Series comparison

-[PULL 00/11] tcg patch queue
+[PULL 00/30] tcg patch queue
-The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
+The following changes since commit 36eae3a732a1f2aa81391e871ac0e9bb3233e7d7:
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
+  Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-migration-20220302b' into staging (2022-03-02 20:55:48 +0000)
 are available in the Git repository at:
-  https://github.com/rth7680/qemu.git tags/pull-tcg-20201008
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220303
-for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:
+for you to fetch changes up to f23e6de25c31cadd9a3b7122f9384e6b259ce37f:
-  accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)
+  tcg/loongarch64: Support TCG_TARGET_SIGNED_ADDR32 (2022-03-03 10:47:20 -1000)
 ----------------------------------------------------------------
-Extend maximum gvec vector size
+Reorder do_constant_folding_cond test to satisfy valgrind.
-Fix i386 avx2 dupi
+Fix value of MAX_OPC_PARAM_IARGS.
-Fix mips host user-only write detection
+Add opcodes for vector nand, nor, eqv.
-Misc cleanups.
+Support vector nand, nor, eqv on PPC and S390X hosts.
 Support AVX512VL, AVX512BW, AVX512DQ, and AVX512VBMI2.
 Support 32-bit guest addresses as signed values.
 ----------------------------------------------------------------
-Kele Huang (1):
+Alex Bennée (1):
-      accel/tcg: Fix computing of is_write for MIPS
+      tcg/optimize: only read val after const check
-Richard Henderson (10):
+Richard Henderson (28):
-      tcg: Adjust simd_desc size encoding
+      tcg: Add opcodes for vector nand, nor, eqv
-      tcg: Drop union from TCGArgConstraint
+      tcg/ppc: Implement vector NAND, NOR, EQV
-      tcg: Move sorted_args into TCGArgConstraint.sort_index
+      tcg/s390x: Implement vector NAND, NOR, EQV
-      tcg: Remove TCG_CT_REG
+      tcg/i386: Detect AVX512
-      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
+      tcg/i386: Add tcg_out_evex_opc
-      tcg: Remove TCGOpDef.used
+      tcg/i386: Use tcg_can_emit_vec_op in expand_vec_cmp_noinv
-      tcg/i386: Fix dupi for avx2 32-bit hosts
+      tcg/i386: Implement avx512 variable shifts
-      tcg: Fix generation of dupi_vec for 32-bit host
+      tcg/i386: Implement avx512 scalar shift
-      tcg/optimize: Fold dup2_vec
+      tcg/i386: Implement avx512 immediate sari shift
-      tcg: Remove TCG_TARGET_HAS_cmp_vec
+      tcg/i386: Implement avx512 immediate rotate
       tcg/i386: Implement avx512 variable rotate
       tcg/i386: Support avx512vbmi2 vector shift-double instructions
       tcg/i386: Expand vector word rotate as avx512vbmi2 shift-double
       tcg/i386: Remove rotls_vec from tcg_target_op_def
       tcg/i386: Expand scalar rotate with avx512 insns
       tcg/i386: Implement avx512 min/max/abs
       tcg/i386: Implement avx512 multiply
       tcg/i386: Implement more logical operations for avx512
       tcg/i386: Implement bitsel for avx512
       tcg: Add TCG_TARGET_SIGNED_ADDR32
       accel/tcg: Split out g2h_tlbe
       accel/tcg: Support TCG_TARGET_SIGNED_ADDR32 for softmmu
       accel/tcg: Add guest_base_signed_addr32 for user-only
       linux-user: Support TCG_TARGET_SIGNED_ADDR32
       tcg/aarch64: Support TCG_TARGET_SIGNED_ADDR32
       tcg/mips: Support TCG_TARGET_SIGNED_ADDR32
       tcg/riscv: Support TCG_TARGET_SIGNED_ADDR32
       tcg/loongarch64: Support TCG_TARGET_SIGNED_ADDR32
- include/tcg/tcg-gvec-desc.h  | 38 ++++++++++++------
+Ziqiao Kong (1):
- include/tcg/tcg.h            | 22 ++++------
+      tcg: Set MAX_OPC_PARAM_IARGS to 7
  tcg/aarch64/tcg-target.h     |  1 -
  tcg/i386/tcg-target.h        |  1 -
  tcg/ppc/tcg-target.h         |  1 -
  accel/tcg/user-exec.c        | 43 ++++++++++++++++++--
  tcg/optimize.c               | 15 +++++++
  tcg/tcg-op-gvec.c            | 35 ++++++++++++----
  tcg/tcg-op-vec.c             | 12 ++++--
  tcg/tcg.c                    | 96 +++++++++++++++++++-------------------------
  tcg/aarch64/tcg-target.c.inc | 17 ++++----
  tcg/arm/tcg-target.c.inc     | 29 ++++++-------
  tcg/i386/tcg-target.c.inc    | 39 +++++++-----------
  tcg/mips/tcg-target.c.inc    | 21 +++++-----
  tcg/ppc/tcg-target.c.inc     | 29 ++++++-------
  tcg/riscv/tcg-target.c.inc   | 16 ++++----
  tcg/s390/tcg-target.c.inc    | 22 +++++-----
  tcg/sparc/tcg-target.c.inc   | 21 ++++------
  tcg/tci/tcg-target.c.inc     |  3 +-
 files changed, 244 insertions(+), 217 deletions(-)
+ include/exec/cpu-all.h            |  20 +-
+ include/exec/cpu_ldst.h           |   3 +-
+ include/qemu/cpuid.h              |  20 +-
+ include/tcg/tcg-opc.h             |   3 +
+ include/tcg/tcg.h                 |   5 +-
+ tcg/aarch64/tcg-target-sa32.h     |   7 +
+ tcg/aarch64/tcg-target.h          |   3 +
+ tcg/arm/tcg-target-sa32.h         |   1 +
+ tcg/arm/tcg-target.h              |   3 +
+ tcg/i386/tcg-target-con-set.h     |   1 +
+ tcg/i386/tcg-target-sa32.h        |   1 +
+ tcg/i386/tcg-target.h             |  17 +-
+ tcg/i386/tcg-target.opc.h         |   3 +
+ tcg/loongarch64/tcg-target-sa32.h |   1 +
+ tcg/mips/tcg-target-sa32.h        |   9 +
+ tcg/ppc/tcg-target-sa32.h         |   1 +
+ tcg/ppc/tcg-target.h              |   3 +
+ tcg/riscv/tcg-target-sa32.h       |   5 +
+ tcg/s390x/tcg-target-sa32.h       |   1 +
+ tcg/s390x/tcg-target.h            |   3 +
+ tcg/sparc/tcg-target-sa32.h       |   1 +
+ tcg/tci/tcg-target-sa32.h         |   1 +
+ accel/tcg/cputlb.c                |  36 ++--
+ bsd-user/main.c                   |   4 +
+ linux-user/elfload.c              |  62 ++++--
+ linux-user/main.c                 |   3 +
+ tcg/optimize.c                    |  20 +-
+ tcg/tcg-op-vec.c                  |  27 ++-
+ tcg/tcg.c                         |  10 +
+ tcg/aarch64/tcg-target.c.inc      |  81 +++++---
+ tcg/i386/tcg-target.c.inc         | 387 +++++++++++++++++++++++++++++++-------
+ tcg/loongarch64/tcg-target.c.inc  |  15 +-
+ tcg/mips/tcg-target.c.inc         |  10 +-
+ tcg/ppc/tcg-target.c.inc          |  15 ++
+ tcg/riscv/tcg-target.c.inc        |   8 +-
+ tcg/s390x/tcg-target.c.inc        |  17 ++
+ tcg/tci/tcg-target.c.inc          |   2 +-
+files changed, 640 insertions(+), 169 deletions(-)
+ create mode 100644 tcg/aarch64/tcg-target-sa32.h
+ create mode 100644 tcg/arm/tcg-target-sa32.h
+ create mode 100644 tcg/i386/tcg-target-sa32.h
+ create mode 100644 tcg/loongarch64/tcg-target-sa32.h
+ create mode 100644 tcg/mips/tcg-target-sa32.h
+ create mode 100644 tcg/ppc/tcg-target-sa32.h
+ create mode 100644 tcg/riscv/tcg-target-sa32.h
+ create mode 100644 tcg/s390x/tcg-target-sa32.h
+ create mode 100644 tcg/sparc/tcg-target-sa32.h
+ create mode 100644 tcg/tci/tcg-target-sa32.h

-[PULL 09/11] tcg/optimize: Fold dup2_vec
+[PULL 01/30] tcg/optimize: only read val after const check
-When the two arguments are identical, this can be reduced to
+From: Alex Bennée <alex.bennee@linaro.org>
 dup_vec or to mov_vec from a tcg_constant_vec.
