 #if TARGET_LONG_BITS == 64
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #endif
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'a':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xf;
+        ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_GENERAL_REGS;
+        ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
         /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'x':
         /* A vector register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_VECTOR_REGS;
+        ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
         break;
 
     case 'e':
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
         }
 #endif
         break;
     case 'S': /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
         } else {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
         }
 #endif
         break;
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
+        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'v':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff00000000ull;
+        ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
 #endif
         break;
     case 'I':
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
 #endif
         break;
     case 'I':
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':                  /* all registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        ct->regs = 0xffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
     case 'A':
         ct->ct |= TCG_CT_CONST_S33;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'R':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
+        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
         ct->ct |= TCG_CT_CONST_S11;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
+        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
         return NULL;
-- 
2.25.1

This uses an existing hole in the TCGArgConstraint structure
and will be convenient for keeping the data in one place.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 +-
 tcg/tcg.c         | 35 +++++++++++++++++------------------
 2 files changed, 18 insertions(+), 19 deletions(-)

This wasn't actually used for anything, really.  All variable
operands must accept registers, and which are indicated by the
set in TCGArgConstraint.regs.

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 #define TCG_CT_ALIAS  0x80
 #define TCG_CT_IALIAS 0x40
 #define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_REG    0x01
 #define TCG_CT_CONST  0x02 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
 /* we give more priority to constraints with less registers */
 static int get_constraint_priority(const TCGOpDef *def, int k)
 {
-    const TCGArgConstraint *arg_ct;
+    const TCGArgConstraint *arg_ct = &def->args_ct[k];
+    int n;
 
-    int i, n;
-    arg_ct = &def->args_ct[k];
     if (arg_ct->ct & TCG_CT_ALIAS) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
-        if (!(arg_ct->ct & TCG_CT_REG))
-            return 0;
-        n = 0;
-        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->regs, i))
-                n++;
-        }
+        n = ctpop64(arg_ct->regs);
     }
     return TCG_TARGET_NB_REGS - n + 1;
 }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         int oarg = *ct_str - '0';
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
-                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
+                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                         /* TCG_CT_ALIAS is for the output arguments.
                            The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r': /* general registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
 
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     /* qemu_st address & data */
     case 's':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'a':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
     case 'x':
         /* A vector register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
         tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S': /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'v':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':                  /* all registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'R':
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
         tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'r':
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
-- 
2.25.1

These are easier to set and test when they have their own fields.
Reduce the size of alias_index and sort_index to 4 bits, which is
sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
constants within the ct field.

Move all initialization to allocation time, rather than init
individual fields in process_op_defs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 14 +++++++-------
 tcg/tcg.c         | 28 ++++++++++++----------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(void);
 void tcg_dump_op_count(void);
 
-#define TCG_CT_ALIAS  0x80
-#define TCG_CT_IALIAS 0x40
-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_CONST  0x02 /* any constant of register size */
+#define TCG_CT_CONST  1 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
-    uint16_t ct;
-    uint8_t alias_index;
-    uint8_t sort_index;
+    unsigned ct : 16;
+    unsigned alias_index : 4;
+    unsigned sort_index : 4;
+    bool oalias : 1;
+    bool ialias : 1;
+    bool newreg : 1;
     TCGRegSet regs;
 } TCGArgConstraint;
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
         total_args += n;
     }
 
-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    args_ct = g_new0(TCGArgConstraint, total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
     const TCGArgConstraint *arg_ct = &def->args_ct[k];
     int n;
 
-    if (arg_ct->ct & TCG_CT_ALIAS) {
+    if (arg_ct->oalias) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].regs = 0;
-            def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
                 case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
                         tcg_debug_assert(def->args_ct[oarg].regs != 0);
-                        /* TCG_CT_ALIAS is for the output arguments.
-                           The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
-                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
+                        /* The output sets oalias.  */
+                        def->args_ct[oarg].oalias = true;
                         def->args_ct[oarg].alias_index = i;
-                        def->args_ct[i].ct |= TCG_CT_IALIAS;
+                        /* The input sets ialias. */
+                        def->args_ct[i].ialias = true;
                         def->args_ct[i].alias_index = oarg;
                     }
                     ct_str++;
                     break;
                 case '&':
-                    def->args_ct[i].ct |= TCG_CT_NEWREG;
+                    def->args_ct[i].newreg = true;
                     ct_str++;
                     break;
                 case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     set = *pset;
 
                     set &= ct->regs;
-                    if (ct->ct & TCG_CT_IALIAS) {
+                    if (ct->ialias) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
 
         i_preferred_regs = o_preferred_regs = 0;
-        if (arg_ct->ct & TCG_CT_IALIAS) {
+        if (arg_ct->ialias) {
             o_preferred_regs = op->output_pref[arg_ct->alias_index];
             if (ts->fixed_reg) {
                 /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                     reg = ts->reg;
                     for (k2 = 0 ; k2 < k ; k2++) {
                         i2 = def->args_ct[nb_oargs + k2].sort_index;
-                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
-                            reg == new_args[i2]) {
+                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                             goto allocate_in_reg;
                         }
                     }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             /* ENV should not be modified.  */
             tcg_debug_assert(!ts->fixed_reg);
 
-            if ((arg_ct->ct & TCG_CT_ALIAS)
-                && !const_args[arg_ct->alias_index]) {
+            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
-            } else if (arg_ct->ct & TCG_CT_NEWREG) {
+            } else if (arg_ct->newreg) {
                 reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
-- 
2.25.1

The definition of INDEX_op_dupi_vec is that it operates on
units of tcg_target_ulong -- in this case 32 bits.  It does
not work to use this for a uint64_t value that happens to be
small enough to fit in tcg_target_ulong.

Fixes: d2fd745fe8b
Fixes: db432672dc5
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
 
 void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
 {
-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
-        do_dupi_vec(r, MO_32, a);
-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
+    if (TCG_TARGET_REG_BITS == 64) {
         do_dupi_vec(r, MO_64, a);
+    } else if (a == dup_const(MO_32, a)) {
+        do_dupi_vec(r, MO_32, a);
     } else {
         TCGv_i64 c = tcg_const_i64(a);
         tcg_gen_dup_i64_vec(MO_64, r, c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
 
 void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
 {
-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    if (vece == MO_64) {
+        tcg_gen_dup64i_vec(r, a);
+    } else {
+        do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    }
 }
 
 void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
-- 
2.25.1

When the two arguments are identical, this can be reduced to
dup_vec or to mov_vec from a tcg_constant_vec.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        case INDEX_op_dup2_vec:
+            assert(TCG_TARGET_REG_BITS == 32);
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                tmp = arg_info(op->args[1])->val;
+                if (tmp == arg_info(op->args[2])->val) {
+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                    break;
+                }
+            } else if (args_are_copies(op->args[1], op->args[2])) {
+                op->opc = INDEX_op_dup_vec;
+                TCGOP_VECE(op) = MO_32;
+                nb_iargs = 1;
+            }
+            goto do_default;
+
         CASE_OP_32_64(not):
         CASE_OP_32_64(neg):
         CASE_OP_32_64(ext8s):
-- 
2.25.1

The cmp_vec opcode is mandatory; this symbol is unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h | 1 -
 tcg/i386/tcg-target.h    | 1 -
 tcg/ppc/tcg-target.h     | 1 -
 3 files changed, 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          1
 #define TCG_TARGET_HAS_shv_vec          have_avx2
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
 #define TCG_TARGET_HAS_shi_vec          0
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
-- 
2.25.1

From: Kele Huang <kele.hwang@gmail.com>

Detect all MIPS store instructions in cpu_signal_handler for all available
MIPS versions, and set is_write if encountering such store instructions.

This fixed the error while dealing with self-modified code for MIPS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Kele Huang <kele.hwang@gmail.com>
Signed-off-by: Xu Zou <iwatchnima@gmail.com>
Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
[rth: Use uintptr_t for pc to fix n32 build error.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
 #elif defined(__mips__)
 
+#if defined(__misp16) || defined(__mips_micromips)
+#error "Unsupported encoding"
+#endif
+
 int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
     siginfo_t *info = pinfo;
     ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.pc;
-    int is_write;
+    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
+    int is_write = 0;
+
+    /* Detect all store instructions at program counter. */
+    switch((insn >> 26) & 077) {
+    case 050: /* SB */
+    case 051: /* SH */
+    case 052: /* SWL */
+    case 053: /* SW */
+    case 054: /* SDL */
+    case 055: /* SDR */
+    case 056: /* SWR */
+    case 070: /* SC */
+    case 071: /* SWC1 */
+    case 074: /* SCD */
+    case 075: /* SDC1 */
+    case 077: /* SD */
+#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
+    case 072: /* SWC2 */
+    case 076: /* SDC2 */
+#endif
+        is_write = 1;
+        break;
+    case 023: /* COP1X */
+        /* Required in all versions of MIPS64 since
+           MIPS64r1 and subsequent versions of MIPS32r2. */
+        switch (insn & 077) {
+        case 010: /* SWXC1 */
+        case 011: /* SDXC1 */
+        case 015: /* SUXC1 */
+            is_write = 1;
+        }
+        break;
+    }
 
-    /* XXX: compute is_write */
-    is_write = 0;
     return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }
 
-- 
2.25.1

The following changes since commit 0a301624c2f4ced3331ffd5bce85b4274fe132af:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220208' into staging (2022-02-08 11:40:08 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220211

for you to fetch changes up to 5c1a101ef6b85537a4ade93c39ea81cadd5c246e:

tests/tcg/multiarch: Add sigbus.c (2022-02-09 09:00:01 +1100)

----------------------------------------------------------------
Fix safe_syscall_base for sparc64.
Fix host signal handling for sparc64-linux.
Speedups for jump cache and work list probing.
Fix for exception replays.
Raise guest SIGBUS for user-only misaligned accesses.

----------------------------------------------------------------
Idan Horowitz (2):
      accel/tcg: Optimize jump cache flush during tlb range flush
      softmmu/cpus: Check if the cpu work list is empty atomically

Pavel Dovgalyuk (1):
      replay: use CF_NOIRQ for special exception-replaying TB

Richard Henderson (29):
      common-user/host/sparc64: Fix safe_syscall_base
      linux-user: Introduce host_signal_mask
      linux-user: Introduce host_sigcontext
      linux-user: Move sparc/host-signal.h to sparc64/host-signal.h
      linux-user/include/host/sparc64: Fix host_sigcontext
      tcg/i386: Support raising sigbus for user-only
      tcg/aarch64: Support raising sigbus for user-only
      tcg/ppc: Support raising sigbus for user-only
      tcg/riscv: Support raising sigbus for user-only
      tcg/s390x: Support raising sigbus for user-only
      tcg/tci: Support raising sigbus for user-only
      tcg/arm: Drop support for armv4 and armv5 hosts
      tcg/arm: Remove use_armv5t_instructions
      tcg/arm: Remove use_armv6_instructions
      tcg/arm: Check alignment for ldrd and strd
      tcg/arm: Support unaligned access for softmmu
      tcg/arm: Reserve a register for guest_base
      tcg/arm: Support raising sigbus for user-only
      tcg/mips: Support unaligned access for user-only
      tcg/mips: Support unaligned access for softmmu
      tcg/sparc: Use tcg_out_movi_imm13 in tcg_out_addsub2_i64
      tcg/sparc: Split out tcg_out_movi_imm32
      tcg/sparc: Add scratch argument to tcg_out_movi_int
      tcg/sparc: Improve code gen for shifted 32-bit constants
      tcg/sparc: Convert patch_reloc to return bool
      tcg/sparc: Use the constant pool for 64-bit constants
      tcg/sparc: Add tcg_out_jmpl_const for better tail calls
      tcg/sparc: Support unaligned access for user-only
      tests/tcg/multiarch: Add sigbus.c

WANG Xuerui (2):
      tcg/loongarch64: Fix fallout from recent MO_Q renaming
      tcg/loongarch64: Support raising sigbus for user-only

linux-user/include/host/aarch64/host-signal.h     |  16 +-
 linux-user/include/host/alpha/host-signal.h       |  14 +-
 linux-user/include/host/arm/host-signal.h         |  14 +-
 linux-user/include/host/i386/host-signal.h        |  14 +-
 linux-user/include/host/loongarch64/host-signal.h |  14 +-
 linux-user/include/host/mips/host-signal.h        |  14 +-
 linux-user/include/host/ppc/host-signal.h         |  14 +-
 linux-user/include/host/riscv/host-signal.h       |  14 +-
 linux-user/include/host/s390/host-signal.h        |  14 +-
 linux-user/include/host/sparc/host-signal.h       |  63 ----
 linux-user/include/host/sparc64/host-signal.h     |  65 +++-
 linux-user/include/host/x86_64/host-signal.h      |  14 +-
 tcg/aarch64/tcg-target.h                          |   2 -
 tcg/arm/tcg-target.h                              |   6 +-
 tcg/i386/tcg-target.h                             |   2 -
 tcg/loongarch64/tcg-target.h                      |   2 -
 tcg/mips/tcg-target.h                             |   2 -
 tcg/ppc/tcg-target.h                              |   2 -
 tcg/riscv/tcg-target.h                            |   2 -
 tcg/s390x/tcg-target.h                            |   2 -
 accel/tcg/cpu-exec.c                              |   3 +-
 accel/tcg/cputlb.c                                |   9 +
 linux-user/signal.c                               |  22 +-
 softmmu/cpus.c                                    |   7 +-
 tcg/tci.c                                         |  20 +-
 tests/tcg/multiarch/sigbus.c                      |  68 ++++
 tcg/aarch64/tcg-target.c.inc                      |  91 ++++-
 tcg/arm/tcg-target.c.inc                          | 410 +++++++++-------------
 tcg/i386/tcg-target.c.inc                         | 103 +++++-
 tcg/loongarch64/tcg-target.c.inc                  |  73 +++-
 tcg/mips/tcg-target.c.inc                         | 387 ++++++++++++++++++--
 tcg/ppc/tcg-target.c.inc                          |  98 +++++-
 tcg/riscv/tcg-target.c.inc                        |  63 +++-
 tcg/s390x/tcg-target.c.inc                        |  59 +++-
 tcg/sparc/tcg-target.c.inc                        | 348 +++++++++++++++---
 common-user/host/sparc64/safe-syscall.inc.S       |   5 +-
 36 files changed, 1561 insertions(+), 495 deletions(-)
 delete mode 100644 linux-user/include/host/sparc/host-signal.h
 create mode 100644 tests/tcg/multiarch/sigbus.c

Use the "retl" instead of "ret" instruction alias, since we
do not allocate a register window in this function.

Fix the offset to the first stacked parameter, which lies
beyond the register window save area.