+valgrind pointed out that arg_info()->val can be undefined which will
+be the case if the arguments are not constant. The ordering of the
+checks will have ensured we never relied on an undefined value but for
+the sake of completeness re-order the code to be clear.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-Id: <20220209112142.3367525-1-alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/optimize.c | 15 +++++++++++++++
+ tcg/optimize.c | 8 ++++----
-file changed, 15 insertions(+)
+file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/optimize.c
 +++ b/tcg/optimize.c
-@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_eq(TCGCond c)
-             }
+ static int do_constant_folding_cond(TCGType type, TCGArg x,
-             goto do_default;
+                                     TCGArg y, TCGCond c)
+ {
-+        case INDEX_op_dup2_vec:
+-    uint64_t xv = arg_info(x)->val;
-+            assert(TCG_TARGET_REG_BITS == 32);
+-    uint64_t yv = arg_info(y)->val;
-+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+-
-+                tmp = arg_info(op->args[1])->val;
+     if (arg_is_const(x) && arg_is_const(y)) {
-+                if (tmp == arg_info(op->args[2])->val) {
++        uint64_t xv = arg_info(x)->val;
-+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
++        uint64_t yv = arg_info(y)->val;
 +                    break;
 +                }
 +            } else if (args_are_copies(op->args[1], op->args[2])) {
 +                op->opc = INDEX_op_dup_vec;
 +                TCGOP_VECE(op) = MO_32;
 +                nb_iargs = 1;
 +            }
 +            goto do_default;
 +
-         CASE_OP_32_64(not):
+         switch (type) {
-         CASE_OP_32_64(neg):
+         case TCG_TYPE_I32:
-         CASE_OP_32_64(ext8s):
+             return do_constant_folding_cond_32(xv, yv, c);
@@ -XXX,XX +XXX,XX @@ static int do_constant_folding_cond(TCGType type, TCGArg x,
          }
      } else if (args_are_copies(x, y)) {
          return do_constant_folding_cond_eq(c);
 -    } else if (arg_is_const(y) && yv == 0) {
 +    } else if (arg_is_const(y) && arg_info(y)->val == 0) {
          switch (c) {
          case TCG_COND_LTU:
              return 0;
 --
 .25.1

-[PULL 04/11] tcg: Remove TCG_CT_REG
+[PULL 02/30] tcg: Set MAX_OPC_PARAM_IARGS to 7
-This wasn't actually used for anything, really.  All variable
+From: Ziqiao Kong <ziqiaokong@gmail.com>
 operands must accept registers, and which are indicated by the
 set in TCGArgConstraint.regs.
+The last entry of DEF_HELPERS_FLAGS_n is DEF_HELPER_FLAGS_7 and
+thus the MAX_OPC_PARAM_IARGS should be 7.
+Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
+Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com>
+Message-Id: <20220227113127.414533-2-ziqiaokong@gmail.com>
+Fixes: e6cadf49c3d ("tcg: Add support for a helper with 7 arguments")
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h            |  1 -
+ include/tcg/tcg.h        | 2 +-
- tcg/tcg.c                    | 15 ++++-----------
+ tcg/tci/tcg-target.c.inc | 2 +-
- tcg/aarch64/tcg-target.c.inc |  3 ---
+files changed, 2 insertions(+), 2 deletions(-)
  tcg/arm/tcg-target.c.inc     |  3 ---
  tcg/i386/tcg-target.c.inc    | 11 -----------
  tcg/mips/tcg-target.c.inc    |  3 ---
  tcg/ppc/tcg-target.c.inc     |  5 -----
  tcg/riscv/tcg-target.c.inc   |  2 --
  tcg/s390/tcg-target.c.inc    |  4 ----
  tcg/sparc/tcg-target.c.inc   |  5 -----
  tcg/tci/tcg-target.c.inc     |  1 -
 files changed, 4 insertions(+), 49 deletions(-)
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg.h
 +++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+@@ -XXX,XX +XXX,XX @@
- #define TCG_CT_ALIAS  0x80
+ #else
- #define TCG_CT_IALIAS 0x40
+ #define MAX_OPC_PARAM_PER_ARG 1
  #define TCG_CT_NEWREG 0x20 /* output requires a new register */
 -#define TCG_CT_REG    0x01
  #define TCG_CT_CONST  0x02 /* any constant of register size */
  typedef struct TCGArgConstraint {
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
  /* we give more priority to constraints with less registers */
  static int get_constraint_priority(const TCGOpDef *def, int k)
  {
 -    const TCGArgConstraint *arg_ct;
 +    const TCGArgConstraint *arg_ct = &def->args_ct[k];
 +    int n;
 -    int i, n;
 -    arg_ct = &def->args_ct[k];
      if (arg_ct->ct & TCG_CT_ALIAS) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
 -        if (!(arg_ct->ct & TCG_CT_REG))
 -            return 0;
 -        n = 0;
 -        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
 -            if (tcg_regset_test_reg(arg_ct->regs, i))
 -                n++;
 -        }
 +        n = ctpop64(arg_ct->regs);
      }
      return TCG_TARGET_NB_REGS - n + 1;
  }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          int oarg = *ct_str - '0';
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
 -                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
 +                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                          /* TCG_CT_ALIAS is for the output arguments.
                             The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r': /* general registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= 0xffffffffu;
          break;
      case 'w': /* advsimd registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= 0xffffffff00000000ull;
          break;
      case 'l': /* qemu_ld / qemu_st address, data_reg */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffffu;
  #ifdef CONFIG_SOFTMMU
          /* x0 and x1 will be overwritten when reading the tlb entry,
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      /* qemu_ld address */
      case 'l':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
  #ifdef CONFIG_SOFTMMU
          /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      /* qemu_st address & data */
      case 's':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch(*ct_str++) {
      case 'a':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
          break;
      case 'b':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
          break;
      case 'c':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
          break;
      case 'd':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
          break;
      case 'S':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
          break;
      case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
          break;
      case 'q':
          /* A register that can be used as a byte operand.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
          break;
      case 'Q':
          /* A register with an addressable second byte (e.g. %ah).  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xf;
          break;
      case 'r':
          /* A general register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          break;
      case 'x':
          /* A vector register.  */
 -        ct->ct |= TCG_CT_REG;
          ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
          tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch(*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L': /* qemu_ld input arg constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
-         break;
+-#define MAX_OPC_PARAM_IARGS 6
-     case 'S': /* qemu_st constraint */
++#define MAX_OPC_PARAM_IARGS 7
--        ct->ct |= TCG_CT_REG;
+ #define MAX_OPC_PARAM_OARGS 1
-         ct->regs = 0xffffffff;
+ #define MAX_OPC_PARAM_ARGS (MAX_OPC_PARAM_IARGS + MAX_OPC_PARAM_OARGS)
-         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
 -        ct->ct |= TCG_CT_REG;
          tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'v':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':                  /* all registers */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffff;
          tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
          tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0;
          tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
  {
      switch (*ct_str++) {
      case 'r':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          break;
      case 'R':
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
          tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
          tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
 -        ct->ct |= TCG_CT_REG;
          ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
-     case 'r':
+     TCG_REG_R0,
-     case 'L':                   /* qemu_ld constraint */
+ };
-     case 'S':                   /* qemu_st constraint */
--        ct->ct |= TCG_CT_REG;
+-#if MAX_OPC_PARAM_IARGS != 6
-         ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
++#if MAX_OPC_PARAM_IARGS != 7
-         break;
+ # error Fix needed, number of supported input arguments changed!
-     default:
+ #endif
 --
 .25.1

-[PULL 10/11] tcg: Remove TCG_TARGET_HAS_cmp_vec
+[PULL 03/30] tcg: Add opcodes for vector nand, nor, eqv
-The cmp_vec opcode is mandatory; this symbol is unused.
+We've had placeholders for these opcodes for a while,
+and should have support on ppc, s390x and avx512 hosts.
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.h | 1 -
+ include/tcg/tcg-opc.h    |  3 +++
- tcg/i386/tcg-target.h    | 1 -
+ include/tcg/tcg.h        |  3 +++
- tcg/ppc/tcg-target.h     | 1 -
+ tcg/aarch64/tcg-target.h |  3 +++
-files changed, 3 deletions(-)
+ tcg/arm/tcg-target.h     |  3 +++
+ tcg/i386/tcg-target.h    |  3 +++
  tcg/ppc/tcg-target.h     |  3 +++
  tcg/s390x/tcg-target.h   |  3 +++
  tcg/optimize.c           | 12 ++++++------
  tcg/tcg-op-vec.c         | 27 ++++++++++++++++++---------
  tcg/tcg.c                |  6 ++++++
 files changed, 51 insertions(+), 15 deletions(-)
 diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg-opc.h
 +++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(or_vec, 1, 2, 0, IMPLVEC)
  DEF(xor_vec, 1, 2, 0, IMPLVEC)
  DEF(andc_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_andc_vec))
  DEF(orc_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_orc_vec))
 +DEF(nand_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_nand_vec))
 +DEF(nor_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_nor_vec))
 +DEF(eqv_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_eqv_vec))
  DEF(not_vec, 1, 1, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_not_vec))
  DEF(shli_vec, 1, 1, 1, IMPLVEC | IMPL(TCG_TARGET_HAS_shi_vec))
 diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/tcg/tcg.h
 +++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
  #define TCG_TARGET_HAS_not_vec          0
  #define TCG_TARGET_HAS_andc_vec         0
  #define TCG_TARGET_HAS_orc_vec          0
 +#define TCG_TARGET_HAS_nand_vec         0
 +#define TCG_TARGET_HAS_nor_vec          0
 +#define TCG_TARGET_HAS_eqv_vec          0
  #define TCG_TARGET_HAS_roti_vec         0
  #define TCG_TARGET_HAS_rots_vec         0
  #define TCG_TARGET_HAS_rotv_vec         0
 diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.h
 +++ b/tcg/aarch64/tcg-target.h
 @@ -XXX,XX +XXX,XX @@ typedef enum {
- #define TCG_TARGET_HAS_shi_vec          1
- #define TCG_TARGET_HAS_shs_vec          0
+ #define TCG_TARGET_HAS_andc_vec         1
- #define TCG_TARGET_HAS_shv_vec          1
+ #define TCG_TARGET_HAS_orc_vec          1
--#define TCG_TARGET_HAS_cmp_vec          1
++#define TCG_TARGET_HAS_nand_vec         0
- #define TCG_TARGET_HAS_mul_vec          1
++#define TCG_TARGET_HAS_nor_vec          0
- #define TCG_TARGET_HAS_sat_vec          1
++#define TCG_TARGET_HAS_eqv_vec          0
- #define TCG_TARGET_HAS_minmax_vec       1
+ #define TCG_TARGET_HAS_not_vec          1
  #define TCG_TARGET_HAS_neg_vec          1
  #define TCG_TARGET_HAS_abs_vec          1
 diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.h
 +++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
  #define TCG_TARGET_HAS_andc_vec         1
  #define TCG_TARGET_HAS_orc_vec          1
 +#define TCG_TARGET_HAS_nand_vec         0
 +#define TCG_TARGET_HAS_nor_vec          0
 +#define TCG_TARGET_HAS_eqv_vec          0
  #define TCG_TARGET_HAS_not_vec          1
  #define TCG_TARGET_HAS_neg_vec          1
  #define TCG_TARGET_HAS_abs_vec          1
 diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.h
 +++ b/tcg/i386/tcg-target.h
-@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
+@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
- #define TCG_TARGET_HAS_shi_vec          1
- #define TCG_TARGET_HAS_shs_vec          1
+ #define TCG_TARGET_HAS_andc_vec         1
- #define TCG_TARGET_HAS_shv_vec          have_avx2
+ #define TCG_TARGET_HAS_orc_vec          0
--#define TCG_TARGET_HAS_cmp_vec          1
++#define TCG_TARGET_HAS_nand_vec         0
- #define TCG_TARGET_HAS_mul_vec          1
++#define TCG_TARGET_HAS_nor_vec          0
- #define TCG_TARGET_HAS_sat_vec          1
++#define TCG_TARGET_HAS_eqv_vec          0
- #define TCG_TARGET_HAS_minmax_vec       1
+ #define TCG_TARGET_HAS_not_vec          0
  #define TCG_TARGET_HAS_neg_vec          0
  #define TCG_TARGET_HAS_abs_vec          1
 diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.h
 +++ b/tcg/ppc/tcg-target.h
 @@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
- #define TCG_TARGET_HAS_shi_vec          0
- #define TCG_TARGET_HAS_shs_vec          0
+ #define TCG_TARGET_HAS_andc_vec         1
- #define TCG_TARGET_HAS_shv_vec          1
+ #define TCG_TARGET_HAS_orc_vec          have_isa_2_07
--#define TCG_TARGET_HAS_cmp_vec          1
++#define TCG_TARGET_HAS_nand_vec         0
- #define TCG_TARGET_HAS_mul_vec          1
++#define TCG_TARGET_HAS_nor_vec          0
- #define TCG_TARGET_HAS_sat_vec          1
++#define TCG_TARGET_HAS_eqv_vec          0
- #define TCG_TARGET_HAS_minmax_vec       1
+ #define TCG_TARGET_HAS_not_vec          1
  #define TCG_TARGET_HAS_neg_vec          have_isa_3_00
  #define TCG_TARGET_HAS_abs_vec          0
 diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390x/tcg-target.h
 +++ b/tcg/s390x/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities[3];
  #define TCG_TARGET_HAS_andc_vec       1
  #define TCG_TARGET_HAS_orc_vec        HAVE_FACILITY(VECTOR_ENH1)
 +#define TCG_TARGET_HAS_nand_vec       0
 +#define TCG_TARGET_HAS_nor_vec        0
 +#define TCG_TARGET_HAS_eqv_vec        0
  #define TCG_TARGET_HAS_not_vec        1
  #define TCG_TARGET_HAS_neg_vec        1
  #define TCG_TARGET_HAS_abs_vec        1
 diff --git a/tcg/optimize.c b/tcg/optimize.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/optimize.c
 +++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
      CASE_OP_32_64_VEC(orc):
          return x | ~y;
 -    CASE_OP_32_64(eqv):
 +    CASE_OP_32_64_VEC(eqv):
          return ~(x ^ y);
 -    CASE_OP_32_64(nand):
 +    CASE_OP_32_64_VEC(nand):
          return ~(x & y);
 -    CASE_OP_32_64(nor):
 +    CASE_OP_32_64_VEC(nor):
          return ~(x | y);
      case INDEX_op_clz_i32:
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
          case INDEX_op_dup2_vec:
              done = fold_dup2(&ctx, op);
              break;
 -        CASE_OP_32_64(eqv):
 +        CASE_OP_32_64_VEC(eqv):
              done = fold_eqv(&ctx, op);
              break;
          CASE_OP_32_64(extract):
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
          CASE_OP_32_64(mulu2):
              done = fold_multiply2(&ctx, op);
              break;
 -        CASE_OP_32_64(nand):
 +        CASE_OP_32_64_VEC(nand):
              done = fold_nand(&ctx, op);
              break;
          CASE_OP_32_64(neg):
              done = fold_neg(&ctx, op);
              break;
 -        CASE_OP_32_64(nor):
 +        CASE_OP_32_64_VEC(nor):
              done = fold_nor(&ctx, op);
              break;
          CASE_OP_32_64_VEC(not):
 diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op-vec.c
 +++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_orc_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
  void tcg_gen_nand_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
  {
 -    /* TODO: Add TCG_TARGET_HAS_nand_vec when adding a backend supports it. */
 -    tcg_gen_and_vec(0, r, a, b);
 -    tcg_gen_not_vec(0, r, r);
 +    if (TCG_TARGET_HAS_nand_vec) {
 +        vec_gen_op3(INDEX_op_nand_vec, 0, r, a, b);
 +    } else {
 +        tcg_gen_and_vec(0, r, a, b);
 +        tcg_gen_not_vec(0, r, r);
 +    }
  }
  void tcg_gen_nor_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
  {
 -    /* TODO: Add TCG_TARGET_HAS_nor_vec when adding a backend supports it. */
 -    tcg_gen_or_vec(0, r, a, b);
 -    tcg_gen_not_vec(0, r, r);
 +    if (TCG_TARGET_HAS_nor_vec) {
 +        vec_gen_op3(INDEX_op_nor_vec, 0, r, a, b);
 +    } else {
 +        tcg_gen_or_vec(0, r, a, b);
 +        tcg_gen_not_vec(0, r, r);
 +    }
  }
  void tcg_gen_eqv_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
  {
 -    /* TODO: Add TCG_TARGET_HAS_eqv_vec when adding a backend supports it. */
 -    tcg_gen_xor_vec(0, r, a, b);
 -    tcg_gen_not_vec(0, r, r);
 +    if (TCG_TARGET_HAS_eqv_vec) {
 +        vec_gen_op3(INDEX_op_eqv_vec, 0, r, a, b);
 +    } else {
 +        tcg_gen_xor_vec(0, r, a, b);
 +        tcg_gen_not_vec(0, r, r);
 +    }
  }
  static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
          return have_vec && TCG_TARGET_HAS_andc_vec;
      case INDEX_op_orc_vec:
          return have_vec && TCG_TARGET_HAS_orc_vec;
 +    case INDEX_op_nand_vec:
 +        return have_vec && TCG_TARGET_HAS_nand_vec;
 +    case INDEX_op_nor_vec:
 +        return have_vec && TCG_TARGET_HAS_nor_vec;
 +    case INDEX_op_eqv_vec:
 +        return have_vec && TCG_TARGET_HAS_eqv_vec;
      case INDEX_op_mul_vec:
          return have_vec && TCG_TARGET_HAS_mul_vec;
      case INDEX_op_shli_vec:
 --
 .25.1

-New patch
+[PULL 04/30] tcg/ppc: Implement vector NAND, NOR, EQV
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/ppc/tcg-target.h     |  6 +++---
+ tcg/ppc/tcg-target.c.inc | 15 +++++++++++++++
+files changed, 18 insertions(+), 3 deletions(-)
+diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.h
++++ b/tcg/ppc/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
+ #define TCG_TARGET_HAS_andc_vec         1
+ #define TCG_TARGET_HAS_orc_vec          have_isa_2_07
+-#define TCG_TARGET_HAS_nand_vec         0
+-#define TCG_TARGET_HAS_nor_vec          0
+-#define TCG_TARGET_HAS_eqv_vec          0
++#define TCG_TARGET_HAS_nand_vec         have_isa_2_07
++#define TCG_TARGET_HAS_nor_vec          1