Fixes: 95c021dac835 ("linux-user/host/sparc64: Add safe-syscall.inc.S")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 common-user/host/sparc64/safe-syscall.inc.S | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/common-user/host/sparc64/safe-syscall.inc.S b/common-user/host/sparc64/safe-syscall.inc.S
index XXXXXXX..XXXXXXX 100644
--- a/common-user/host/sparc64/safe-syscall.inc.S
+++ b/common-user/host/sparc64/safe-syscall.inc.S
@@ -XXX,XX +XXX,XX @@
         .type   safe_syscall_end, @function
 
 #define STACK_BIAS  2047
-#define PARAM(N)    STACK_BIAS + N*8
+#define WINDOW_SIZE 16 * 8
+#define PARAM(N)    STACK_BIAS + WINDOW_SIZE + N * 8
 
         /*
          * This is the entry point for making a system call. The calling
@@ -XXX,XX +XXX,XX @@ safe_syscall_end:
         /* code path for having successfully executed the syscall */
         bcs,pn  %xcc, 1f
          nop
-        ret
+        retl
          nop
 
         /* code path when we didn't execute the syscall */
-- 
2.25.1

Do not directly access the uc_sigmask member.
This is preparation for a sparc64 fix.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/include/host/aarch64/host-signal.h  |  5 +++++
 linux-user/include/host/alpha/host-signal.h    |  5 +++++
 linux-user/include/host/arm/host-signal.h      |  5 +++++
 linux-user/include/host/i386/host-signal.h     |  5 +++++
 .../include/host/loongarch64/host-signal.h     |  5 +++++
 linux-user/include/host/mips/host-signal.h     |  5 +++++
 linux-user/include/host/ppc/host-signal.h      |  5 +++++
 linux-user/include/host/riscv/host-signal.h    |  5 +++++
 linux-user/include/host/s390/host-signal.h     |  5 +++++
 linux-user/include/host/sparc/host-signal.h    |  5 +++++
 linux-user/include/host/x86_64/host-signal.h   |  5 +++++
 linux-user/signal.c                            | 18 ++++++++----------
 12 files changed, 63 insertions(+), 10 deletions(-)

Do not directly access ucontext_t as the third signal parameter.
This is preparation for a sparc64 fix.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/include/host/aarch64/host-signal.h     | 13 ++++++++-----
 linux-user/include/host/alpha/host-signal.h       | 11 +++++++----
 linux-user/include/host/arm/host-signal.h         | 11 +++++++----
 linux-user/include/host/i386/host-signal.h        | 11 +++++++----
 linux-user/include/host/loongarch64/host-signal.h | 11 +++++++----
 linux-user/include/host/mips/host-signal.h        | 11 +++++++----
 linux-user/include/host/ppc/host-signal.h         | 11 +++++++----
 linux-user/include/host/riscv/host-signal.h       | 11 +++++++----
 linux-user/include/host/s390/host-signal.h        | 11 +++++++----
 linux-user/include/host/sparc/host-signal.h       | 11 +++++++----
 linux-user/include/host/x86_64/host-signal.h      | 11 +++++++----
 linux-user/signal.c                               |  4 ++--
 12 files changed, 80 insertions(+), 47 deletions(-)

diff --git a/linux-user/include/host/aarch64/host-signal.h b/linux-user/include/host/aarch64/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/aarch64/host-signal.h
+++ b/linux-user/include/host/aarch64/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef AARCH64_HOST_SIGNAL_H
 #define AARCH64_HOST_SIGNAL_H
 
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
 /* Pre-3.16 kernel headers don't have these, so provide fallback definitions */
 #ifndef ESR_MAGIC
 #define ESR_MAGIC 0x45535201
@@ -XXX,XX +XXX,XX @@ struct esr_context {
 };
 #endif
 
-static inline struct _aarch64_ctx *first_ctx(ucontext_t *uc)
+static inline struct _aarch64_ctx *first_ctx(host_sigcontext *uc)
 {
     return (struct _aarch64_ctx *)&uc->uc_mcontext.__reserved;
 }
@@ -XXX,XX +XXX,XX @@ static inline struct _aarch64_ctx *next_ctx(struct _aarch64_ctx *hdr)
     return (struct _aarch64_ctx *)((char *)hdr + hdr->size);
 }
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.pc;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.pc = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     struct _aarch64_ctx *hdr;
     uint32_t insn;
diff --git a/linux-user/include/host/alpha/host-signal.h b/linux-user/include/host/alpha/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/alpha/host-signal.h
+++ b/linux-user/include/host/alpha/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ALPHA_HOST_SIGNAL_H
 #define ALPHA_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.sc_pc;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.sc_pc = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     uint32_t *pc = (uint32_t *)host_signal_pc(uc);
     uint32_t insn = *pc;
diff --git a/linux-user/include/host/arm/host-signal.h b/linux-user/include/host/arm/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/arm/host-signal.h
+++ b/linux-user/include/host/arm/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ARM_HOST_SIGNAL_H
 #define ARM_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.arm_pc;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.arm_pc = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     /*
      * In the FSR, bit 11 is WnR, assuming a v6 or
diff --git a/linux-user/include/host/i386/host-signal.h b/linux-user/include/host/i386/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/i386/host-signal.h
+++ b/linux-user/include/host/i386/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef I386_HOST_SIGNAL_H
 #define I386_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.gregs[REG_EIP];
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.gregs[REG_EIP] = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
         && (uc->uc_mcontext.gregs[REG_ERR] & 0x2);
diff --git a/linux-user/include/host/loongarch64/host-signal.h b/linux-user/include/host/loongarch64/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/loongarch64/host-signal.h
+++ b/linux-user/include/host/loongarch64/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef LOONGARCH64_HOST_SIGNAL_H
 #define LOONGARCH64_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.__pc;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.__pc = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     const uint32_t *pinsn = (const uint32_t *)host_signal_pc(uc);
     uint32_t insn = pinsn[0];
diff --git a/linux-user/include/host/mips/host-signal.h b/linux-user/include/host/mips/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/mips/host-signal.h
+++ b/linux-user/include/host/mips/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef MIPS_HOST_SIGNAL_H
 #define MIPS_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.pc;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.pc = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
@@ -XXX,XX +XXX,XX @@ static inline void *host_signal_mask(ucontext_t *uc)
 #error "Unsupported encoding"
 #endif
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     uint32_t insn = *(uint32_t *)host_signal_pc(uc);
 
diff --git a/linux-user/include/host/ppc/host-signal.h b/linux-user/include/host/ppc/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/ppc/host-signal.h
+++ b/linux-user/include/host/ppc/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef PPC_HOST_SIGNAL_H
 #define PPC_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.regs->nip;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.regs->nip = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     return uc->uc_mcontext.regs->trap != 0x400
         && (uc->uc_mcontext.regs->dsisr & 0x02000000);
diff --git a/linux-user/include/host/riscv/host-signal.h b/linux-user/include/host/riscv/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/riscv/host-signal.h
+++ b/linux-user/include/host/riscv/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef RISCV_HOST_SIGNAL_H
 #define RISCV_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.__gregs[REG_PC];
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.__gregs[REG_PC] = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     /*
      * Detect store by reading the instruction at the program counter.
diff --git a/linux-user/include/host/s390/host-signal.h b/linux-user/include/host/s390/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/s390/host-signal.h
+++ b/linux-user/include/host/s390/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef S390_HOST_SIGNAL_H
 #define S390_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.psw.addr;
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.psw.addr = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     uint16_t *pinsn = (uint16_t *)host_signal_pc(uc);
 
diff --git a/linux-user/include/host/sparc/host-signal.h b/linux-user/include/host/sparc/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/sparc/host-signal.h
+++ b/linux-user/include/host/sparc/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef SPARC_HOST_SIGNAL_H
 #define SPARC_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
 #ifdef __arch64__
     return uc->uc_mcontext.mc_gregs[MC_PC];
@@ -XXX,XX +XXX,XX @@ static inline uintptr_t host_signal_pc(ucontext_t *uc)
 #endif
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
 #ifdef __arch64__
     uc->uc_mcontext.mc_gregs[MC_PC] = pc;
@@ -XXX,XX +XXX,XX @@ static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
 #endif
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     uint32_t insn = *(uint32_t *)host_signal_pc(uc);
 
diff --git a/linux-user/include/host/x86_64/host-signal.h b/linux-user/include/host/x86_64/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/x86_64/host-signal.h
+++ b/linux-user/include/host/x86_64/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef X86_64_HOST_SIGNAL_H
 #define X86_64_HOST_SIGNAL_H
 
-static inline uintptr_t host_signal_pc(ucontext_t *uc)
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
 {
     return uc->uc_mcontext.gregs[REG_RIP];
 }
 
-static inline void host_signal_set_pc(ucontext_t *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
 {
     uc->uc_mcontext.gregs[REG_RIP] = pc;
 }
 
-static inline void *host_signal_mask(ucontext_t *uc)
+static inline void *host_signal_mask(host_sigcontext *uc)
 {
     return &uc->uc_sigmask;
 }
 
-static inline bool host_signal_write(siginfo_t *info, ucontext_t *uc)
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
 {
     return uc->uc_mcontext.gregs[REG_TRAPNO] == 0xe
         && (uc->uc_mcontext.gregs[REG_ERR] & 0x2);
diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ void queue_signal(CPUArchState *env, int sig, int si_type,
 /* Adjust the signal context to rewind out of safe-syscall if we're in it */
 static inline void rewind_if_in_safe_syscall(void *puc)
 {
-    ucontext_t *uc = (ucontext_t *)puc;
+    host_sigcontext *uc = (host_sigcontext *)puc;
     uintptr_t pcreg = host_signal_pc(uc);
 
     if (pcreg > (uintptr_t)safe_syscall_start
@@ -XXX,XX +XXX,XX @@ static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
     CPUState *cpu = env_cpu(env);
     TaskState *ts = cpu->opaque;
     target_siginfo_t tinfo;
-    ucontext_t *uc = puc;
+    host_sigcontext *uc = puc;
     struct emulated_sigtable *k;
     int guest_sig;
     uintptr_t pc = 0;
-- 
2.25.1

We do not support sparc32 as a host, so there's no point in
sparc64 redirecting to sparc.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/include/host/sparc/host-signal.h   | 71 -------------------
 linux-user/include/host/sparc64/host-signal.h | 64 ++++++++++++++++-
 2 files changed, 63 insertions(+), 72 deletions(-)
 delete mode 100644 linux-user/include/host/sparc/host-signal.h

diff --git a/linux-user/include/host/sparc/host-signal.h b/linux-user/include/host/sparc/host-signal.h
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/linux-user/include/host/sparc/host-signal.h
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * host-signal.h: signal info dependent on the host architecture
- *
- * Copyright (c) 2003-2005 Fabrice Bellard
- * Copyright (c) 2021 Linaro Limited
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#ifndef SPARC_HOST_SIGNAL_H
-#define SPARC_HOST_SIGNAL_H
-
-/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
-typedef ucontext_t host_sigcontext;
-
-static inline uintptr_t host_signal_pc(host_sigcontext *uc)
-{
-#ifdef __arch64__
-    return uc->uc_mcontext.mc_gregs[MC_PC];
-#else
-    return uc->uc_mcontext.gregs[REG_PC];
-#endif
-}
-
-static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
-{
-#ifdef __arch64__
-    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
-#else
-    uc->uc_mcontext.gregs[REG_PC] = pc;
-#endif
-}
-
-static inline void *host_signal_mask(host_sigcontext *uc)
-{
-    return &uc->uc_sigmask;
-}
-
-static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
-{
-    uint32_t insn = *(uint32_t *)host_signal_pc(uc);
-
-    if ((insn >> 30) == 3) {
-        switch ((insn >> 19) & 0x3f) {
-        case 0x05: /* stb */
-        case 0x15: /* stba */
-        case 0x06: /* sth */
-        case 0x16: /* stha */
-        case 0x04: /* st */
-        case 0x14: /* sta */
-        case 0x07: /* std */
-        case 0x17: /* stda */
-        case 0x0e: /* stx */
-        case 0x1e: /* stxa */
-        case 0x24: /* stf */
-        case 0x34: /* stfa */
-        case 0x27: /* stdf */
-        case 0x37: /* stdfa */
-        case 0x26: /* stqf */
-        case 0x36: /* stqfa */
-        case 0x25: /* stfsr */
-        case 0x3c: /* casa */
-        case 0x3e: /* casxa */
-            return true;
-        }
-    }
-    return false;
-}
-
-#endif
diff --git a/linux-user/include/host/sparc64/host-signal.h b/linux-user/include/host/sparc64/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/sparc64/host-signal.h
+++ b/linux-user/include/host/sparc64/host-signal.h
@@ -1 +1,63 @@
-#include "../sparc/host-signal.h"
+/*
+ * host-signal.h: signal info dependent on the host architecture
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef SPARC64_HOST_SIGNAL_H
+#define SPARC64_HOST_SIGNAL_H
+
+/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+{
+    return uc->uc_mcontext.mc_gregs[MC_PC];
+}
+
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+{
+    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
+}
+
+static inline void *host_signal_mask(host_sigcontext *uc)
+{
+    return &uc->uc_sigmask;
+}
+
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+{
+    uint32_t insn = *(uint32_t *)host_signal_pc(uc);
+
+    if ((insn >> 30) == 3) {
+        switch ((insn >> 19) & 0x3f) {
+        case 0x05: /* stb */
+        case 0x15: /* stba */
+        case 0x06: /* sth */
+        case 0x16: /* stha */
+        case 0x04: /* st */
+        case 0x14: /* sta */
+        case 0x07: /* std */
+        case 0x17: /* stda */
+        case 0x0e: /* stx */
+        case 0x1e: /* stxa */
+        case 0x24: /* stf */
+        case 0x34: /* stfa */
+        case 0x27: /* stdf */
+        case 0x37: /* stdfa */
+        case 0x26: /* stqf */
+        case 0x36: /* stqfa */
+        case 0x25: /* stfsr */
+        case 0x3c: /* casa */
+        case 0x3e: /* casxa */
+            return true;
+        }
+    }
+    return false;
+}
+
+#endif
-- 
2.25.1

Sparc64 is unique on linux in *not* passing ucontext_t as
the third argument to a SA_SIGINFO handler.  It passes the
old struct sigcontext instead.

Set both pc and npc in host_signal_set_pc.

Fixes: 8b5bd461935b ("linux-user/host/sparc: Populate host_signal.h")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/include/host/sparc64/host-signal.h | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/linux-user/include/host/sparc64/host-signal.h b/linux-user/include/host/sparc64/host-signal.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/include/host/sparc64/host-signal.h
+++ b/linux-user/include/host/sparc64/host-signal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef SPARC64_HOST_SIGNAL_H
 #define SPARC64_HOST_SIGNAL_H
 
-/* FIXME: the third argument to a SA_SIGINFO handler is *not* ucontext_t. */
-typedef ucontext_t host_sigcontext;
+/* The third argument to a SA_SIGINFO handler is struct sigcontext.  */
+typedef struct sigcontext host_sigcontext;
 
-static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+static inline uintptr_t host_signal_pc(host_sigcontext *sc)
 {
-    return uc->uc_mcontext.mc_gregs[MC_PC];
+    return sc->sigc_regs.tpc;
 }
 
-static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+static inline void host_signal_set_pc(host_sigcontext *sc, uintptr_t pc)
 {
-    uc->uc_mcontext.mc_gregs[MC_PC] = pc;
+    sc->sigc_regs.tpc = pc;
+    sc->sigc_regs.tnpc = pc + 4;
 }
 
-static inline void *host_signal_mask(host_sigcontext *uc)
+static inline void *host_signal_mask(host_sigcontext *sc)
 {
-    return &uc->uc_sigmask;
+    return &sc->sigc_mask;
 }
 
 static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

When the length of the range is large enough, clearing the whole cache is
faster than iterating over the (possibly extremely large) set of pages
contained in the range.

This mimics the pre-existing similar optimization done on the flush of the
tlb itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Message-Id: <20220110164754.1066025-1-idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
     }
     qemu_spin_unlock(&env_tlb(env)->c.lock);
 
+    /*
+     * If the length is larger than the jump cache size, then it will take
+     * longer to clear each entry individually than it will to clear it all.
+     */
+    if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
+        cpu_tb_jmp_cache_clear(cpu);
+        return;
+    }
+
     for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
         tb_flush_jmp_cache(cpu, d.addr + i);
     }
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

Instead of taking the lock of the cpu work list in order to check if it's
empty, we can just read the head pointer atomically. This decreases
cpu_work_list_empty's share from 5% to 1.3% in a profile of icount-enabled
aarch64-softmmu.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Message-Id: <20220114004358.299534-1-idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/cpus.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ bool cpu_is_stopped(CPUState *cpu)
 
 bool cpu_work_list_empty(CPUState *cpu)
 {
-    bool ret;
-
-    qemu_mutex_lock(&cpu->work_mutex);
-    ret = QSIMPLEQ_EMPTY(&cpu->work_list);
-    qemu_mutex_unlock(&cpu->work_mutex);
-    return ret;
+    return QSIMPLEQ_EMPTY_ATOMIC(&cpu->work_list);
 }
 
 bool cpu_thread_is_idle(CPUState *cpu)
-- 
2.25.1

From: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>

Commit aff0e204cb1f1c036a496c94c15f5dfafcd9b4b4 introduced CF_NOIRQ usage,
but one case was forgotten. Record/replay uses one special TB which is not
really executed, but used to cause a correct exception in replay mode.
This patch adds CF_NOIRQ flag for such block.

Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <164362834054.1754532.7678416881159817273.stgit@pasha-ThinkPad-X280>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_has_exception()
             && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0) {
             /* Execute just one insn to trigger exception pending in the log */
-            cpu->cflags_next_tb = (curr_cflags(cpu) & ~CF_USE_ICOUNT) | 1;
+            cpu->cflags_next_tb = (curr_cflags(cpu) & ~CF_USE_ICOUNT)
+                | CF_NOIRQ | 1;
         }
 #endif
         return false;
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |   2 -
 tcg/i386/tcg-target.c.inc | 103 ++++++++++++++++++++++++++++++++++++--
 2 files changed, 98 insertions(+), 7 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ static inline void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
 
 #define TCG_TARGET_HAS_MEMORY_BSWAP  have_movbe
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #endif
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
+#include "../tcg-ldst.c.inc"
 #include "../tcg-pool.c.inc"
 
 #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
 #define OPC_XCHG_ax_r32	(0x90)
 
-#define OPC_GRP3_Ev	(0xf7)
-#define OPC_GRP5	(0xff)
+#define OPC_GRP3_Eb     (0xf6)
+#define OPC_GRP3_Ev     (0xf7)
+#define OPC_GRP5        (0xff)
 #define OPC_GRP14       (0x73 | P_EXT | P_DATA16)
 
 /* Group 1 opcode extensions for 0x80-0x83.
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define SHIFT_SAR 7
 
 /* Group 3 opcode extensions for 0xf6, 0xf7.  To be used with OPC_GRP3.  */
+#define EXT3_TESTi 0
 #define EXT3_NOT   2
 #define EXT3_NEG   3
 #define EXT3_MUL   4
@@ -XXX,XX +XXX,XX @@ static void tcg_out_nopn(TCGContext *s, int n)
 }
 
 #if defined(CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     int mmu_idx, uintptr_t ra)
  */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_jmp(s, qemu_st_helpers[opc & (MO_BSWAP | MO_SIZE)]);
     return true;
 }
-#elif TCG_TARGET_REG_BITS == 32
+#else
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
+                                   TCGReg addrhi, unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *label;
+
+    /*
+     * We are expecting a_bits to max out at 7, so we can usually use testb.
+     * For i686, we have to use testl for %esi/%edi.
+     */
+    if (a_mask <= 0xff && (TCG_TARGET_REG_BITS == 64 || addrlo < 4)) {
+        tcg_out_modrm(s, OPC_GRP3_Eb | P_REXB_RM, EXT3_TESTi, addrlo);
+        tcg_out8(s, a_mask);
+    } else {
+        tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_TESTi, addrlo);
+        tcg_out32(s, a_mask);
+    }
+
+    /* jne slow_path */
+    tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
+
+    label = new_ldst_label(s);
+    label->is_ld = is_ld;
+    label->addrlo_reg = addrlo;
+    label->addrhi_reg = addrhi;
+    label->raddr = tcg_splitwx_to_rx(s->code_ptr + 4);
+    label->label_ptr[0] = s->code_ptr;
+
+    s->code_ptr += 4;
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    /* resolve label address */
+    tcg_patch32(l->label_ptr[0], s->code_ptr - l->label_ptr[0] - 4);
+
+    if (TCG_TARGET_REG_BITS == 32) {
+        int ofs = 0;
+
+        tcg_out_st(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP, ofs);
+        ofs += 4;
+
+        tcg_out_st(s, TCG_TYPE_I32, l->addrlo_reg, TCG_REG_ESP, ofs);
+        ofs += 4;
+        if (TARGET_LONG_BITS == 64) {
+            tcg_out_st(s, TCG_TYPE_I32, l->addrhi_reg, TCG_REG_ESP, ofs);
+            ofs += 4;
+        }
+
+        tcg_out_pushi(s, (uintptr_t)l->raddr);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_TL, tcg_target_call_iarg_regs[1],
+                    l->addrlo_reg);
+        tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
+
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RAX, (uintptr_t)l->raddr);
+        tcg_out_push(s, TCG_REG_RAX);
+    }
+
+    /* "Tail call" to the helper, with the return address back inline. */
+    tcg_out_jmp(s, (const void *)(l->is_ld ? helper_unaligned_ld
+                                  : helper_unaligned_st));
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+#if TCG_TARGET_REG_BITS == 32
 # define x86_guest_base_seg     0
 # define x86_guest_base_index   -1
 # define x86_guest_base_offset  guest_base
@@ -XXX,XX +XXX,XX @@ static inline int setup_guest_base_seg(void)
     return 0;
 }
 # endif
+#endif
 #endif /* SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
 #if defined(CONFIG_SOFTMMU)
     int mem_index;
     tcg_insn_unit *label_ptr[2];
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
     add_qemu_ldst_label(s, true, is64, oi, datalo, datahi, addrlo, addrhi,
                         s->code_ptr, label_ptr);
 #else
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
+    }
+
     tcg_out_qemu_ld_direct(s, datalo, datahi, addrlo, x86_guest_base_index,
                            x86_guest_base_offset, x86_guest_base_seg,
                            is64, opc);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
 #if defined(CONFIG_SOFTMMU)
     int mem_index;
     tcg_insn_unit *label_ptr[2];
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
     add_qemu_ldst_label(s, false, is64, oi, datalo, datahi, addrlo, addrhi,
                         s->code_ptr, label_ptr);
 #else
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
+    }
+
     tcg_out_qemu_st_direct(s, datalo, datahi, addrlo, x86_guest_base_index,
                            x86_guest_base_offset, x86_guest_base_seg, opc);
 #endif
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h     |  2 -
 tcg/aarch64/tcg-target.c.inc | 91 +++++++++++++++++++++++++++++-------
 2 files changed, 74 insertions(+), 19 deletions(-)

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #endif /* AARCH64_TCG_TARGET_H */
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * See the COPYING file in the top-level directory for details.
  */
 
+#include "../tcg-ldst.c.inc"
 #include "../tcg-pool.c.inc"
 #include "qemu/bitops.h"
 
@@ -XXX,XX +XXX,XX @@ typedef enum {
     I3404_ANDI      = 0x12000000,
     I3404_ORRI      = 0x32000000,
     I3404_EORI      = 0x52000000,
+    I3404_ANDSI     = 0x72000000,
 
     /* Move wide immediate instructions.  */
     I3405_MOVN      = 0x12800000,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_goto_long(TCGContext *s, const tcg_insn_unit *target)
     if (offset == sextract64(offset, 0, 26)) {
         tcg_out_insn(s, 3206, B, offset);
     } else {
-        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, (intptr_t)target);
-        tcg_out_insn(s, 3207, BR, TCG_REG_TMP);
+        /* Choose X9 as a call-clobbered non-LR temporary. */
+        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_X9, (intptr_t)target);
+        tcg_out_insn(s, 3207, BR, TCG_REG_X9);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_cltz(TCGContext *s, TCGType ext, TCGReg d,
     }
 }
 
-#ifdef CONFIG_SOFTMMU
-#include "../tcg-ldst.c.inc"
+static void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
+{
+    ptrdiff_t offset = tcg_pcrel_diff(s, target);
+    tcg_debug_assert(offset == sextract64(offset, 0, 21));
+    tcg_out_insn(s, 3406, ADR, rd, offset);
+}
 
+#ifdef CONFIG_SOFTMMU
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     MemOpIdx oi, uintptr_t ra)
  */
@@ -XXX,XX +XXX,XX @@ static void * const qemu_st_helpers[MO_SIZE + 1] = {
 #endif
 };
 
-static inline void tcg_out_adr(TCGContext *s, TCGReg rd, const void *target)
-{
-    ptrdiff_t offset = tcg_pcrel_diff(s, target);
-    tcg_debug_assert(offset == sextract64(offset, 0, 21));
-    tcg_out_insn(s, 3406, ADR, rd, offset);
-}
-
 static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 {
     MemOpIdx oi = lb->oi;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, MemOp opc,
     tcg_out_insn(s, 3202, B_C, TCG_COND_NE, 0);
 }
 
+#else
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
+                                   unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *label = new_ldst_label(s);
+
+    label->is_ld = is_ld;
+    label->addrlo_reg = addr_reg;
+
+    /* tst addr, #mask */
+    tcg_out_logicali(s, I3404_ANDSI, 0, TCG_REG_XZR, addr_reg, a_mask);
+
+    label->label_ptr[0] = s->code_ptr;
+
+    /* b.ne slow_path */
+    tcg_out_insn(s, 3202, B_C, TCG_COND_NE, 0);
+
+    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    if (!reloc_pc19(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_X1, l->addrlo_reg);
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_X0, TCG_AREG0);
+
+    /* "Tail call" to the helper, with the return address back inline. */
+    tcg_out_adr(s, TCG_REG_LR, l->raddr);
+    tcg_out_goto_long(s, (const void *)(l->is_ld ? helper_unaligned_ld
+                                        : helper_unaligned_st));
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
 #endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    /* Byte swapping is left to middle-end expansion. */
-    tcg_debug_assert((memop & MO_BSWAP) == 0);
-
     switch (memop & MO_SSIZE) {
     case MO_UB:
         tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                    TCGReg data_r, TCGReg addr_r,
                                    TCGType otype, TCGReg off_r)
 {
-    /* Byte swapping is left to middle-end expansion. */
-    tcg_debug_assert((memop & MO_BSWAP) == 0);
-
     switch (memop & MO_SIZE) {
     case MO_8:
         tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 {
     MemOp memop = get_memop(oi);
     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
+
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((memop & MO_BSWAP) == 0);
+
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
     tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     add_qemu_ldst_label(s, true, oi, ext, data_reg, addr_reg,
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
+    unsigned a_bits = get_alignment_bits(memop);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addr_reg, a_bits);
+    }
     if (USE_GUEST_BASE) {
         tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
                                TCG_REG_GUEST_BASE, otype, addr_reg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 {
     MemOp memop = get_memop(oi);
     const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
+
+    /* Byte swapping is left to middle-end expansion. */
+    tcg_debug_assert((memop & MO_BSWAP) == 0);
+
 #ifdef CONFIG_SOFTMMU
     unsigned mem_index = get_mmuidx(oi);
     tcg_insn_unit *label_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     add_qemu_ldst_label(s, false, oi, (memop & MO_SIZE)== MO_64,
                         data_reg, addr_reg, s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
+    unsigned a_bits = get_alignment_bits(memop);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addr_reg, a_bits);
+    }
     if (USE_GUEST_BASE) {
         tcg_out_qemu_st_direct(s, memop, data_reg,
                                TCG_REG_GUEST_BASE, otype, addr_reg);
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.h     |  2 -
 tcg/ppc/tcg-target.c.inc | 98 ++++++++++++++++++++++++++++++++++++----
 2 files changed, 90 insertions(+), 10 deletions(-)

diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 #define TCG_TARGET_DEFAULT_MO (0)
 #define TCG_TARGET_HAS_MEMORY_BSWAP     1
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #endif
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 
 #include "elf.h"
 #include "../tcg-pool.c.inc"
+#include "../tcg-ldst.c.inc"
 
 /*
  * Standardize on the _CALL_FOO symbols used by GCC:
@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
     }
 }
 
-static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
+static void tcg_out_call_int(TCGContext *s, int lk,
+                             const tcg_insn_unit *target)
 {
 #ifdef _CALL_AIX
     /* Look through the descriptor.  If the branch is in range, and we
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
 
     if (in_range_b(diff) && toc == (uint32_t)toc) {
         tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP1, toc);
-        tcg_out_b(s, LK, tgt);
+        tcg_out_b(s, lk, tgt);
     } else {
         /* Fold the low bits of the constant into the addresses below.  */
         intptr_t arg = (intptr_t)target;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R0, TCG_REG_TMP1, ofs);
         tcg_out32(s, MTSPR | RA(TCG_REG_R0) | CTR);
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_REG_TMP1, ofs + SZP);
-        tcg_out32(s, BCCTR | BO_ALWAYS | LK);
+        tcg_out32(s, BCCTR | BO_ALWAYS | lk);
     }
 #elif defined(_CALL_ELF) && _CALL_ELF == 2
     intptr_t diff;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
 
     diff = tcg_pcrel_diff(s, target);
     if (in_range_b(diff)) {
-        tcg_out_b(s, LK, target);
+        tcg_out_b(s, lk, target);
     } else {
         tcg_out32(s, MTSPR | RS(TCG_REG_R12) | CTR);
-        tcg_out32(s, BCCTR | BO_ALWAYS | LK);
+        tcg_out32(s, BCCTR | BO_ALWAYS | lk);
     }
 #else
-    tcg_out_b(s, LK, target);
+    tcg_out_b(s, lk, target);
 #endif
 }
 
+static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target)
+{
+    tcg_out_call_int(s, LK, target);
+}
+
 static const uint32_t qemu_ldx_opc[(MO_SSIZE + MO_BSWAP) + 1] = {
     [MO_UB] = LBZX,
     [MO_UW] = LHZX,
@@ -XXX,XX +XXX,XX @@ static const uint32_t qemu_exts_opc[4] = {
 };
 
 #if defined (CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 /* helper signature: helper_ld_mmu(CPUState *env, target_ulong addr,
  *                                 int mmu_idx, uintptr_t ra)
  */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_b(s, 0, lb->raddr);
     return true;
 }
+#else
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
+                                   TCGReg addrhi, unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *label = new_ldst_label(s);
+
+    label->is_ld = is_ld;
+    label->addrlo_reg = addrlo;
+    label->addrhi_reg = addrhi;
+
+    /* We are expecting a_bits to max out at 7, much lower than ANDI. */
+    tcg_debug_assert(a_bits < 16);
+    tcg_out32(s, ANDI | SAI(addrlo, TCG_REG_R0, a_mask));
+
+    label->label_ptr[0] = s->code_ptr;
+    tcg_out32(s, BC | BI(0, CR_EQ) | BO_COND_FALSE | LK);
+
+    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    if (!reloc_pc14(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
+        TCGReg arg = TCG_REG_R4;
+#ifdef TCG_TARGET_CALL_ALIGN_ARGS
+        arg |= 1;
+#endif
+        if (l->addrlo_reg != arg) {
+            tcg_out_mov(s, TCG_TYPE_I32, arg, l->addrhi_reg);
+            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, l->addrlo_reg);
+        } else if (l->addrhi_reg != arg + 1) {
+            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, l->addrlo_reg);
+            tcg_out_mov(s, TCG_TYPE_I32, arg, l->addrhi_reg);
+        } else {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R0, arg);
+            tcg_out_mov(s, TCG_TYPE_I32, arg, arg + 1);
+            tcg_out_mov(s, TCG_TYPE_I32, arg + 1, TCG_REG_R0);
+        }
+    } else {
+        tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R4, l->addrlo_reg);
+    }
+    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R3, TCG_AREG0);
+
+    /* "Tail call" to the helper, with the return address back inline. */
+    tcg_out_call_int(s, 0, (const void *)(l->is_ld ? helper_unaligned_ld
+                                          : helper_unaligned_st));
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
 #endif /* SOFTMMU */
 
 static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     tcg_insn_unit *label_ptr;
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 
     rbase = TCG_REG_R3;
 #else  /* !CONFIG_SOFTMMU */
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
+    }
     rbase = guest_base ? TCG_GUEST_BASE_REG : 0;
     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
         tcg_out_ext32u(s, TCG_REG_TMP1, addrlo);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
 #ifdef CONFIG_SOFTMMU
     int mem_index;
     tcg_insn_unit *label_ptr;
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
 
     rbase = TCG_REG_R3;
 #else  /* !CONFIG_SOFTMMU */
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
+    }
     rbase = guest_base ? TCG_GUEST_BASE_REG : 0;
     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
         tcg_out_ext32u(s, TCG_REG_TMP1, addrlo);
-- 
2.25.1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target.h     |  2 --
 tcg/riscv/tcg-target.c.inc | 63 ++++++++++++++++++++++++++++++++++++--
 2 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
 #define TCG_TARGET_DEFAULT_MO (0)
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #define TCG_TARGET_HAS_MEMORY_BSWAP 0
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
+#include "../tcg-ldst.c.inc"
 #include "../tcg-pool.c.inc"
 
 #ifdef CONFIG_DEBUG_TCG
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
  */
 
 #if defined(CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     MemOpIdx oi, uintptr_t ra)
  */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_goto(s, l->raddr);
     return true;
 }
+#else
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
+                                   unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *l = new_ldst_label(s);
+
+    l->is_ld = is_ld;
+    l->addrlo_reg = addr_reg;
+
+    /* We are expecting a_bits to max out at 7, so we can always use andi. */
+    tcg_debug_assert(a_bits < 12);
+    tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_TMP1, addr_reg, a_mask);
+
+    l->label_ptr[0] = s->code_ptr;
+    tcg_out_opc_branch(s, OPC_BNE, TCG_REG_TMP1, TCG_REG_ZERO, 0);
+
+    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    /* resolve label address */
+    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
+
+    /* tail call, with the return address back inline. */
+    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RA, (uintptr_t)l->raddr);
+    tcg_out_call_int(s, (const void *)(l->is_ld ? helper_unaligned_ld
+                                       : helper_unaligned_st), true);
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
 #endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
+#else
+    unsigned a_bits;
 #endif
     TCGReg base = TCG_REG_TMP0;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addr_regl, a_bits);
+    }
     if (guest_base != 0) {
         tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
+#else
+    unsigned a_bits;
 #endif
     TCGReg base = TCG_REG_TMP0;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addr_regl, a_bits);
+    }
     if (guest_base != 0) {
         tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target.h     |  2 --
 tcg/s390x/tcg-target.c.inc | 59 ++++++++++++++++++++++++++++++++++++--
 2 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -XXX,XX +XXX,XX @@ static inline void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
     /* no need to flush icache explicitly */
 }
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #endif
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
 #error "unsupported code generation mode"
 #endif
 
+#include "../tcg-ldst.c.inc"
 #include "../tcg-pool.c.inc"
 #include "elf.h"
 
@@ -XXX,XX +XXX,XX @@ typedef enum S390Opcode {
     RI_OIHL     = 0xa509,
     RI_OILH     = 0xa50a,
     RI_OILL     = 0xa50b,
+    RI_TMLL     = 0xa701,
 