++#define TCG_TARGET_HAS_eqv_vec          have_isa_2_07
+ #define TCG_TARGET_HAS_not_vec          1
+ #define TCG_TARGET_HAS_neg_vec          have_isa_3_00
+ #define TCG_TARGET_HAS_abs_vec          0
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/ppc/tcg-target.c.inc
++++ b/tcg/ppc/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_xor_vec:
+     case INDEX_op_andc_vec:
+     case INDEX_op_not_vec:
++    case INDEX_op_nor_vec:
++    case INDEX_op_eqv_vec:
++    case INDEX_op_nand_vec:
+         return 1;
+     case INDEX_op_orc_vec:
+         return have_isa_2_07;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_orc_vec:
+         insn = VORC;
+         break;
++    case INDEX_op_nand_vec:
++        insn = VNAND;
++        break;
++    case INDEX_op_nor_vec:
++        insn = VNOR;
++        break;
++    case INDEX_op_eqv_vec:
++        insn = VEQV;
++        break;
+     case INDEX_op_cmp_vec:
+         switch (args[3]) {
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_xor_vec:
+     case INDEX_op_andc_vec:
+     case INDEX_op_orc_vec:
++    case INDEX_op_nor_vec:
++    case INDEX_op_eqv_vec:
++    case INDEX_op_nand_vec:
+     case INDEX_op_cmp_vec:
+     case INDEX_op_ssadd_vec:
+     case INDEX_op_sssub_vec:
+--
+.25.1

-New patch
+[PULL 05/30] tcg/s390x: Implement vector NAND, NOR, EQV
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/s390x/tcg-target.h     |  6 +++---
+ tcg/s390x/tcg-target.c.inc | 17 +++++++++++++++++
+files changed, 20 insertions(+), 3 deletions(-)
+diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.h
++++ b/tcg/s390x/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities[3];
+ #define TCG_TARGET_HAS_andc_vec       1
+ #define TCG_TARGET_HAS_orc_vec        HAVE_FACILITY(VECTOR_ENH1)
+-#define TCG_TARGET_HAS_nand_vec       0
+-#define TCG_TARGET_HAS_nor_vec        0
+-#define TCG_TARGET_HAS_eqv_vec        0
++#define TCG_TARGET_HAS_nand_vec       HAVE_FACILITY(VECTOR_ENH1)
++#define TCG_TARGET_HAS_nor_vec        1
++#define TCG_TARGET_HAS_eqv_vec        HAVE_FACILITY(VECTOR_ENH1)
+ #define TCG_TARGET_HAS_not_vec        1
+ #define TCG_TARGET_HAS_neg_vec        1
+ #define TCG_TARGET_HAS_abs_vec        1
+diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/s390x/tcg-target.c.inc
++++ b/tcg/s390x/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ typedef enum S390Opcode {
+     VRRc_VMXL   = 0xe7fd,
+     VRRc_VN     = 0xe768,
+     VRRc_VNC    = 0xe769,
++    VRRc_VNN    = 0xe76e,
+     VRRc_VNO    = 0xe76b,
++    VRRc_VNX    = 0xe76c,
+     VRRc_VO     = 0xe76a,
+     VRRc_VOC    = 0xe76f,
+     VRRc_VPKS   = 0xe797,   /* we leave the m5 cs field 0 */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_xor_vec:
+         tcg_out_insn(s, VRRc, VX, a0, a1, a2, 0);
+         break;
++    case INDEX_op_nand_vec:
++        tcg_out_insn(s, VRRc, VNN, a0, a1, a2, 0);
++        break;
++    case INDEX_op_nor_vec:
++        tcg_out_insn(s, VRRc, VNO, a0, a1, a2, 0);
++        break;
++    case INDEX_op_eqv_vec:
++        tcg_out_insn(s, VRRc, VNX, a0, a1, a2, 0);
++        break;
+     case INDEX_op_shli_vec:
+         tcg_out_insn(s, VRSa, VESL, a0, a2, TCG_REG_NONE, a1, vece);
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_and_vec:
+     case INDEX_op_andc_vec:
+     case INDEX_op_bitsel_vec:
++    case INDEX_op_eqv_vec:
++    case INDEX_op_nand_vec:
+     case INDEX_op_neg_vec:
++    case INDEX_op_nor_vec:
+     case INDEX_op_not_vec:
+     case INDEX_op_or_vec:
+     case INDEX_op_orc_vec:
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_or_vec:
+     case INDEX_op_orc_vec:
+     case INDEX_op_xor_vec:
++    case INDEX_op_nand_vec:
++    case INDEX_op_nor_vec:
++    case INDEX_op_eqv_vec:
+     case INDEX_op_cmp_vec:
+     case INDEX_op_mul_vec:
+     case INDEX_op_rotlv_vec:
+--
+.25.1

-New patch
+[PULL 06/30] tcg/i386: Detect AVX512
+There are some operation sizes in some subsets of AVX512 that
+are missing from previous iterations of AVX.  Detect them.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/qemu/cpuid.h      | 20 +++++++++++++++++---
+ tcg/i386/tcg-target.h     |  4 ++++
+ tcg/i386/tcg-target.c.inc | 24 ++++++++++++++++++++++--
+files changed, 43 insertions(+), 5 deletions(-)
+diff --git a/include/qemu/cpuid.h b/include/qemu/cpuid.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/cpuid.h
++++ b/include/qemu/cpuid.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef bit_AVX2
+ #define bit_AVX2        (1 << 5)
+ #endif
+-#ifndef bit_AVX512F
+-#define bit_AVX512F        (1 << 16)
+-#endif
+ #ifndef bit_BMI2
+ #define bit_BMI2        (1 << 8)
+ #endif
++#ifndef bit_AVX512F
++#define bit_AVX512F     (1 << 16)
++#endif
++#ifndef bit_AVX512DQ
++#define bit_AVX512DQ    (1 << 17)
++#endif
++#ifndef bit_AVX512BW
++#define bit_AVX512BW    (1 << 30)
++#endif
++#ifndef bit_AVX512VL
++#define bit_AVX512VL    (1u << 31)
++#endif
++
++/* Leaf 7, %ecx */
++#ifndef bit_AVX512VBMI2
++#define bit_AVX512VBMI2 (1 << 6)
++#endif
+ /* Leaf 0x80000001, %ecx */
+ #ifndef bit_LZCNT
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_bmi1;
+ extern bool have_popcnt;
+ extern bool have_avx1;
+ extern bool have_avx2;
++extern bool have_avx512bw;
++extern bool have_avx512dq;
++extern bool have_avx512vbmi2;
++extern bool have_avx512vl;
+ extern bool have_movbe;
+ /* optional instructions */
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ bool have_bmi1;
+ bool have_popcnt;
+ bool have_avx1;
+ bool have_avx2;
++bool have_avx512bw;
++bool have_avx512dq;
++bool have_avx512vbmi2;
++bool have_avx512vl;
+ bool have_movbe;
+ #ifdef CONFIG_CPUID_H
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
+ static void tcg_target_init(TCGContext *s)
+ {
+ #ifdef CONFIG_CPUID_H
+-    unsigned a, b, c, d, b7 = 0;
++    unsigned a, b, c, d, b7 = 0, c7 = 0;
+     unsigned max = __get_cpuid_max(0, 0);
+     if (max >= 7) {
+         /* BMI1 is available on AMD Piledriver and Intel Haswell CPUs.  */
+-        __cpuid_count(7, 0, a, b7, c, d);
++        __cpuid_count(7, 0, a, b7, c7, d);
+         have_bmi1 = (b7 & bit_BMI) != 0;
+         have_bmi2 = (b7 & bit_BMI2) != 0;
+     }
+@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
+             if ((xcrl & 6) == 6) {
+                 have_avx1 = (c & bit_AVX) != 0;
+                 have_avx2 = (b7 & bit_AVX2) != 0;
++
++                /*
++                 * There are interesting instructions in AVX512, so long
++                 * as we have AVX512VL, which indicates support for EVEX
++                 * on sizes smaller than 512 bits.  We are required to
++                 * check that OPMASK and all extended ZMM state are enabled
++                 * even if we're not using them -- the insns will fault.
++                 */
++                if ((xcrl & 0xe0) == 0xe0
++                    && (b7 & bit_AVX512F)
++                    && (b7 & bit_AVX512VL)) {
++                    have_avx512vl = true;
++                    have_avx512bw = (b7 & bit_AVX512BW) != 0;
++                    have_avx512dq = (b7 & bit_AVX512DQ) != 0;
++                    have_avx512vbmi2 = (c7 & bit_AVX512VBMI2) != 0;
++                }
+             }
+         }
+     }
+--
+.25.1

-[PULL 11/11] accel/tcg: Fix computing of is_write for MIPS
+[PULL 07/30] tcg/i386: Add tcg_out_evex_opc
-From: Kele Huang <kele.hwang@gmail.com>
+The evex encoding is added here, for use in a subsequent patch.
-Detect all MIPS store instructions in cpu_signal_handler for all available
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-MIPS versions, and set is_write if encountering such store instructions.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 This fixed the error while dealing with self-modified code for MIPS.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Kele Huang <kele.hwang@gmail.com>
 Signed-off-by: Xu Zou <iwatchnima@gmail.com>
 Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
 [rth: Use uintptr_t for pc to fix n32 build error.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
+ tcg/i386/tcg-target.c.inc | 51 ++++++++++++++++++++++++++++++++++++++-
-file changed, 39 insertions(+), 4 deletions(-)
+file changed, 50 insertions(+), 1 deletion(-)
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
+--- a/tcg/i386/tcg-target.c.inc
-+++ b/accel/tcg/user-exec.c
++++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define P_SIMDF3        0x20000         /* 0xf3 opcode prefix */
- #elif defined(__mips__)
+ #define P_SIMDF2        0x40000         /* 0xf2 opcode prefix */
+ #define P_VEXL          0x80000         /* Set VEX.L = 1 */
-+#if defined(__misp16) || defined(__mips_micromips)
++#define P_EVEX          0x100000        /* Requires EVEX encoding */
-+#error "Unsupported encoding"
-+#endif
+ #define OPC_ARITH_EvIz    (0x81)
  #define OPC_ARITH_EvIb    (0x83)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
      tcg_out8(s, opc);
  }
 +static void tcg_out_evex_opc(TCGContext *s, int opc, int r, int v,
 +                             int rm, int index)
 +{
 +    /* The entire 4-byte evex prefix; with R' and V' set. */
 +    uint32_t p = 0x08041062;
 +    int mm, pp;
 +
- int cpu_signal_handler(int host_signum, void *pinfo,
++    tcg_debug_assert(have_avx512vl);
-                        void *puc)
++
 +    /* EVEX.mm */
 +    if (opc & P_EXT3A) {
 +        mm = 3;
 +    } else if (opc & P_EXT38) {
 +        mm = 2;
 +    } else if (opc & P_EXT) {
 +        mm = 1;
 +    } else {
 +        g_assert_not_reached();
 +    }
 +
 +    /* EVEX.pp */
 +    if (opc & P_DATA16) {
 +        pp = 1;                          /* 0x66 */
 +    } else if (opc & P_SIMDF3) {
 +        pp = 2;                          /* 0xf3 */
 +    } else if (opc & P_SIMDF2) {
 +        pp = 3;                          /* 0xf2 */
 +    } else {
 +        pp = 0;
 +    }
 +
 +    p = deposit32(p, 8, 2, mm);
 +    p = deposit32(p, 13, 1, (rm & 8) == 0);             /* EVEX.RXB.B */
 +    p = deposit32(p, 14, 1, (index & 8) == 0);          /* EVEX.RXB.X */
 +    p = deposit32(p, 15, 1, (r & 8) == 0);              /* EVEX.RXB.R */
 +    p = deposit32(p, 16, 2, pp);
 +    p = deposit32(p, 19, 4, ~v);
 +    p = deposit32(p, 23, 1, (opc & P_VEXW) != 0);
 +    p = deposit32(p, 29, 2, (opc & P_VEXL) != 0);
 +
 +    tcg_out32(s, p);
 +    tcg_out8(s, opc);
 +}
 +
  static void tcg_out_vex_modrm(TCGContext *s, int opc, int r, int v, int rm)
  {
-     siginfo_t *info = pinfo;
+-    tcg_out_vex_opc(s, opc, r, v, rm, 0);
-     ucontext_t *uc = puc;
++    if (opc & P_EVEX) {
--    greg_t pc = uc->uc_mcontext.pc;
++        tcg_out_evex_opc(s, opc, r, v, rm, 0);
--    int is_write;
++    } else {
-+    uintptr_t pc = uc->uc_mcontext.pc;
++        tcg_out_vex_opc(s, opc, r, v, rm, 0);
 +    uint32_t insn = *(uint32_t *)pc;
 +    int is_write = 0;
 +
 +    /* Detect all store instructions at program counter. */
 +    switch((insn >> 26) & 077) {
 +    case 050: /* SB */
 +    case 051: /* SH */
 +    case 052: /* SWL */
 +    case 053: /* SW */
 +    case 054: /* SDL */
 +    case 055: /* SDR */
 +    case 056: /* SWR */
 +    case 070: /* SC */
 +    case 071: /* SWC1 */
 +    case 074: /* SCD */
 +    case 075: /* SDC1 */
 +    case 077: /* SD */
 +#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
 +    case 072: /* SWC2 */
 +    case 076: /* SDC2 */
 +#endif
 +        is_write = 1;
 +        break;
 +    case 023: /* COP1X */
 +        /* Required in all versions of MIPS64 since
 +           MIPS64r1 and subsequent versions of MIPS32r2. */
 +        switch (insn & 077) {
 +        case 010: /* SWXC1 */
 +        case 011: /* SDXC1 */
 +        case 015: /* SUXC1 */
 +            is_write = 1;
 +        }
 +        break;
 +    }
+     tcg_out8(s, 0xc0 | (LOWREGMASK(r) << 3) | LOWREGMASK(rm));
 -    /* XXX: compute is_write */
 -    is_write = 0;
      return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
  }
 --
 .25.1

-New patch
+[PULL 08/30] tcg/i386: Use tcg_can_emit_vec_op in expand_vec_cmp_noinv
+The condition for UMIN/UMAX availability is about to change;
+use the canonical version.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool expand_vec_cmp_noinv(TCGType type, unsigned vece, TCGv_vec v0,
+         fixup = NEED_SWAP | NEED_INV;
+         break;
+     case TCG_COND_LEU:
+-        if (vece <= MO_32) {
++        if (tcg_can_emit_vec_op(INDEX_op_umin_vec, type, vece)) {
+             fixup = NEED_UMIN;
+         } else {
+             fixup = NEED_BIAS | NEED_INV;
+         }
+         break;
+     case TCG_COND_GTU:
+-        if (vece <= MO_32) {
++        if (tcg_can_emit_vec_op(INDEX_op_umin_vec, type, vece)) {
+             fixup = NEED_UMIN | NEED_INV;
+         } else {
+             fixup = NEED_BIAS;
+         }
+         break;
+     case TCG_COND_GEU:
+-        if (vece <= MO_32) {