     RIE_CGIJ    = 0xec7c,
     RIE_CGRJ    = 0xec64,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg data,
 }
 
 #if defined(CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 /* We're expecting to use a 20-bit negative offset on the tlb memory ops.  */
 QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) > 0);
 QEMU_BUILD_BUG_ON(TLB_MASK_TABLE_OFS(0) < -(1 << 19));
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     return true;
 }
 #else
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld,
+                                   TCGReg addrlo, unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *l = new_ldst_label(s);
+
+    l->is_ld = is_ld;
+    l->addrlo_reg = addrlo;
+
+    /* We are expecting a_bits to max out at 7, much lower than TMLL. */
+    tcg_debug_assert(a_bits < 16);
+    tcg_out_insn(s, RI, TMLL, addrlo, a_mask);
+
+    tcg_out16(s, RI_BRC | (7 << 4)); /* CC in {1,2,3} */
+    l->label_ptr[0] = s->code_ptr;
+    s->code_ptr += 1;
+
+    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    if (!patch_reloc(l->label_ptr[0], R_390_PC16DBL,
+                     (intptr_t)tcg_splitwx_to_rx(s->code_ptr), 2)) {
+        return false;
+    }
+
+    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_R3, l->addrlo_reg);
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R2, TCG_AREG0);
+
+    /* "Tail call" to the helper, with the return address back inline. */
+    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R14, (uintptr_t)l->raddr);
+    tgen_gotoi(s, S390_CC_ALWAYS, (const void *)(l->is_ld ? helper_unaligned_ld
+                                                 : helper_unaligned_st));
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
 static void tcg_prepare_user_ldst(TCGContext *s, TCGReg *addr_reg,
                                   TCGReg *index_reg, tcg_target_long *disp)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
 #else
     TCGReg index_reg;
     tcg_target_long disp;
+    unsigned a_bits = get_alignment_bits(opc);
 
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addr_reg, a_bits);
+    }
     tcg_prepare_user_ldst(s, &addr_reg, &index_reg, &disp);
     tcg_out_qemu_ld_direct(s, opc, data_reg, addr_reg, index_reg, disp);
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
 #else
     TCGReg index_reg;
     tcg_target_long disp;
+    unsigned a_bits = get_alignment_bits(opc);
 
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addr_reg, a_bits);
+    }
     tcg_prepare_user_ldst(s, &addr_reg, &index_reg, &disp);
     tcg_out_qemu_st_direct(s, opc, data_reg, addr_reg, index_reg, disp);
 #endif
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
                             MemOpIdx oi, const void *tb_ptr)
 {
-    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+    MemOp mop = get_memop(oi);
     uintptr_t ra = (uintptr_t)tb_ptr;
 
 #ifdef CONFIG_SOFTMMU
-    switch (mop) {
+    switch (mop & (MO_BSWAP | MO_SSIZE)) {
     case MO_UB:
         return helper_ret_ldub_mmu(env, taddr, oi, ra);
     case MO_SB:
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
     }
 #else
     void *haddr = g2h(env_cpu(env), taddr);
+    unsigned a_mask = (1u << get_alignment_bits(mop)) - 1;
     uint64_t ret;
 
     set_helper_retaddr(ra);
-    switch (mop) {
+    if (taddr & a_mask) {
+        helper_unaligned_ld(env, taddr);
+    }
+    switch (mop & (MO_BSWAP | MO_SSIZE)) {
     case MO_UB:
         ret = ldub_p(haddr);
         break;
@@ -XXX,XX +XXX,XX @@ static uint64_t tci_qemu_ld(CPUArchState *env, target_ulong taddr,
 static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
                         MemOpIdx oi, const void *tb_ptr)
 {
-    MemOp mop = get_memop(oi) & (MO_BSWAP | MO_SSIZE);
+    MemOp mop = get_memop(oi);
     uintptr_t ra = (uintptr_t)tb_ptr;
 
 #ifdef CONFIG_SOFTMMU
-    switch (mop) {
+    switch (mop & (MO_BSWAP | MO_SIZE)) {
     case MO_UB:
         helper_ret_stb_mmu(env, taddr, val, oi, ra);
         break;
@@ -XXX,XX +XXX,XX @@ static void tci_qemu_st(CPUArchState *env, target_ulong taddr, uint64_t val,
     }
 #else
     void *haddr = g2h(env_cpu(env), taddr);
+    unsigned a_mask = (1u << get_alignment_bits(mop)) - 1;
 
     set_helper_retaddr(ra);
-    switch (mop) {
+    if (taddr & a_mask) {
+        helper_unaligned_st(env, taddr);
+    }
+    switch (mop & (MO_BSWAP | MO_SIZE)) {
     case MO_UB:
         stb_p(haddr, val);
         break;
-- 
2.25.1

From: WANG Xuerui <git@xen0n.name>

Signed-off-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220106134238.3936163-1-git@xen0n.name>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.h     |  2 -
 tcg/loongarch64/tcg-target.c.inc | 71 +++++++++++++++++++++++++++++++-
 2 files changed, 69 insertions(+), 4 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.h
+++ b/tcg/loongarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
 #define TCG_TARGET_DEFAULT_MO (0)
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 
 #define TCG_TARGET_HAS_MEMORY_BSWAP 0
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
+#include "../tcg-ldst.c.inc"
+
 #ifdef CONFIG_DEBUG_TCG
 static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "zero",
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
  */
 
 #if defined(CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 /*
  * helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     MemOpIdx oi, uintptr_t ra)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
     return tcg_out_goto(s, l->raddr);
 }
+#else
+
+/*
+ * Alignment helpers for user-mode emulation
+ */
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addr_reg,
+                                   unsigned a_bits)
+{
+    TCGLabelQemuLdst *l = new_ldst_label(s);
+
+    l->is_ld = is_ld;
+    l->addrlo_reg = addr_reg;
+
+    /*
+     * Without micro-architecture details, we don't know which of bstrpick or
+     * andi is faster, so use bstrpick as it's not constrained by imm field
+     * width. (Not to say alignments >= 2^12 are going to happen any time
+     * soon, though)
+     */
+    tcg_out_opc_bstrpick_d(s, TCG_REG_TMP1, addr_reg, 0, a_bits - 1);
+
+    l->label_ptr[0] = s->code_ptr;
+    tcg_out_opc_bne(s, TCG_REG_TMP1, TCG_REG_ZERO, 0);
+
+    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    /* resolve label address */
+    if (!reloc_br_sk16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
+
+    /* tail call, with the return address back inline. */
+    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RA, (uintptr_t)l->raddr);
+    tcg_out_call_int(s, (const void *)(l->is_ld ? helper_unaligned_ld
+                                       : helper_unaligned_st), true);
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
 #endif /* CONFIG_SOFTMMU */
 
 /*
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
+#else
+    unsigned a_bits;
 #endif
     TCGReg base;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
                         data_regl, addr_regl,
                         s->code_ptr, label_ptr);
 #else
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addr_regl, a_bits);
+    }
     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
     TCGReg guest_base_reg = USE_GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_ZERO;
     tcg_out_qemu_ld_indexed(s, data_regl, base, guest_base_reg, opc, type);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[1];
+#else
+    unsigned a_bits;
 #endif
     TCGReg base;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
                         data_regl, addr_regl,
                         s->code_ptr, label_ptr);
 #else
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addr_regl, a_bits);
+    }
     base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
     TCGReg guest_base_reg = USE_GUEST_BASE ? TCG_GUEST_BASE_REG : TCG_REG_ZERO;
     tcg_out_qemu_st_indexed(s, data_regl, base, guest_base_reg, opc);
-- 
2.25.1

This is now always true, since we require armv6.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |  3 +--
 tcg/arm/tcg-target.c.inc | 35 ++++++-----------------------------
 2 files changed, 7 insertions(+), 31 deletions(-)

This is now always true, since we require armv6.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |   1 -
 tcg/arm/tcg-target.c.inc | 192 ++++++---------------------------------
 2 files changed, 27 insertions(+), 166 deletions(-)

diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 
 extern int arm_arch;
 
-#define use_armv6_instructions  (__ARM_ARCH >= 6 || arm_arch >= 6)
 #define use_armv7_instructions  (__ARM_ARCH >= 7 || arm_arch >= 7)
 
 #undef TCG_TARGET_STACK_GROWSUP
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
 static void tcg_out_mul32(TCGContext *s, ARMCond cond, TCGReg rd,
                           TCGReg rn, TCGReg rm)
 {
-    /* if ArchVersion() < 6 && d == n then UNPREDICTABLE;  */
-    if (!use_armv6_instructions && rd == rn) {
-        if (rd == rm) {
-            /* rd == rn == rm; copy an input to tmp first.  */
-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
-            rm = rn = TCG_REG_TMP;
-        } else {
-            rn = rm;
-            rm = rd;
-        }
-    }
     /* mul */
     tcg_out32(s, (cond << 28) | 0x90 | (rd << 16) | (rm << 8) | rn);
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mul32(TCGContext *s, ARMCond cond, TCGReg rd,
 static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
                             TCGReg rd1, TCGReg rn, TCGReg rm)
 {
-    /* if ArchVersion() < 6 && (dHi == n || dLo == n) then UNPREDICTABLE;  */
-    if (!use_armv6_instructions && (rd0 == rn || rd1 == rn)) {
-        if (rd0 == rm || rd1 == rm) {
-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
-            rn = TCG_REG_TMP;
-        } else {
-            TCGReg t = rn;
-            rn = rm;
-            rm = t;
-        }
-    }
     /* umull */
     tcg_out32(s, (cond << 28) | 0x00800090 |
               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
 static void tcg_out_smull32(TCGContext *s, ARMCond cond, TCGReg rd0,
                             TCGReg rd1, TCGReg rn, TCGReg rm)
 {
-    /* if ArchVersion() < 6 && (dHi == n || dLo == n) then UNPREDICTABLE;  */
-    if (!use_armv6_instructions && (rd0 == rn || rd1 == rn)) {
-        if (rd0 == rm || rd1 == rm) {
-            tcg_out_mov_reg(s, cond, TCG_REG_TMP, rn);
-            rn = TCG_REG_TMP;
-        } else {
-            TCGReg t = rn;
-            rn = rm;
-            rm = t;
-        }
-    }
     /* smull */
     tcg_out32(s, (cond << 28) | 0x00c00090 |
               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_udiv(TCGContext *s, ARMCond cond,
 
 static void tcg_out_ext8s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
-    if (use_armv6_instructions) {
-        /* sxtb */
-        tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rn, SHIFT_IMM_LSL(24));
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rd, SHIFT_IMM_ASR(24));
-    }
+    /* sxtb */
+    tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | rn);
 }
 
 static void __attribute__((unused))
@@ -XXX,XX +XXX,XX @@ tcg_out_ext8u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 
 static void tcg_out_ext16s(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
-    if (use_armv6_instructions) {
-        /* sxth */
-        tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rn, SHIFT_IMM_LSL(16));
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rd, SHIFT_IMM_ASR(16));
-    }
+    /* sxth */
+    tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | rn);
 }
 
 static void tcg_out_ext16u(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
-    if (use_armv6_instructions) {
-        /* uxth */
-        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rn, SHIFT_IMM_LSL(16));
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rd, SHIFT_IMM_LSR(16));
-    }
+    /* uxth */
+    tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rn);
 }
 
 static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
                             TCGReg rd, TCGReg rn, int flags)
 {
-    if (use_armv6_instructions) {
-        if (flags & TCG_BSWAP_OS) {
-            /* revsh */
-            tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
-            return;
-        }
-
-        /* rev16 */
-        tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
-        if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            /* uxth */
-            tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
-        }
+    if (flags & TCG_BSWAP_OS) {
+        /* revsh */
+        tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
         return;
     }
 
-    if (flags == 0) {
-        /*
-         * For stores, no input or output extension:
-         *                              rn  = xxAB
-         * lsr tmp, rn, #8              tmp = 0xxA
-         * and tmp, tmp, #0xff          tmp = 000A
-         * orr rd, tmp, rn, lsl #8      rd  = xABA
-         */
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_LSR(8));
-        tcg_out_dat_imm(s, cond, ARITH_AND, TCG_REG_TMP, TCG_REG_TMP, 0xff);
-        tcg_out_dat_reg(s, cond, ARITH_ORR,
-                        rd, TCG_REG_TMP, rn, SHIFT_IMM_LSL(8));
-        return;
+    /* rev16 */
+    tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
+    if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        /* uxth */
+        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
     }
-
-    /*
-     * Byte swap, leaving the result at the top of the register.
-     * We will then shift down, zero or sign-extending.
-     */
-    if (flags & TCG_BSWAP_IZ) {
-        /*
-         *                              rn  = 00AB
-         * ror tmp, rn, #8              tmp = B00A
-         * orr tmp, tmp, tmp, lsl #16   tmp = BA00
-         */
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, rn, SHIFT_IMM_ROR(8));
-        tcg_out_dat_reg(s, cond, ARITH_ORR,
-                        TCG_REG_TMP, TCG_REG_TMP, TCG_REG_TMP,
-                        SHIFT_IMM_LSL(16));
-    } else {
-        /*
-         *                              rn  = xxAB
-         * and tmp, rn, #0xff00         tmp = 00A0
-         * lsl tmp, tmp, #8             tmp = 0A00
-         * orr tmp, tmp, rn, lsl #24    tmp = BA00
-         */
-        tcg_out_dat_rI(s, cond, ARITH_AND, TCG_REG_TMP, rn, 0xff00, 1);
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        TCG_REG_TMP, 0, TCG_REG_TMP, SHIFT_IMM_LSL(8));
-        tcg_out_dat_reg(s, cond, ARITH_ORR,
-                        TCG_REG_TMP, TCG_REG_TMP, rn, SHIFT_IMM_LSL(24));
-    }
-    tcg_out_dat_reg(s, cond, ARITH_MOV, rd, 0, TCG_REG_TMP,
-                    (flags & TCG_BSWAP_OS
-                     ? SHIFT_IMM_ASR(8) : SHIFT_IMM_LSR(8)));
 }
 
 static void tcg_out_bswap32(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
-    if (use_armv6_instructions) {
-        /* rev */
-        tcg_out32(s, 0x06bf0f30 | (cond << 28) | (rd << 12) | rn);
-    } else {
-        tcg_out_dat_reg(s, cond, ARITH_EOR,
-                        TCG_REG_TMP, rn, rn, SHIFT_IMM_ROR(16));
-        tcg_out_dat_imm(s, cond, ARITH_BIC,
-                        TCG_REG_TMP, TCG_REG_TMP, 0xff | 0x800);
-        tcg_out_dat_reg(s, cond, ARITH_MOV,
-                        rd, 0, rn, SHIFT_IMM_ROR(8));
-        tcg_out_dat_reg(s, cond, ARITH_EOR,
-                        rd, rd, TCG_REG_TMP, SHIFT_IMM_LSR(8));
-    }
+    /* rev */
+    tcg_out32(s, 0x06bf0f30 | (cond << 28) | (rd << 12) | rn);
 }
 
 static void tcg_out_deposit(TCGContext *s, ARMCond cond, TCGReg rd,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
 {
     if (use_armv7_instructions) {
         tcg_out32(s, INSN_DMB_ISH);
-    } else if (use_armv6_instructions) {
+    } else {
         tcg_out32(s, INSN_DMB_MCR);
     }
 }
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_arg_reg64(TCGContext *s, TCGReg argreg,
     if (argreg & 1) {
         argreg++;
     }
-    if (use_armv6_instructions && argreg >= 4
-        && (arglo & 1) == 0 && arghi == arglo + 1) {
+    if (argreg >= 4 && (arglo & 1) == 0 && arghi == arglo + 1) {
         tcg_out_strd_8(s, COND_AL, arglo,
                        TCG_REG_CALL_STACK, (argreg - 4) * 4);
         return argreg + 2;
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
                    : offsetof(CPUTLBEntry, addr_write));
     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
-    int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
-    int table_off = fast_off + offsetof(CPUTLBDescFast, table);
     unsigned s_bits = opc & MO_SIZE;
     unsigned a_bits = get_alignment_bits(opc);
 
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
     }
 
     /* Load env_tlb(env)->f[mmu_idx].{mask,table} into {r0,r1}.  */
-    if (use_armv6_instructions) {
-        tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
-    } else {
-        tcg_out_ld(s, TCG_TYPE_I32, TCG_REG_R0, TCG_AREG0, mask_off);
-        tcg_out_ld(s, TCG_TYPE_I32, TCG_REG_R1, TCG_AREG0, table_off);
-    }
+    tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
 