++        if (tcg_can_emit_vec_op(INDEX_op_umax_vec, type, vece)) {
+             fixup = NEED_UMAX;
+         } else {
+             fixup = NEED_BIAS | NEED_SWAP | NEED_INV;
+         }
+         break;
+     case TCG_COND_LTU:
+-        if (vece <= MO_32) {
++        if (tcg_can_emit_vec_op(INDEX_op_umax_vec, type, vece)) {
+             fixup = NEED_UMAX | NEED_INV;
+         } else {
+             fixup = NEED_BIAS | NEED_SWAP;
+--
+.25.1

-New patch
+[PULL 09/30] tcg/i386: Implement avx512 variable shifts
+AVX512VL has VPSRAVQ, and
+AVX512BW has VPSLLVW, VPSRAVW, VPSRLVW.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 32 ++++++++++++++++++++++++--------
+file changed, 24 insertions(+), 8 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
+ #define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
+ #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
++#define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
+ #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
++#define OPC_VPSRAVW     (0x11 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
++#define OPC_VPSRAVQ     (0x46 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSRLVW     (0x10 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
+ #define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
+ #define OPC_VZEROUPPER  (0x77 | P_EXT)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
+     };
+     static int const shlv_insn[4] = {
+-        /* TODO: AVX512 adds support for MO_16.  */
+-        OPC_UD2, OPC_UD2, OPC_VPSLLVD, OPC_VPSLLVQ
++        OPC_UD2, OPC_VPSLLVW, OPC_VPSLLVD, OPC_VPSLLVQ
+     };
+     static int const shrv_insn[4] = {
+-        /* TODO: AVX512 adds support for MO_16.  */
+-        OPC_UD2, OPC_UD2, OPC_VPSRLVD, OPC_VPSRLVQ
++        OPC_UD2, OPC_VPSRLVW, OPC_VPSRLVD, OPC_VPSRLVQ
+     };
+     static int const sarv_insn[4] = {
+-        /* TODO: AVX512 adds support for MO_16, MO_64.  */
+-        OPC_UD2, OPC_UD2, OPC_VPSRAVD, OPC_UD2
++        OPC_UD2, OPC_VPSRAVW, OPC_VPSRAVD, OPC_VPSRAVQ
+     };
+     static int const shls_insn[4] = {
+         OPC_UD2, OPC_PSLLW, OPC_PSLLD, OPC_PSLLQ
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_shlv_vec:
+     case INDEX_op_shrv_vec:
+-        return have_avx2 && vece >= MO_32;
++        switch (vece) {
++        case MO_16:
++            return have_avx512bw;
++        case MO_32:
++        case MO_64:
++            return have_avx2;
++        }
++        return 0;
+     case INDEX_op_sarv_vec:
+-        return have_avx2 && vece == MO_32;
++        switch (vece) {
++        case MO_16:
++            return have_avx512bw;
++        case MO_32:
++            return have_avx2;
++        case MO_64:
++            return have_avx512vl;
++        }
++        return 0;
+     case INDEX_op_rotlv_vec:
+     case INDEX_op_rotrv_vec:
+         return have_avx2 && vece >= MO_32 ? -1 : 0;
+--
+.25.1

-New patch
+[PULL 10/30] tcg/i386: Implement avx512 scalar shift
+AVX512VL has VPSRAQ.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 12 ++++++++++--
+file changed, 10 insertions(+), 2 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_PSLLQ       (0xf3 | P_EXT | P_DATA16)
+ #define OPC_PSRAW       (0xe1 | P_EXT | P_DATA16)
+ #define OPC_PSRAD       (0xe2 | P_EXT | P_DATA16)
++#define OPC_VPSRAQ      (0x72 | P_EXT | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PSRLW       (0xd1 | P_EXT | P_DATA16)
+ #define OPC_PSRLD       (0xd2 | P_EXT | P_DATA16)
+ #define OPC_PSRLQ       (0xd3 | P_EXT | P_DATA16)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         OPC_UD2, OPC_PSRLW, OPC_PSRLD, OPC_PSRLQ
+     };
+     static int const sars_insn[4] = {
+-        OPC_UD2, OPC_PSRAW, OPC_PSRAD, OPC_UD2
++        OPC_UD2, OPC_PSRAW, OPC_PSRAD, OPC_VPSRAQ
+     };
+     static int const abs_insn[4] = {
+         /* TODO: AVX512 adds support for MO_64.  */
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_shrs_vec:
+         return vece >= MO_16;
+     case INDEX_op_sars_vec:
+-        return vece >= MO_16 && vece <= MO_32;
++        switch (vece) {
++        case MO_16:
++        case MO_32:
++            return 1;
++        case MO_64:
++            return have_avx512vl;
++        }
++        return 0;
+     case INDEX_op_rotls_vec:
+         return vece >= MO_16 ? -1 : 0;
+--
+.25.1

-New patch
+[PULL 11/30] tcg/i386: Implement avx512 immediate sari shift
+AVX512 has VPSRAQ with immediate operand, in the same form as
+with AVX, but requires EVEX encoding and W1.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 30 +++++++++++++++++++++---------
+file changed, 21 insertions(+), 9 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         break;
+     case INDEX_op_shli_vec:
++        insn = shift_imm_insn[vece];
+         sub = 6;
+         goto gen_shift;
+     case INDEX_op_shri_vec:
++        insn = shift_imm_insn[vece];
+         sub = 2;
+         goto gen_shift;
+     case INDEX_op_sari_vec:
+-        tcg_debug_assert(vece != MO_64);
++        if (vece == MO_64) {
++            insn = OPC_PSHIFTD_Ib | P_VEXW | P_EVEX;
++        } else {
++            insn = shift_imm_insn[vece];
++        }
+         sub = 4;
+     gen_shift:
+         tcg_debug_assert(vece != MO_8);
+-        insn = shift_imm_insn[vece];
+         if (type == TCG_TYPE_V256) {
+             insn |= P_VEXL;
+         }
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+         return vece == MO_8 ? -1 : 1;
+     case INDEX_op_sari_vec:
+-        /* We must expand the operation for MO_8.  */
+-        if (vece == MO_8) {
++        switch (vece) {
++        case MO_8:
+             return -1;
+-        }
+-        /* We can emulate this for MO_64, but it does not pay off
+-           unless we're producing at least 4 values.  */
+-        if (vece == MO_64) {
++        case MO_16:
++        case MO_32:
++            return 1;
++        case MO_64:
++            if (have_avx512vl) {
++                return 1;
++            }
++            /*
++             * We can emulate this for MO_64, but it does not pay off
++             * unless we're producing at least 4 values.