     /* Extract the tlb index from the address into R0.  */
     tcg_out_dat_reg(s, COND_AL, ARITH_AND, TCG_REG_R0, TCG_REG_R0, addrlo,
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
      * Load the tlb comparator into R2/R3 and the fast path addend into R1.
      */
     if (cmp_off == 0) {
-        if (use_armv6_instructions && TARGET_LONG_BITS == 64) {
+        if (TARGET_LONG_BITS == 64) {
             tcg_out_ldrd_rwb(s, COND_AL, TCG_REG_R2, TCG_REG_R1, TCG_REG_R0);
         } else {
             tcg_out_ld32_rwb(s, COND_AL, TCG_REG_R2, TCG_REG_R1, TCG_REG_R0);
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
     } else {
         tcg_out_dat_reg(s, COND_AL, ARITH_ADD,
                         TCG_REG_R1, TCG_REG_R1, TCG_REG_R0, 0);
-        if (use_armv6_instructions && TARGET_LONG_BITS == 64) {
+        if (TARGET_LONG_BITS == 64) {
             tcg_out_ldrd_8(s, COND_AL, TCG_REG_R2, TCG_REG_R1, cmp_off);
         } else {
             tcg_out_ld32_12(s, COND_AL, TCG_REG_R2, TCG_REG_R1, cmp_off);
         }
     }
-    if (!use_armv6_instructions && TARGET_LONG_BITS == 64) {
-        tcg_out_ld32_12(s, COND_AL, TCG_REG_R3, TCG_REG_R1, cmp_off + 4);
-    }
 
     /* Load the tlb addend.  */
     tcg_out_ld32_12(s, COND_AL, TCG_REG_R1, TCG_REG_R1,
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     TCGReg argreg, datalo, datahi;
     MemOpIdx oi = lb->oi;
     MemOp opc = get_memop(oi);
-    void *func;
 
     if (!reloc_pc24(lb->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     argreg = tcg_out_arg_imm32(s, argreg, oi);
     argreg = tcg_out_arg_reg32(s, argreg, TCG_REG_R14);
 
-    /* For armv6 we can use the canonical unsigned helpers and minimize
-       icache usage.  For pre-armv6, use the signed helpers since we do
-       not have a single insn sign-extend.  */
-    if (use_armv6_instructions) {
-        func = qemu_ld_helpers[opc & MO_SIZE];
-    } else {
-        func = qemu_ld_helpers[opc & MO_SSIZE];
-        if (opc & MO_SIGN) {
-            opc = MO_UL;
-        }
-    }
-    tcg_out_call(s, func);
+    /* Use the canonical unsigned helpers and minimize icache usage. */
+    tcg_out_call(s, qemu_ld_helpers[opc & MO_SIZE]);
 
     datalo = lb->datalo_reg;
     datahi = lb->datahi_reg;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
         break;
     case MO_UQ:
         /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU && use_armv6_instructions
+        if (USING_SOFTMMU
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
         } else if (datalo != addend) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         break;
     case MO_UQ:
         /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU && use_armv6_instructions
+        if (USING_SOFTMMU
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
         } else if (datalo == addrlo) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
         break;
     case MO_64:
         /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU && use_armv6_instructions
+        if (USING_SOFTMMU
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
         } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         break;
     case MO_64:
         /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU && use_armv6_instructions
+        if (USING_SOFTMMU
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
         } else {
-- 
2.25.1

We will shortly allow the use of unaligned memory accesses,
and these require proper alignment.  Use get_alignment_bits
to verify and remove USING_SOFTMMU.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ bool use_idiv_instructions;
 bool use_neon_instructions;
 #endif
 
-/* ??? Ought to think about changing CONFIG_SOFTMMU to always defined.  */
-#ifdef CONFIG_SOFTMMU
-# define USING_SOFTMMU 1
-#else
-# define USING_SOFTMMU 0
-#endif
-
 #ifdef CONFIG_DEBUG_TCG
 static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "%r0",  "%r1",  "%r2",  "%r3",  "%r4",  "%r5",  "%r6",  "%r7",
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
         tcg_out_ld32_r(s, COND_AL, datalo, addrlo, addend);
         break;
     case MO_UQ:
-        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU
+        /* LDRD requires alignment; double-check that. */
+        if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
         } else if (datalo != addend) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         tcg_out_ld32_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_UQ:
-        /* Avoid ldrd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU
+        /* LDRD requires alignment; double-check that. */
+        if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_ldrd_8(s, COND_AL, datalo, addrlo, 0);
         } else if (datalo == addrlo) {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
         tcg_out_st32_r(s, cond, datalo, addrlo, addend);
         break;
     case MO_64:
-        /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU
+        /* STRD requires alignment; double-check that. */
+        if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
         } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
         tcg_out_st32_12(s, COND_AL, datalo, addrlo, 0);
         break;
     case MO_64:
-        /* Avoid strd for user-only emulation, to handle unaligned.  */
-        if (USING_SOFTMMU
+        /* STRD requires alignment; double-check that. */
+        if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
         } else {
-- 
2.25.1

From armv6, the architecture supports unaligned accesses.
All we need to do is perform the correct alignment check
in tcg_out_tlb_read.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 41 ++++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
                    : offsetof(CPUTLBEntry, addr_write));
     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
-    unsigned s_bits = opc & MO_SIZE;
-    unsigned a_bits = get_alignment_bits(opc);
-
-    /*
-     * We don't support inline unaligned acceses, but we can easily
-     * support overalignment checks.
-     */
-    if (a_bits < s_bits) {
-        a_bits = s_bits;
-    }
+    unsigned s_mask = (1 << (opc & MO_SIZE)) - 1;
+    unsigned a_mask = (1 << get_alignment_bits(opc)) - 1;
+    TCGReg t_addr;
 
     /* Load env_tlb(env)->f[mmu_idx].{mask,table} into {r0,r1}.  */
     tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_read(TCGContext *s, TCGReg addrlo, TCGReg addrhi,
 
     /*
      * Check alignment, check comparators.
-     * Do this in no more than 3 insns.  Use MOVW for v7, if possible,
+     * Do this in 2-4 insns.  Use MOVW for v7, if possible,
      * to reduce the number of sequential conditional instructions.
      * Almost all guests have at least 4k pages, which means that we need
      * to clear at least 9 bits even for an 8-byte memory, which means it
      * isn't worth checking for an immediate operand for BIC.
+     *
+     * For unaligned accesses, test the page of the last unit of alignment.
+     * This leaves the least significant alignment bits unchanged, and of
+     * course must be zero.
      */
+    t_addr = addrlo;
+    if (a_mask < s_mask) {
+        t_addr = TCG_REG_R0;
+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, t_addr,
+                        addrlo, s_mask - a_mask);
+    }
     if (use_armv7_instructions && TARGET_PAGE_BITS <= 16) {
-        tcg_target_ulong mask = ~(TARGET_PAGE_MASK | ((1 << a_bits) - 1));
-
-        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, mask);
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, ~(TARGET_PAGE_MASK | a_mask));
         tcg_out_dat_reg(s, COND_AL, ARITH_BIC, TCG_REG_TMP,
-                        addrlo, TCG_REG_TMP, 0);
+                        t_addr, TCG_REG_TMP, 0);
         tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0, TCG_REG_R2, TCG_REG_TMP, 0);
     } else {
-        if (a_bits) {
-            tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo,
-                            (1 << a_bits) - 1);
+        if (a_mask) {
+            tcg_debug_assert(a_mask <= 0xff);
+            tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo, a_mask);
         }
-        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0, addrlo,
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0, t_addr,
                         SHIFT_IMM_LSR(TARGET_PAGE_BITS));
-        tcg_out_dat_reg(s, (a_bits ? COND_EQ : COND_AL), ARITH_CMP,
+        tcg_out_dat_reg(s, (a_mask ? COND_EQ : COND_AL), ARITH_CMP,
                         0, TCG_REG_R2, TCG_REG_TMP,
                         SHIFT_IMM_LSL(TARGET_PAGE_BITS));
     }
-- 
2.25.1

Reserve a register for the guest_base using aarch64 for reference.
By doing so, we do not have to recompute it for every memory load.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[2] = {
 
 #define TCG_REG_TMP  TCG_REG_R12
 #define TCG_VEC_TMP  TCG_REG_Q15
+#ifndef CONFIG_SOFTMMU
+#define TCG_REG_GUEST_BASE  TCG_REG_R11
+#endif
 
 typedef enum {
     COND_EQ = 0x0,
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
 
 static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
                                   TCGReg datalo, TCGReg datahi,
-                                  TCGReg addrlo, TCGReg addend)
+                                  TCGReg addrlo, TCGReg addend,
+                                  bool scratch_addend)
 {
     /* Byte swapping is left to middle-end expansion. */
     tcg_debug_assert((opc & MO_BSWAP) == 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
         if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_ldrd_r(s, COND_AL, datalo, addrlo, addend);
-        } else if (datalo != addend) {
+        } else if (scratch_addend) {
             tcg_out_ld32_rwb(s, COND_AL, datalo, addend, addrlo);
             tcg_out_ld32_12(s, COND_AL, datahi, addend, 4);
         } else {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
     label_ptr = s->code_ptr;
     tcg_out_bl_imm(s, COND_NE, 0);
 
-    tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, addend);
+    tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, addend, true);
 
     add_qemu_ldst_label(s, true, oi, datalo, datahi, addrlo, addrhi,
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
     if (guest_base) {
-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, guest_base);
-        tcg_out_qemu_ld_index(s, opc, datalo, datahi, addrlo, TCG_REG_TMP);
+        tcg_out_qemu_ld_index(s, opc, datalo, datahi,
+                              addrlo, TCG_REG_GUEST_BASE, false);
     } else {
         tcg_out_qemu_ld_direct(s, opc, datalo, datahi, addrlo);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
 
 static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
                                   TCGReg datalo, TCGReg datahi,
-                                  TCGReg addrlo, TCGReg addend)
+                                  TCGReg addrlo, TCGReg addend,
+                                  bool scratch_addend)
 {
     /* Byte swapping is left to middle-end expansion. */
     tcg_debug_assert((opc & MO_BSWAP) == 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_index(TCGContext *s, ARMCond cond, MemOp opc,
         if (get_alignment_bits(opc) >= MO_64
             && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
-        } else {
+        } else if (scratch_addend) {
             tcg_out_st32_rwb(s, cond, datalo, addend, addrlo);
             tcg_out_st32_12(s, cond, datahi, addend, 4);
+        } else {
+            tcg_out_dat_reg(s, cond, ARITH_ADD, TCG_REG_TMP,
+                            addend, addrlo, SHIFT_IMM_LSL(0));
+            tcg_out_st32_12(s, cond, datalo, TCG_REG_TMP, 0);
+            tcg_out_st32_12(s, cond, datahi, TCG_REG_TMP, 4);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
     mem_index = get_mmuidx(oi);
     addend = tcg_out_tlb_read(s, addrlo, addrhi, opc, mem_index, 0);
 
-    tcg_out_qemu_st_index(s, COND_EQ, opc, datalo, datahi, addrlo, addend);
+    tcg_out_qemu_st_index(s, COND_EQ, opc, datalo, datahi,
+                          addrlo, addend, true);
 
     /* The conditional call must come last, as we're going to return here.  */
     label_ptr = s->code_ptr;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
     if (guest_base) {
-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, guest_base);
-        tcg_out_qemu_st_index(s, COND_AL, opc, datalo,
-                              datahi, addrlo, TCG_REG_TMP);
+        tcg_out_qemu_st_index(s, COND_AL, opc, datalo, datahi,
+                              addrlo, TCG_REG_GUEST_BASE, false);
     } else {
         tcg_out_qemu_st_direct(s, opc, datalo, datahi, addrlo);
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
 
     tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
 
+#ifndef CONFIG_SOFTMMU
+    if (guest_base) {
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_GUEST_BASE, guest_base);
+        tcg_regset_set_reg(s->reserved_regs, TCG_REG_GUEST_BASE);
+    }
+#endif
+
     tcg_out_b_reg(s, COND_AL, tcg_target_call_iarg_regs[1]);
 
     /*
-- 
2.25.1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.h     |  2 -
 tcg/arm/tcg-target.c.inc | 83 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 81 insertions(+), 4 deletions(-)

diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
 /* not defined -- call should be eliminated at compile time */
 void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t);
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 #define TCG_TARGET_NEED_POOL_LABELS
 
 #endif
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "elf.h"
+#include "../tcg-ldst.c.inc"
 #include "../tcg-pool.c.inc"
 
 int arm_arch = __ARM_ARCH;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vldst(TCGContext *s, ARMInsn insn,
 }
 
 #ifdef CONFIG_SOFTMMU
-#include "../tcg-ldst.c.inc"
-
 /* helper signature: helper_ret_ld_mmu(CPUState *env, target_ulong addr,
  *                                     int mmu_idx, uintptr_t ra)
  */
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
     tcg_out_goto(s, COND_AL, qemu_st_helpers[opc & MO_SIZE]);
     return true;
 }
+#else
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
+                                   TCGReg addrhi, unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *label = new_ldst_label(s);
+
+    label->is_ld = is_ld;
+    label->addrlo_reg = addrlo;
+    label->addrhi_reg = addrhi;
+
+    /* We are expecting a_bits to max out at 7, and can easily support 8. */
+    tcg_debug_assert(a_mask <= 0xff);
+    /* tst addr, #mask */
+    tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addrlo, a_mask);
+
+    /* blne slow_path */
+    label->label_ptr[0] = s->code_ptr;
+    tcg_out_bl_imm(s, COND_NE, 0);
+
+    label->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    if (!reloc_pc24(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    if (TARGET_LONG_BITS == 64) {
+        /* 64-bit target address is aligned into R2:R3. */
+        if (l->addrhi_reg != TCG_REG_R2) {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, l->addrlo_reg);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, l->addrhi_reg);
+        } else if (l->addrlo_reg != TCG_REG_R3) {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, l->addrhi_reg);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, l->addrlo_reg);
+        } else {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R1, TCG_REG_R2);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R2, TCG_REG_R3);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R3, TCG_REG_R1);
+        }
+    } else {
+        tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R1, l->addrlo_reg);
+    }
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_R0, TCG_AREG0);
+
+    /*
+     * Tail call to the helper, with the return address back inline,
+     * just for the clarity of the debugging traceback -- the helper
+     * cannot return.  We have used BLNE to arrive here, so LR is
+     * already set.
+     */
+    tcg_out_goto(s, COND_AL, (const void *)
+                 (l->is_ld ? helper_unaligned_ld : helper_unaligned_st));
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
 #endif /* SOFTMMU */
 
 static void tcg_out_qemu_ld_index(TCGContext *s, MemOp opc,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
     int mem_index;
     TCGReg addend;
     tcg_insn_unit *label_ptr;
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is64)
     add_qemu_ldst_label(s, true, oi, datalo, datahi, addrlo, addrhi,
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, true, addrlo, addrhi, a_bits);
+    }
     if (guest_base) {
         tcg_out_qemu_ld_index(s, opc, datalo, datahi,
                               addrlo, TCG_REG_GUEST_BASE, false);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
     int mem_index;
     TCGReg addend;
     tcg_insn_unit *label_ptr;
+#else
+    unsigned a_bits;
 #endif
 
     datalo = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
     add_qemu_ldst_label(s, false, oi, datalo, datahi, addrlo, addrhi,
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
+    a_bits = get_alignment_bits(opc);
+    if (a_bits) {
+        tcg_out_test_alignment(s, false, addrlo, addrhi, a_bits);
+    }
     if (guest_base) {
         tcg_out_qemu_st_index(s, COND_AL, opc, datalo, datahi,
                               addrlo, TCG_REG_GUEST_BASE, false);
-- 
2.25.1

This is kinda sorta the opposite of the other tcg hosts, where
we get (normal) alignment checks for free with host SIGBUS and
need to add code to support unaligned accesses.

Fortunately, the ISA contains pairs of instructions that are
used to implement unaligned memory accesses.  Use them.

Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.h     |   2 -
 tcg/mips/tcg-target.c.inc | 334 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 328 insertions(+), 8 deletions(-)

diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_mips32r2_instructions;
 void tb_target_set_jmp_target(uintptr_t, uintptr_t, uintptr_t, uintptr_t)
     QEMU_ERROR("code path is reachable");
 
-#ifdef CONFIG_SOFTMMU
 #define TCG_TARGET_NEED_LDST_LABELS
-#endif
 
 #endif
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@
  * THE SOFTWARE.
  */
 
+#include "../tcg-ldst.c.inc"
+
 #ifdef HOST_WORDS_BIGENDIAN
 # define MIPS_BE  1
 #else
@@ -XXX,XX +XXX,XX @@ typedef enum {
     OPC_ORI      = 015 << 26,
     OPC_XORI     = 016 << 26,
     OPC_LUI      = 017 << 26,
+    OPC_BNEL     = 025 << 26,
+    OPC_BNEZALC_R6 = 030 << 26,
     OPC_DADDIU   = 031 << 26,
+    OPC_LDL      = 032 << 26,
+    OPC_LDR      = 033 << 26,
     OPC_LB       = 040 << 26,
     OPC_LH       = 041 << 26,
+    OPC_LWL      = 042 << 26,
     OPC_LW       = 043 << 26,
     OPC_LBU      = 044 << 26,
     OPC_LHU      = 045 << 26,
+    OPC_LWR      = 046 << 26,
     OPC_LWU      = 047 << 26,
     OPC_SB       = 050 << 26,
     OPC_SH       = 051 << 26,
+    OPC_SWL      = 052 << 26,
     OPC_SW       = 053 << 26,
+    OPC_SDL      = 054 << 26,
+    OPC_SDR      = 055 << 26,
+    OPC_SWR      = 056 << 26,
     OPC_LD       = 067 << 26,
     OPC_SD       = 077 << 26,
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
 }
 
 #if defined(CONFIG_SOFTMMU)
-#include "../tcg-ldst.c.inc"
-
 static void * const qemu_ld_helpers[(MO_SSIZE | MO_BSWAP) + 1] = {
     [MO_UB]   = helper_ret_ldub_mmu,
     [MO_SB]   = helper_ret_ldsb_mmu,
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0);
     return true;
 }
-#endif
+
+#else
+
+static void tcg_out_test_alignment(TCGContext *s, bool is_ld, TCGReg addrlo,
+                                   TCGReg addrhi, unsigned a_bits)
+{
+    unsigned a_mask = (1 << a_bits) - 1;
+    TCGLabelQemuLdst *l = new_ldst_label(s);
+
+    l->is_ld = is_ld;
+    l->addrlo_reg = addrlo;
+    l->addrhi_reg = addrhi;
+
+    /* We are expecting a_bits to max out at 7, much lower than ANDI. */
+    tcg_debug_assert(a_bits < 16);
+    tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, addrlo, a_mask);
+
+    l->label_ptr[0] = s->code_ptr;
+    if (use_mips32r6_instructions) {
+        tcg_out_opc_br(s, OPC_BNEZALC_R6, TCG_REG_ZERO, TCG_TMP0);
+    } else {
+        tcg_out_opc_br(s, OPC_BNEL, TCG_TMP0, TCG_REG_ZERO);
+        tcg_out_nop(s);
+    }
+
+    l->raddr = tcg_splitwx_to_rx(s->code_ptr);
+}
+
+static bool tcg_out_fail_alignment(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    void *target;
+
+    if (!reloc_pc16(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+        return false;
+    }
+
+    if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
+        /* A0 is env, A1 is skipped, A2:A3 is the uint64_t address. */
+        TCGReg a2 = MIPS_BE ? l->addrhi_reg : l->addrlo_reg;
+        TCGReg a3 = MIPS_BE ? l->addrlo_reg : l->addrhi_reg;
+
+        if (a3 != TCG_REG_A2) {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, a2);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, a3);
+        } else if (a2 != TCG_REG_A3) {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, a3);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, a2);
+        } else {
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_TMP0, TCG_REG_A2);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A2, TCG_REG_A3);
+            tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_A3, TCG_TMP0);
+        }
+    } else {
+        tcg_out_mov(s, TCG_TYPE_TL, TCG_REG_A1, l->addrlo_reg);
+    }
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_A0, TCG_AREG0);
+
+    /*
+     * Tail call to the helper, with the return address back inline.
+     * We have arrived here via BNEL, so $31 is already set.
+     */
+    target = (l->is_ld ? helper_unaligned_ld : helper_unaligned_st);
+    tcg_out_call_int(s, target, true);
+    return true;
+}
+
+static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+
+static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+{
+    return tcg_out_fail_alignment(s, l);
+}
+#endif /* SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                    TCGReg base, MemOp opc, bool is_64)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
+static void __attribute__((unused))
+tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
+                                    TCGReg base, MemOp opc, bool is_64)
+{
+    const MIPSInsn lw1 = MIPS_BE ? OPC_LWL : OPC_LWR;
+    const MIPSInsn lw2 = MIPS_BE ? OPC_LWR : OPC_LWL;
+    const MIPSInsn ld1 = MIPS_BE ? OPC_LDL : OPC_LDR;
+    const MIPSInsn ld2 = MIPS_BE ? OPC_LDR : OPC_LDL;
+
+    bool sgn = (opc & MO_SIGN);
+
+    switch (opc & (MO_SSIZE | MO_BSWAP)) {
+    case MO_SW | MO_BE:
+    case MO_UW | MO_BE:
+        tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP0, base, 0);
+        tcg_out_opc_imm(s, OPC_LBU, lo, base, 1);
+        if (use_mips32r2_instructions) {
+            tcg_out_opc_bf(s, OPC_INS, lo, TCG_TMP0, 31, 8);
+        } else {
+            tcg_out_opc_sa(s, OPC_SLL, TCG_TMP0, TCG_TMP0, 8);
+            tcg_out_opc_reg(s, OPC_OR, lo, TCG_TMP0, TCG_TMP1);
+        }
+        break;
+
+    case MO_SW | MO_LE:
+    case MO_UW | MO_LE:
+        if (use_mips32r2_instructions && lo != base) {
+            tcg_out_opc_imm(s, OPC_LBU, lo, base, 0);
+            tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP0, base, 1);
+            tcg_out_opc_bf(s, OPC_INS, lo, TCG_TMP0, 31, 8);
+        } else {
+            tcg_out_opc_imm(s, OPC_LBU, TCG_TMP0, base, 0);
+            tcg_out_opc_imm(s, sgn ? OPC_LB : OPC_LBU, TCG_TMP1, base, 1);
+            tcg_out_opc_sa(s, OPC_SLL, TCG_TMP1, TCG_TMP1, 8);
+            tcg_out_opc_reg(s, OPC_OR, lo, TCG_TMP0, TCG_TMP1);
+        }
+        break;
+
+    case MO_SL:
+    case MO_UL:
+        tcg_out_opc_imm(s, lw1, lo, base, 0);
+        tcg_out_opc_imm(s, lw2, lo, base, 3);
+        if (TCG_TARGET_REG_BITS == 64 && is_64 && !sgn) {
+            tcg_out_ext32u(s, lo, lo);
+        }
+        break;
+
+    case MO_UL | MO_BSWAP:
+    case MO_SL | MO_BSWAP:
+        if (use_mips32r2_instructions) {
+            tcg_out_opc_imm(s, lw1, lo, base, 0);
+            tcg_out_opc_imm(s, lw2, lo, base, 3);
+            tcg_out_bswap32(s, lo, lo,
+                            TCG_TARGET_REG_BITS == 64 && is_64
+                            ? (sgn ? TCG_BSWAP_OS : TCG_BSWAP_OZ) : 0);
+        } else {
+            const tcg_insn_unit *subr =
+                (TCG_TARGET_REG_BITS == 64 && is_64 && !sgn
+                 ? bswap32u_addr : bswap32_addr);
+
+            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0);
+            tcg_out_bswap_subr(s, subr);
+            /* delay slot */
+            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 3);
+            tcg_out_mov(s, is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32, lo, TCG_TMP3);
+        }
+        break;
+
+    case MO_UQ:
+        if (TCG_TARGET_REG_BITS == 64) {
+            tcg_out_opc_imm(s, ld1, lo, base, 0);
+            tcg_out_opc_imm(s, ld2, lo, base, 7);
+        } else {
+            tcg_out_opc_imm(s, lw1, MIPS_BE ? hi : lo, base, 0 + 0);
+            tcg_out_opc_imm(s, lw2, MIPS_BE ? hi : lo, base, 0 + 3);
+            tcg_out_opc_imm(s, lw1, MIPS_BE ? lo : hi, base, 4 + 0);
+            tcg_out_opc_imm(s, lw2, MIPS_BE ? lo : hi, base, 4 + 3);
+        }
+        break;
+
+    case MO_UQ | MO_BSWAP:
+        if (TCG_TARGET_REG_BITS == 64) {
+            if (use_mips32r2_instructions) {
+                tcg_out_opc_imm(s, ld1, lo, base, 0);
+                tcg_out_opc_imm(s, ld2, lo, base, 7);
+                tcg_out_bswap64(s, lo, lo);
+            } else {
+                tcg_out_opc_imm(s, ld1, TCG_TMP0, base, 0);
+                tcg_out_bswap_subr(s, bswap64_addr);
+                /* delay slot */
+                tcg_out_opc_imm(s, ld2, TCG_TMP0, base, 7);
+                tcg_out_mov(s, TCG_TYPE_I64, lo, TCG_TMP3);
+            }
+        } else if (use_mips32r2_instructions) {
+            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0 + 0);
+            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 0 + 3);
+            tcg_out_opc_imm(s, lw1, TCG_TMP1, base, 4 + 0);
+            tcg_out_opc_imm(s, lw2, TCG_TMP1, base, 4 + 3);
+            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP0, 0, TCG_TMP0);
+            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP1, 0, TCG_TMP1);
+            tcg_out_opc_sa(s, OPC_ROTR, MIPS_BE ? lo : hi, TCG_TMP0, 16);
+            tcg_out_opc_sa(s, OPC_ROTR, MIPS_BE ? hi : lo, TCG_TMP1, 16);
+        } else {
+            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 0 + 0);
+            tcg_out_bswap_subr(s, bswap32_addr);
+            /* delay slot */
+            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 0 + 3);
+            tcg_out_opc_imm(s, lw1, TCG_TMP0, base, 4 + 0);
+            tcg_out_mov(s, TCG_TYPE_I32, MIPS_BE ? lo : hi, TCG_TMP3);
+            tcg_out_bswap_subr(s, bswap32_addr);
+            /* delay slot */
+            tcg_out_opc_imm(s, lw2, TCG_TMP0, base, 4 + 3);
+            tcg_out_mov(s, TCG_TYPE_I32, MIPS_BE ? hi : lo, TCG_TMP3);
+        }
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 {
     TCGReg addr_regl, addr_regh __attribute__((unused));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
+#else
+    unsigned a_bits, s_bits;
 #endif
     TCGReg base = TCG_REG_A0;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     } else {
         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
-    tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+    a_bits = get_alignment_bits(opc);
+    s_bits = opc & MO_SIZE;
+    /*
+     * R6 removes the left/right instructions but requires the
+     * system to support misaligned memory accesses.
+     */
+    if (use_mips32r6_instructions) {
+        if (a_bits) {
+            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
+        }
+        tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+    } else {
+        if (a_bits && a_bits != s_bits) {
+            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
+        }
+        if (a_bits >= s_bits) {
+            tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+        } else {
+            tcg_out_qemu_ld_unalign(s, data_regl, data_regh, base, opc, is_64);
+        }
+    }
 #endif
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
+static void __attribute__((unused))
+tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
+                                    TCGReg base, MemOp opc)
+{
+    const MIPSInsn sw1 = MIPS_BE ? OPC_SWL : OPC_SWR;
+    const MIPSInsn sw2 = MIPS_BE ? OPC_SWR : OPC_SWL;
+    const MIPSInsn sd1 = MIPS_BE ? OPC_SDL : OPC_SDR;
+    const MIPSInsn sd2 = MIPS_BE ? OPC_SDR : OPC_SDL;
+
+    /* Don't clutter the code below with checks to avoid bswapping ZERO.  */
+    if ((lo | hi) == 0) {
+        opc &= ~MO_BSWAP;
+    }
+
+    switch (opc & (MO_SIZE | MO_BSWAP)) {
+    case MO_16 | MO_BE:
+        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, lo, 8);
+        tcg_out_opc_imm(s, OPC_SB, TCG_TMP0, base, 0);
+        tcg_out_opc_imm(s, OPC_SB, lo, base, 1);
+        break;
+
+    case MO_16 | MO_LE:
+        tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, lo, 8);
+        tcg_out_opc_imm(s, OPC_SB, lo, base, 0);
+        tcg_out_opc_imm(s, OPC_SB, TCG_TMP0, base, 1);
+        break;
+
+    case MO_32 | MO_BSWAP:
+        tcg_out_bswap32(s, TCG_TMP3, lo, 0);
+        lo = TCG_TMP3;
+        /* fall through */
+    case MO_32:
+        tcg_out_opc_imm(s, sw1, lo, base, 0);
+        tcg_out_opc_imm(s, sw2, lo, base, 3);
+        break;
+
+    case MO_64 | MO_BSWAP:
+        if (TCG_TARGET_REG_BITS == 64) {
+            tcg_out_bswap64(s, TCG_TMP3, lo);
+            lo = TCG_TMP3;
+        } else if (use_mips32r2_instructions) {
+            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP0, 0, MIPS_BE ? hi : lo);
+            tcg_out_opc_reg(s, OPC_WSBH, TCG_TMP1, 0, MIPS_BE ? lo : hi);
+            tcg_out_opc_sa(s, OPC_ROTR, TCG_TMP0, TCG_TMP0, 16);
+            tcg_out_opc_sa(s, OPC_ROTR, TCG_TMP1, TCG_TMP1, 16);
+            hi = MIPS_BE ? TCG_TMP0 : TCG_TMP1;
+            lo = MIPS_BE ? TCG_TMP1 : TCG_TMP0;
+        } else {
+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? lo : hi, 0);
+            tcg_out_opc_imm(s, sw1, TCG_TMP3, base, 0 + 0);
+            tcg_out_opc_imm(s, sw2, TCG_TMP3, base, 0 + 3);
+            tcg_out_bswap32(s, TCG_TMP3, MIPS_BE ? hi : lo, 0);
+            tcg_out_opc_imm(s, sw1, TCG_TMP3, base, 4 + 0);
+            tcg_out_opc_imm(s, sw2, TCG_TMP3, base, 4 + 3);
+            break;
+        }
+        /* fall through */
+    case MO_64:
+        if (TCG_TARGET_REG_BITS == 64) {
+            tcg_out_opc_imm(s, sd1, lo, base, 0);
+            tcg_out_opc_imm(s, sd2, lo, base, 7);
+        } else {
+            tcg_out_opc_imm(s, sw1, MIPS_BE ? hi : lo, base, 0 + 0);
+            tcg_out_opc_imm(s, sw2, MIPS_BE ? hi : lo, base, 0 + 3);
+            tcg_out_opc_imm(s, sw1, MIPS_BE ? lo : hi, base, 4 + 0);
+            tcg_out_opc_imm(s, sw2, MIPS_BE ? lo : hi, base, 4 + 3);
+        }
+        break;
+
+    default:
+        tcg_abort();
+    }
+}
 static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
 {
     TCGReg addr_regl, addr_regh __attribute__((unused));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
+#else
+    unsigned a_bits, s_bits;
 #endif
     TCGReg base = TCG_REG_A0;
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    base = TCG_REG_A0;
     if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     } else {
         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
-    tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
+    a_bits = get_alignment_bits(opc);
+    s_bits = opc & MO_SIZE;
+    /*
+     * R6 removes the left/right instructions but requires the
+     * system to support misaligned memory accesses.
+     */
+    if (use_mips32r6_instructions) {
+        if (a_bits) {
+            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
+        }
+        tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
+    } else {
+        if (a_bits && a_bits != s_bits) {
+            tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
+        }
+        if (a_bits >= s_bits) {
+            tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
+        } else {
+            tcg_out_qemu_st_unalign(s, data_regl, data_regh, base, opc);
+        }
+    }
 #endif
 }
 
-- 
2.25.1

We can use the routines just added for user-only to emit
unaligned accesses in softmmu mode too.

Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 91 ++++++++++++++++++++++-----------------
 1 file changed, 51 insertions(+), 40 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
                              tcg_insn_unit *label_ptr[2], bool is_load)
 {
     MemOp opc = get_memop(oi);
-    unsigned s_bits = opc & MO_SIZE;
     unsigned a_bits = get_alignment_bits(opc);
+    unsigned s_bits = opc & MO_SIZE;
+    unsigned a_mask = (1 << a_bits) - 1;
+    unsigned s_mask = (1 << s_bits) - 1;
     int mem_index = get_mmuidx(oi);
     int fast_off = TLB_MASK_TABLE_OFS(mem_index);
     int mask_off = fast_off + offsetof(CPUTLBDescFast, mask);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
     int add_off = offsetof(CPUTLBEntry, addend);
     int cmp_off = (is_load ? offsetof(CPUTLBEntry, addr_read)
                    : offsetof(CPUTLBEntry, addr_write));
-    target_ulong mask;
+    target_ulong tlb_mask;
 
     /* Load tlb_mask[mmu_idx] and tlb_table[mmu_idx].  */
     tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP0, TCG_AREG0, mask_off);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
     /* Add the tlb_table pointer, creating the CPUTLBEntry address in TMP3.  */
     tcg_out_opc_reg(s, ALIAS_PADD, TCG_TMP3, TCG_TMP3, TCG_TMP1);
 
-    /* We don't currently support unaligned accesses.
-       We could do so with mips32r6.  */
-    if (a_bits < s_bits) {
-        a_bits = s_bits;
-    }
-
-    /* Mask the page bits, keeping the alignment bits to compare against.  */
-    mask = (target_ulong)TARGET_PAGE_MASK | ((1 << a_bits) - 1);
-
     /* Load the (low-half) tlb comparator.  */
     if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-        tcg_out_ld(s, TCG_TYPE_I32, TCG_TMP0, TCG_TMP3, cmp_off + LO_OFF);
-        tcg_out_movi(s, TCG_TYPE_I32, TCG_TMP1, mask);
+        tcg_out_ldst(s, OPC_LW, TCG_TMP0, TCG_TMP3, cmp_off + LO_OFF);
     } else {
         tcg_out_ldst(s, (TARGET_LONG_BITS == 64 ? OPC_LD
                          : TCG_TARGET_REG_BITS == 64 ? OPC_LWU : OPC_LW),
                      TCG_TMP0, TCG_TMP3, cmp_off);
-        tcg_out_movi(s, TCG_TYPE_TL, TCG_TMP1, mask);
-        /* No second compare is required here;
-           load the tlb addend for the fast path.  */
-        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
     }
 
     /* Zero extend a 32-bit guest address for a 64-bit host. */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
         tcg_out_ext32u(s, base, addrl);
         addrl = base;
     }
-    tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
+
+    /*
+     * Mask the page bits, keeping the alignment bits to compare against.
+     * For unaligned accesses, compare against the end of the access to
+     * verify that it does not cross a page boundary.
+     */
+    tlb_mask = (target_ulong)TARGET_PAGE_MASK | a_mask;
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_TMP1, tlb_mask);
+    if (a_mask >= s_mask) {
+        tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, addrl);
+    } else {
+        tcg_out_opc_imm(s, ALIAS_PADDI, TCG_TMP2, addrl, s_mask - a_mask);
+        tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, TCG_TMP2);
+    }
+
+    if (TCG_TARGET_REG_BITS >= TARGET_LONG_BITS) {
+        /* Load the tlb addend for the fast path.  */
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
+    }
 
     label_ptr[0] = s->code_ptr;
     tcg_out_opc_br(s, OPC_BNE, TCG_TMP1, TCG_TMP0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
     /* Load and test the high half tlb comparator.  */
     if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
         /* delay slot */
-        tcg_out_ld(s, TCG_TYPE_I32, TCG_TMP0, TCG_TMP3, cmp_off + HI_OFF);
+        tcg_out_ldst(s, OPC_LW, TCG_TMP0, TCG_TMP3, cmp_off + HI_OFF);
 
         /* Load the tlb addend for the fast path.  */
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP2, TCG_TMP3, add_off);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
-static void __attribute__((unused))
-tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
+static void tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
                                     TCGReg base, MemOp opc, bool is_64)
 {
     const MIPSInsn lw1 = MIPS_BE ? OPC_LWL : OPC_LWR;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
 #else
-    unsigned a_bits, s_bits;
 #endif
+    unsigned a_bits, s_bits;
     TCGReg base = TCG_REG_A0;
 
     data_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     addr_regh = (TCG_TARGET_REG_BITS < TARGET_LONG_BITS ? *args++ : 0);
     oi = *args++;
     opc = get_memop(oi);
+    a_bits = get_alignment_bits(opc);
+    s_bits = opc & MO_SIZE;
 
+    /*
+     * R6 removes the left/right instructions but requires the
+     * system to support misaligned memory accesses.
+     */
 #if defined(CONFIG_SOFTMMU)
     tcg_out_tlb_load(s, base, addr_regl, addr_regh, oi, label_ptr, 1);
-    tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+    if (use_mips32r6_instructions || a_bits >= s_bits) {
+        tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+    } else {
+        tcg_out_qemu_ld_unalign(s, data_regl, data_regh, base, opc, is_64);
+    }
     add_qemu_ldst_label(s, 1, oi,
                         (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                         data_regl, data_regh, addr_regl, addr_regh,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     } else {
         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
-    a_bits = get_alignment_bits(opc);
-    s_bits = opc & MO_SIZE;
-    /*
-     * R6 removes the left/right instructions but requires the
-     * system to support misaligned memory accesses.
-     */
     if (use_mips32r6_instructions) {
         if (a_bits) {
             tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
-static void __attribute__((unused))
-tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
+static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
                                     TCGReg base, MemOp opc)
 {
     const MIPSInsn sw1 = MIPS_BE ? OPC_SWL : OPC_SWR;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     MemOp opc;
 #if defined(CONFIG_SOFTMMU)
     tcg_insn_unit *label_ptr[2];
-#else
-    unsigned a_bits, s_bits;
 #endif
+    unsigned a_bits, s_bits;
     TCGReg base = TCG_REG_A0;
 
     data_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     addr_regh = (TCG_TARGET_REG_BITS < TARGET_LONG_BITS ? *args++ : 0);
     oi = *args++;
     opc = get_memop(oi);
+    a_bits = get_alignment_bits(opc);
+    s_bits = opc & MO_SIZE;
 
+    /*
+     * R6 removes the left/right instructions but requires the
+     * system to support misaligned memory accesses.
+     */
 #if defined(CONFIG_SOFTMMU)
     tcg_out_tlb_load(s, base, addr_regl, addr_regh, oi, label_ptr, 0);
-    tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
+    if (use_mips32r6_instructions || a_bits >= s_bits) {
+        tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
+    } else {
+        tcg_out_qemu_st_unalign(s, data_regl, data_regh, base, opc);
+    }
     add_qemu_ldst_label(s, 0, oi,
                         (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                         data_regl, data_regh, addr_regl, addr_regh,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     } else {
         tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_GUEST_BASE_REG, addr_regl);
     }
-    a_bits = get_alignment_bits(opc);
-    s_bits = opc & MO_SIZE;
-    /*
-     * R6 removes the left/right instructions but requires the
-     * system to support misaligned memory accesses.
-     */
     if (use_mips32r6_instructions) {
         if (a_bits) {
             tcg_out_test_alignment(s, true, addr_regl, addr_regh, a_bits);
-- 
2.25.1

When BH is constant, it is constrained to 11 bits for use in MOVCC.
For the cases in which we must load the constant BH into a register,
we do not need the full logic of tcg_out_movi; we can use the simpler
function for emitting a 13 bit constant.

This eliminates the only case in which TCG_REG_T2 was passed to
tcg_out_movi, which will shortly become invalid.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
     if (use_vis3_instructions && !is_sub) {
         /* Note that ADDXC doesn't accept immediates.  */
         if (bhconst && bh != 0) {
-           tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_T2, bh);
+           tcg_out_movi_imm13(s, TCG_REG_T2, bh);
            bh = TCG_REG_T2;
         }
         tcg_out_arith(s, rh, ah, bh, ARITH_ADDXC);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
 	    tcg_out_movcc(s, TCG_COND_GEU, MOVCC_XCC, rh, ah, 0);
 	}
     } else {
-        /* Otherwise adjust BH as if there is carry into T2 ... */
+        /*
+         * Otherwise adjust BH as if there is carry into T2.
+         * Note that constant BH is constrained to 11 bits for the MOVCC,
+         * so the adjustment fits 12 bits.
+         */
         if (bhconst) {
-            tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_T2, bh + (is_sub ? -1 : 1));
+            tcg_out_movi_imm13(s, TCG_REG_T2, bh + (is_sub ? -1 : 1));
         } else {
             tcg_out_arithi(s, TCG_REG_T2, bh, 1,
                            is_sub ? ARITH_SUB : ARITH_ADD);
-- 
2.25.1

Handle 32-bit constants with a separate function, so that
tcg_out_movi_int does not need to recurse.  This slightly
rearranges the order of tests for small constants, but
produces the same output.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_imm13(TCGContext *s, TCGReg ret, int32_t arg)
     tcg_out_arithi(s, ret, TCG_REG_G0, arg, ARITH_OR);
 }
 
+static void tcg_out_movi_imm32(TCGContext *s, TCGReg ret, int32_t arg)
+{
+    if (check_fit_i32(arg, 13)) {
+        /* A 13-bit constant sign-extended to 64-bits.  */
+        tcg_out_movi_imm13(s, ret, arg);
+    } else {
+        /* A 32-bit constant zero-extended to 64 bits.  */
+        tcg_out_sethi(s, ret, arg);
+        if (arg & 0x3ff) {
+            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
+        }
+    }
+}
+
 static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
                              tcg_target_long arg, bool in_prologue)
 {
     tcg_target_long hi, lo = (int32_t)arg;
     tcg_target_long test, lsb;
 
-    /* Make sure we test 32-bit constants for imm13 properly.  */
-    if (type == TCG_TYPE_I32) {
-        arg = lo;
+    /* A 32-bit constant, or 32-bit zero-extended to 64-bits.  */
+    if (type == TCG_TYPE_I32 || arg == (uint32_t)arg) {
+        tcg_out_movi_imm32(s, ret, arg);
+        return;
     }
 
     /* A 13-bit constant sign-extended to 64-bits.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
         }
     }
 
-    /* A 32-bit constant, or 32-bit zero-extended to 64-bits.  */
-    if (type == TCG_TYPE_I32 || arg == (uint32_t)arg) {
-        tcg_out_sethi(s, ret, arg);
-        if (arg & 0x3ff) {
-            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
-        }
-        return;
-    }
-
     /* A 32-bit constant sign-extended to 64-bits.  */
     if (arg == lo) {
         tcg_out_sethi(s, ret, ~arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     /* A 64-bit constant decomposed into 2 32-bit pieces.  */
     if (check_fit_i32(lo, 13)) {
         hi = (arg - lo) >> 32;
-        tcg_out_movi(s, TCG_TYPE_I32, ret, hi);
+        tcg_out_movi_imm32(s, ret, hi);
         tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
         tcg_out_arithi(s, ret, ret, lo, ARITH_ADD);
     } else {
         hi = arg >> 32;
-        tcg_out_movi(s, TCG_TYPE_I32, ret, hi);
-        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_T2, lo);
+        tcg_out_movi_imm32(s, ret, hi);
+        tcg_out_movi_imm32(s, TCG_REG_T2, lo);
         tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
         tcg_out_arith(s, ret, ret, TCG_REG_T2, ARITH_OR);
     }
-- 
2.25.1

This will allow us to control exactly what scratch register is
used for loading the constant.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_imm32(TCGContext *s, TCGReg ret, int32_t arg)
 }
 
 static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
-                             tcg_target_long arg, bool in_prologue)
+                             tcg_target_long arg, bool in_prologue,
+                             TCGReg scratch)
 {
     tcg_target_long hi, lo = (int32_t)arg;
     tcg_target_long test, lsb;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     } else {
         hi = arg >> 32;
         tcg_out_movi_imm32(s, ret, hi);
-        tcg_out_movi_imm32(s, TCG_REG_T2, lo);
+        tcg_out_movi_imm32(s, scratch, lo);
         tcg_out_arithi(s, ret, ret, 32, SHIFT_SLLX);
-        tcg_out_arith(s, ret, ret, TCG_REG_T2, ARITH_OR);
+        tcg_out_arith(s, ret, ret, scratch, ARITH_OR);
     }
 }
 
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg)
 {
-    tcg_out_movi_int(s, type, ret, arg, false);
+    tcg_debug_assert(ret != TCG_REG_T2);
+    tcg_out_movi_int(s, type, ret, arg, false, TCG_REG_T2);
 }
 
 static void tcg_out_ldst_rr(TCGContext *s, TCGReg data, TCGReg a1,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
     } else {
         uintptr_t desti = (uintptr_t)dest;
         tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
-                         desti & ~0xfff, in_prologue);
+                         desti & ~0xfff, in_prologue, TCG_REG_O7);
         tcg_out_arithi(s, TCG_REG_O7, TCG_REG_T1, desti & 0xfff, JMPL);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
 
 #ifndef CONFIG_SOFTMMU
     if (guest_base != 0) {
-        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG, guest_base, true);
+        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG,
+                         guest_base, true, TCG_REG_T1);
         tcg_regset_set_reg(s->reserved_regs, TCG_GUEST_BASE_REG);
     }
 #endif
-- 
2.25.1

We had code for checking for 13 and 21-bit shifted constants,
but we can do better and allow 32-bit shifted constants.
This is still 2 insns shorter than the full 64-bit sequence.

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
         return;
     }
 
-    /* A 21-bit constant, shifted.  */
+    /* A 32-bit constant, shifted.  */
     lsb = ctz64(arg);
     test = (tcg_target_long)arg >> lsb;
-    if (check_fit_tl(test, 13)) {
-        tcg_out_movi_imm13(s, ret, test);
-        tcg_out_arithi(s, ret, ret, lsb, SHIFT_SLLX);
-        return;
-    } else if (lsb > 10 && test == extract64(test, 0, 21)) {
+    if (lsb > 10 && test == extract64(test, 0, 21)) {
         tcg_out_sethi(s, ret, test << 10);
         tcg_out_arithi(s, ret, ret, lsb - 10, SHIFT_SLLX);
         return;
+    } else if (test == (uint32_t)test || test == (int32_t)test) {
+        tcg_out_movi_int(s, TCG_TYPE_I64, ret, test, in_prologue, scratch);
+        tcg_out_arithi(s, ret, ret, lsb, SHIFT_SLLX);
+        return;
     }
 
     /* A 64-bit constant decomposed into 2 32-bit pieces.  */
-- 
2.25.1

Since 7ecd02a06f8, if patch_reloc fails we restart translation
with a smaller TB.  SPARC had its function signature changed,
but not the logic.  Replace assert with return false.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *src_rw, int type,
 
     switch (type) {
     case R_SPARC_WDISP16:
-        assert(check_fit_ptr(pcrel >> 2, 16));
+        if (!check_fit_ptr(pcrel >> 2, 16)) {
+            return false;
+        }
         insn &= ~INSN_OFF16(-1);
         insn |= INSN_OFF16(pcrel);
         break;
     case R_SPARC_WDISP19:
-        assert(check_fit_ptr(pcrel >> 2, 19));
+        if (!check_fit_ptr(pcrel >> 2, 19)) {
+            return false;
+        }
         insn &= ~INSN_OFF19(-1);
         insn |= INSN_OFF19(pcrel);
         break;
-- 
2.25.1

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *src_rw, int type,
         insn &= ~INSN_OFF19(-1);
         insn |= INSN_OFF19(pcrel);
         break;
+    case R_SPARC_13:
+        if (!check_fit_ptr(value, 13)) {
+            return false;
+        }
+        insn &= ~INSN_IMM13(-1);
+        insn |= INSN_IMM13(value);
+        break;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
         return;
     }
 
+    /* Use the constant pool, if possible. */
+    if (!in_prologue && USE_REG_TB) {
+        new_pool_label(s, arg, R_SPARC_13, s->code_ptr,
+                       tcg_tbrel_diff(s, NULL));
+        tcg_out32(s, LDX | INSN_RD(ret) | INSN_RS1(TCG_REG_TB));
+        return;
+    }
+
     /* A 64-bit constant decomposed into 2 32-bit pieces.  */
     if (check_fit_i32(lo, 13)) {
         hi = (arg - lo) >> 32;
-- 
2.25.1

Due to mapping changes, we now rarely place the code_gen_buffer
near the main executable.  Which means that direct calls will
now rarely be in range.

So, always use indirect calls for tail calls, which allows us to
avoid clobbering %o7, and therefore we need not save and restore it.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
     tcg_out_mov(s, TCG_TYPE_I64, rl, tmp);
 }
 
+static void tcg_out_jmpl_const(TCGContext *s, const tcg_insn_unit *dest,
+                               bool in_prologue, bool tail_call)
+{
+    uintptr_t desti = (uintptr_t)dest;
+
+    /* Be careful not to clobber %o7 for a tail call. */
+    tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
+                     desti & ~0xfff, in_prologue,
+                     tail_call ? TCG_REG_G2 : TCG_REG_O7);
+    tcg_out_arithi(s, tail_call ? TCG_REG_G0 : TCG_REG_O7,
+                   TCG_REG_T1, desti & 0xfff, JMPL);
+}
+
 static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
                                  bool in_prologue)
 {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_call_nodelay(TCGContext *s, const tcg_insn_unit *dest,
     if (disp == (int32_t)disp) {
         tcg_out32(s, CALL | (uint32_t)disp >> 2);
     } else {
-        uintptr_t desti = (uintptr_t)dest;
-        tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_REG_T1,
-                         desti & ~0xfff, in_prologue, TCG_REG_O7);
-        tcg_out_arithi(s, TCG_REG_O7, TCG_REG_T1, desti & 0xfff, JMPL);
+        tcg_out_jmpl_const(s, dest, in_prologue, false);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
 
         /* Set the retaddr operand.  */
         tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
-        /* Set the env operand.  */
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O0, TCG_AREG0);
         /* Tail call.  */
-        tcg_out_call_nodelay(s, qemu_ld_helpers[i], true);
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O7, ra);
+        tcg_out_jmpl_const(s, qemu_ld_helpers[i], true, true);
+        /* delay slot -- set the env argument */
+        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
     }
 
     for (i = 0; i < ARRAY_SIZE(qemu_st_helpers); ++i) {
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
         if (ra >= TCG_REG_O6) {
             tcg_out_st(s, TCG_TYPE_PTR, TCG_REG_O7, TCG_REG_CALL_STACK,
                        TCG_TARGET_CALL_STACK_OFFSET);
-            ra = TCG_REG_G1;
+        } else {
+            tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
         }
-        tcg_out_mov(s, TCG_TYPE_PTR, ra, TCG_REG_O7);
-        /* Set the env operand.  */
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O0, TCG_AREG0);
+
         /* Tail call.  */
-        tcg_out_call_nodelay(s, qemu_st_helpers[i], true);
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_O7, ra);
+        tcg_out_jmpl_const(s, qemu_st_helpers[i], true, true);
+        /* delay slot -- set the env argument */
+        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
     }
 }
 #endif
-- 
2.25.1

This is kinda sorta the opposite of the other tcg hosts, where
we get (normal) alignment checks for free with host SIGBUS and
need to add code to support unaligned accesses.

This inline code expansion is somewhat large, but it takes quite
a few instructions to make a function call to a helper anyway.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc/tcg-target.c.inc | 219 +++++++++++++++++++++++++++++++++++--
 1 file changed, 211 insertions(+), 8 deletions(-)

diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_oarg_regs[] = {
 #define ARITH_ADD  (INSN_OP(2) | INSN_OP3(0x00))
 #define ARITH_ADDCC (INSN_OP(2) | INSN_OP3(0x10))
 #define ARITH_AND  (INSN_OP(2) | INSN_OP3(0x01))
+#define ARITH_ANDCC (INSN_OP(2) | INSN_OP3(0x11))
 #define ARITH_ANDN (INSN_OP(2) | INSN_OP3(0x05))
 #define ARITH_OR   (INSN_OP(2) | INSN_OP3(0x02))
 #define ARITH_ORCC (INSN_OP(2) | INSN_OP3(0x12))
@@ -XXX,XX +XXX,XX @@ static void build_trampolines(TCGContext *s)
         tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
     }
 }
+#else
+static const tcg_insn_unit *qemu_unalign_ld_trampoline;
+static const tcg_insn_unit *qemu_unalign_st_trampoline;
+
+static void build_trampolines(TCGContext *s)
+{
+    for (int ld = 0; ld < 2; ++ld) {
+        void *helper;
+
+        while ((uintptr_t)s->code_ptr & 15) {
+            tcg_out_nop(s);
+        }
+
+        if (ld) {
+            helper = helper_unaligned_ld;
+            qemu_unalign_ld_trampoline = tcg_splitwx_to_rx(s->code_ptr);
+        } else {
+            helper = helper_unaligned_st;
+            qemu_unalign_st_trampoline = tcg_splitwx_to_rx(s->code_ptr);
+        }
+
+        if (!SPARC64 && TARGET_LONG_BITS == 64) {
+            /* Install the high part of the address.  */
+            tcg_out_arithi(s, TCG_REG_O1, TCG_REG_O2, 32, SHIFT_SRLX);
+        }
+
+        /* Tail call.  */
+        tcg_out_jmpl_const(s, helper, true, true);
+        /* delay slot -- set the env argument */
+        tcg_out_mov_delay(s, TCG_REG_O0, TCG_AREG0);
+    }
+}
 #endif
 
 /* Generate global QEMU prologue and epilogue code */
@@ -XXX,XX +XXX,XX @@ static void tcg_target_qemu_prologue(TCGContext *s)
     /* delay slot */
     tcg_out_movi_imm13(s, TCG_REG_O0, 0);
 
-#ifdef CONFIG_SOFTMMU
     build_trampolines(s);
-#endif
 }
 
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
@@ -XXX,XX +XXX,XX @@ static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addr, int mem_index,
 static const int qemu_ld_opc[(MO_SSIZE | MO_BSWAP) + 1] = {
     [MO_UB]   = LDUB,
     [MO_SB]   = LDSB,
+    [MO_UB | MO_LE] = LDUB,
+    [MO_SB | MO_LE] = LDSB,
 
     [MO_BEUW] = LDUH,
     [MO_BESW] = LDSH,
     [MO_BEUL] = LDUW,
     [MO_BESL] = LDSW,
     [MO_BEUQ] = LDX,
+    [MO_BESQ] = LDX,
 
     [MO_LEUW] = LDUH_LE,
     [MO_LESW] = LDSH_LE,
     [MO_LEUL] = LDUW_LE,
     [MO_LESL] = LDSW_LE,
     [MO_LEUQ] = LDX_LE,
+    [MO_LESQ] = LDX_LE,
 };
 
 static const int qemu_st_opc[(MO_SIZE | MO_BSWAP) + 1] = {
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
                             MemOpIdx oi, bool is_64)
 {
     MemOp memop = get_memop(oi);
+    tcg_insn_unit *label_ptr;
+
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
     TCGReg addrz, param;
     const tcg_insn_unit *func;
-    tcg_insn_unit *label_ptr;
 
     addrz = tcg_out_tlb_load(s, addr, memi, memop,
                              offsetof(CPUTLBEntry, addr_read));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
 
     *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
 #else
+    TCGReg index = (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0);
+    unsigned a_bits = get_alignment_bits(memop);
+    unsigned s_bits = memop & MO_SIZE;
+    unsigned t_bits;
+
     if (SPARC64 && TARGET_LONG_BITS == 32) {
         tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
         addr = TCG_REG_T1;
     }
-    tcg_out_ldst_rr(s, data, addr,
-                    (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0),
+
+    /*
+     * Normal case: alignment equal to access size.
+     */
+    if (a_bits == s_bits) {
+        tcg_out_ldst_rr(s, data, addr, index,
+                        qemu_ld_opc[memop & (MO_BSWAP | MO_SSIZE)]);
+        return;
+    }
+
+    /*
+     * Test for at least natural alignment, and assume most accesses
+     * will be aligned -- perform a straight load in the delay slot.
+     * This is required to preserve atomicity for aligned accesses.
+     */
+    t_bits = MAX(a_bits, s_bits);
+    tcg_debug_assert(t_bits < 13);
+    tcg_out_arithi(s, TCG_REG_G0, addr, (1u << t_bits) - 1, ARITH_ANDCC);
+
+    /* beq,a,pt %icc, label */
+    label_ptr = s->code_ptr;
+    tcg_out_bpcc0(s, COND_E, BPCC_A | BPCC_PT | BPCC_ICC, 0);
+    /* delay slot */
+    tcg_out_ldst_rr(s, data, addr, index,
                     qemu_ld_opc[memop & (MO_BSWAP | MO_SSIZE)]);
+
+    if (a_bits >= s_bits) {
+        /*
+         * Overalignment: A successful alignment test will perform the memory
+         * operation in the delay slot, and failure need only invoke the
+         * handler for SIGBUS.
+         */
+        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
+        tcg_out_call_nodelay(s, qemu_unalign_ld_trampoline, false);
+        /* delay slot -- move to low part of argument reg */
+        tcg_out_mov_delay(s, arg_low, addr);
+    } else {
+        /* Underalignment: load by pieces of minimum alignment. */
+        int ld_opc, a_size, s_size, i;
+
+        /*
+         * Force full address into T1 early; avoids problems with
+         * overlap between @addr and @data.
+         */
+        tcg_out_arith(s, TCG_REG_T1, addr, index, ARITH_ADD);
+
+        a_size = 1 << a_bits;
+        s_size = 1 << s_bits;
+        if ((memop & MO_BSWAP) == MO_BE) {
+            ld_opc = qemu_ld_opc[a_bits | MO_BE | (memop & MO_SIGN)];
+            tcg_out_ldst(s, data, TCG_REG_T1, 0, ld_opc);
+            ld_opc = qemu_ld_opc[a_bits | MO_BE];
+            for (i = a_size; i < s_size; i += a_size) {
+                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, ld_opc);
+                tcg_out_arithi(s, data, data, a_size, SHIFT_SLLX);
+                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
+            }
+        } else if (a_bits == 0) {
+            ld_opc = LDUB;
+            tcg_out_ldst(s, data, TCG_REG_T1, 0, ld_opc);
+            for (i = a_size; i < s_size; i += a_size) {
+                if ((memop & MO_SIGN) && i == s_size - a_size) {
+                    ld_opc = LDSB;
+                }
+                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, ld_opc);
+                tcg_out_arithi(s, TCG_REG_T2, TCG_REG_T2, i * 8, SHIFT_SLLX);
+                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
+            }
+        } else {
+            ld_opc = qemu_ld_opc[a_bits | MO_LE];
+            tcg_out_ldst_rr(s, data, TCG_REG_T1, TCG_REG_G0, ld_opc);
+            for (i = a_size; i < s_size; i += a_size) {
+                tcg_out_arithi(s, TCG_REG_T1, TCG_REG_T1, a_size, ARITH_ADD);
+                if ((memop & MO_SIGN) && i == s_size - a_size) {
+                    ld_opc = qemu_ld_opc[a_bits | MO_LE | MO_SIGN];
+                }
+                tcg_out_ldst_rr(s, TCG_REG_T2, TCG_REG_T1, TCG_REG_G0, ld_opc);
+                tcg_out_arithi(s, TCG_REG_T2, TCG_REG_T2, i * 8, SHIFT_SLLX);
+                tcg_out_arith(s, data, data, TCG_REG_T2, ARITH_OR);
+            }
+        }
+    }
+
+    *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
 #endif /* CONFIG_SOFTMMU */
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
                             MemOpIdx oi)
 {
     MemOp memop = get_memop(oi);
+    tcg_insn_unit *label_ptr;
+
 #ifdef CONFIG_SOFTMMU
     unsigned memi = get_mmuidx(oi);
     TCGReg addrz, param;
     const tcg_insn_unit *func;
-    tcg_insn_unit *label_ptr;
 
     addrz = tcg_out_tlb_load(s, addr, memi, memop,
                              offsetof(CPUTLBEntry, addr_write));
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
 
     *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
 #else
+    TCGReg index = (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0);
+    unsigned a_bits = get_alignment_bits(memop);
+    unsigned s_bits = memop & MO_SIZE;
+    unsigned t_bits;
+
     if (SPARC64 && TARGET_LONG_BITS == 32) {
         tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL);
         addr = TCG_REG_T1;
     }
-    tcg_out_ldst_rr(s, data, addr,
-                    (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0),
+
+    /*
+     * Normal case: alignment equal to access size.
+     */
+    if (a_bits == s_bits) {
+        tcg_out_ldst_rr(s, data, addr, index,
+                        qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]);
+        return;
+    }
+
+    /*
+     * Test for at least natural alignment, and assume most accesses
+     * will be aligned -- perform a straight store in the delay slot.
+     * This is required to preserve atomicity for aligned accesses.
+     */
+    t_bits = MAX(a_bits, s_bits);
+    tcg_debug_assert(t_bits < 13);
+    tcg_out_arithi(s, TCG_REG_G0, addr, (1u << t_bits) - 1, ARITH_ANDCC);
+
+    /* beq,a,pt %icc, label */
+    label_ptr = s->code_ptr;
+    tcg_out_bpcc0(s, COND_E, BPCC_A | BPCC_PT | BPCC_ICC, 0);
+    /* delay slot */
+    tcg_out_ldst_rr(s, data, addr, index,
                     qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]);
+
+    if (a_bits >= s_bits) {
+        /*
+         * Overalignment: A successful alignment test will perform the memory
+         * operation in the delay slot, and failure need only invoke the
+         * handler for SIGBUS.
+         */
+        TCGReg arg_low = TCG_REG_O1 + (!SPARC64 && TARGET_LONG_BITS == 64);
+        tcg_out_call_nodelay(s, qemu_unalign_st_trampoline, false);
+        /* delay slot -- move to low part of argument reg */
+        tcg_out_mov_delay(s, arg_low, addr);
+    } else {
+        /* Underalignment: store by pieces of minimum alignment. */
+        int st_opc, a_size, s_size, i;
+
+        /*
+         * Force full address into T1 early; avoids problems with
+         * overlap between @addr and @data.
+         */
+        tcg_out_arith(s, TCG_REG_T1, addr, index, ARITH_ADD);
+
+        a_size = 1 << a_bits;
+        s_size = 1 << s_bits;
+        if ((memop & MO_BSWAP) == MO_BE) {
+            st_opc = qemu_st_opc[a_bits | MO_BE];
+            for (i = 0; i < s_size; i += a_size) {
+                TCGReg d = data;
+                int shift = (s_size - a_size - i) * 8;
+                if (shift) {
+                    d = TCG_REG_T2;
+                    tcg_out_arithi(s, d, data, shift, SHIFT_SRLX);
+                }
+                tcg_out_ldst(s, d, TCG_REG_T1, i, st_opc);
+            }
+        } else if (a_bits == 0) {
+            tcg_out_ldst(s, data, TCG_REG_T1, 0, STB);
+            for (i = 1; i < s_size; i++) {
+                tcg_out_arithi(s, TCG_REG_T2, data, i * 8, SHIFT_SRLX);
+                tcg_out_ldst(s, TCG_REG_T2, TCG_REG_T1, i, STB);
+            }
+        } else {
+            /* Note that ST*A with immediate asi must use indexed address. */
+            st_opc = qemu_st_opc[a_bits + MO_LE];
+            tcg_out_ldst_rr(s, data, TCG_REG_T1, TCG_REG_G0, st_opc);
+            for (i = a_size; i < s_size; i += a_size) {
+                tcg_out_arithi(s, TCG_REG_T2, data, i * 8, SHIFT_SRLX);
+                tcg_out_arithi(s, TCG_REG_T1, TCG_REG_T1, a_size, ARITH_ADD);
+                tcg_out_ldst_rr(s, TCG_REG_T2, TCG_REG_T1, TCG_REG_G0, st_opc);
+            }
+        }
+    }
+
+    *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr));
 #endif /* CONFIG_SOFTMMU */
 }
 
-- 
2.25.1

A mostly generic test for unaligned access raising SIGBUS.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/multiarch/sigbus.c | 68 ++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 tests/tcg/multiarch/sigbus.c

diff --git a/tests/tcg/multiarch/sigbus.c b/tests/tcg/multiarch/sigbus.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/sigbus.c
@@ -XXX,XX +XXX,XX @@
+#define _GNU_SOURCE 1
+
+#include <assert.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <endian.h>
+
+
+unsigned long long x = 0x8877665544332211ull;
+void * volatile p = (void *)&x + 1;
+
+void sigbus(int sig, siginfo_t *info, void *uc)
+{
+    assert(sig == SIGBUS);
+    assert(info->si_signo == SIGBUS);
+#ifdef BUS_ADRALN
+    assert(info->si_code == BUS_ADRALN);
+#endif
+    assert(info->si_addr == p);
+    exit(EXIT_SUCCESS);
+}
+
+int main()
+{
+    struct sigaction sa = {
+        .sa_sigaction = sigbus,
+        .sa_flags = SA_SIGINFO
+    };
+    int allow_fail = 0;
+    int tmp;
+
+    tmp = sigaction(SIGBUS, &sa, NULL);
+    assert(tmp == 0);
+
+    /*
+     * Select an operation that's likely to enforce alignment.
+     * On many guests that support unaligned accesses by default,
+     * this is often an atomic operation.
+     */
+#if defined(__aarch64__)
+    asm volatile("ldxr %w0,[%1]" : "=r"(tmp) : "r"(p) : "memory");
+#elif defined(__alpha__)
+    asm volatile("ldl_l %0,0(%1)" : "=r"(tmp) : "r"(p) : "memory");
+#elif defined(__arm__)
+    asm volatile("ldrex %0,[%1]" : "=r"(tmp) : "r"(p) : "memory");
+#elif defined(__powerpc__)
+    asm volatile("lwarx %0,0,%1" : "=r"(tmp) : "r"(p) : "memory");
+#elif defined(__riscv_atomic)
+    asm volatile("lr.w %0,(%1)" : "=r"(tmp) : "r"(p) : "memory");
+#else
+    /* No insn known to fault unaligned -- try for a straight load. */
+    allow_fail = 1;
+    tmp = *(volatile int *)p;
+#endif
+
+    assert(allow_fail);
+
+    /*
+     * We didn't see a signal.
+     * We might as well validate the unaligned load worked.
+     */
+    if (BYTE_ORDER == LITTLE_ENDIAN) {
+        assert(tmp == 0x55443322);
+    } else {
+        assert(tmp == 0x77665544);
+    }
+    return EXIT_SUCCESS;
+}
-- 
2.25.1