++             */
+             return type >= TCG_TYPE_V256 ? -1 : 0;
+         }
+-        return 1;
++        return 0;
+     case INDEX_op_shls_vec:
+     case INDEX_op_shrs_vec:
+--
+.25.1

-New patch
+[PULL 12/30] tcg/i386: Implement avx512 immediate rotate
+AVX512VL has VPROLD and VPROLQ, layered onto the same
+opcode as PSHIFTD, but requires EVEX encoding and W1.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.h     |  2 +-
+ tcg/i386/tcg-target.c.inc | 15 +++++++++++++--
+files changed, 14 insertions(+), 3 deletions(-)
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
+ #define TCG_TARGET_HAS_not_vec          0
+ #define TCG_TARGET_HAS_neg_vec          0
+ #define TCG_TARGET_HAS_abs_vec          1
+-#define TCG_TARGET_HAS_roti_vec         0
++#define TCG_TARGET_HAS_roti_vec         have_avx512vl
+ #define TCG_TARGET_HAS_rots_vec         0
+ #define TCG_TARGET_HAS_rotv_vec         0
+ #define TCG_TARGET_HAS_shi_vec          1
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_PSHUFLW     (0x70 | P_EXT | P_SIMDF2)
+ #define OPC_PSHUFHW     (0x70 | P_EXT | P_SIMDF3)
+ #define OPC_PSHIFTW_Ib  (0x71 | P_EXT | P_DATA16) /* /2 /6 /4 */
+-#define OPC_PSHIFTD_Ib  (0x72 | P_EXT | P_DATA16) /* /2 /6 /4 */
++#define OPC_PSHIFTD_Ib  (0x72 | P_EXT | P_DATA16) /* /1 /2 /6 /4 */
+ #define OPC_PSHIFTQ_Ib  (0x73 | P_EXT | P_DATA16) /* /2 /6 /4 */
+ #define OPC_PSLLW       (0xf1 | P_EXT | P_DATA16)
+ #define OPC_PSLLD       (0xf2 | P_EXT | P_DATA16)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+             insn = shift_imm_insn[vece];
+         }
+         sub = 4;
++        goto gen_shift;
++    case INDEX_op_rotli_vec:
++        insn = OPC_PSHIFTD_Ib | P_EVEX;  /* VPROL[DQ] */
++        if (vece == MO_64) {
++            insn |= P_VEXW;
++        }
++        sub = 1;
++        goto gen_shift;
+     gen_shift:
+         tcg_debug_assert(vece != MO_8);
+         if (type == TCG_TYPE_V256) {
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_shli_vec:
+     case INDEX_op_shri_vec:
+     case INDEX_op_sari_vec:
++    case INDEX_op_rotli_vec:
+     case INDEX_op_x86_psrldq_vec:
+         return C_O1_I1(x, x);
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_xor_vec:
+     case INDEX_op_andc_vec:
+         return 1;
+-    case INDEX_op_rotli_vec:
+     case INDEX_op_cmp_vec:
+     case INDEX_op_cmpsel_vec:
+         return -1;
++    case INDEX_op_rotli_vec:
++        return have_avx512vl && vece >= MO_32 ? 1 : -1;
++
+     case INDEX_op_shli_vec:
+     case INDEX_op_shri_vec:
+         /* We must expand the operation for MO_8.  */
+--
+.25.1

-New patch
+[PULL 13/30] tcg/i386: Implement avx512 variable rotate
+AVX512VL has VPROLVD and VPRORVQ.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.h     |  2 +-
+ tcg/i386/tcg-target.c.inc | 25 ++++++++++++++++++++++++-
+files changed, 25 insertions(+), 2 deletions(-)
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
+ #define TCG_TARGET_HAS_abs_vec          1
+ #define TCG_TARGET_HAS_roti_vec         have_avx512vl
+ #define TCG_TARGET_HAS_rots_vec         0
+-#define TCG_TARGET_HAS_rotv_vec         0
++#define TCG_TARGET_HAS_rotv_vec         have_avx512vl
+ #define TCG_TARGET_HAS_shi_vec          1
+ #define TCG_TARGET_HAS_shs_vec          1
+ #define TCG_TARGET_HAS_shv_vec          have_avx2
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
+ #define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
+ #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
++#define OPC_VPROLVD     (0x15 | P_EXT38 | P_DATA16 | P_EVEX)
++#define OPC_VPROLVQ     (0x15 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPRORVD     (0x14 | P_EXT38 | P_DATA16 | P_EVEX)
++#define OPC_VPRORVQ     (0x14 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
+ #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     static int const umax_insn[4] = {
+         OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
+     };
++    static int const rotlv_insn[4] = {
++        OPC_UD2, OPC_UD2, OPC_VPROLVD, OPC_VPROLVQ
++    };
++    static int const rotrv_insn[4] = {
++        OPC_UD2, OPC_UD2, OPC_VPRORVD, OPC_VPRORVQ
++    };
+     static int const shlv_insn[4] = {
+         OPC_UD2, OPC_VPSLLVW, OPC_VPSLLVD, OPC_VPSLLVQ
+     };
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_sarv_vec:
+         insn = sarv_insn[vece];
+         goto gen_simd;
++    case INDEX_op_rotlv_vec:
++        insn = rotlv_insn[vece];
++        goto gen_simd;
++    case INDEX_op_rotrv_vec:
++        insn = rotrv_insn[vece];
++        goto gen_simd;
+     case INDEX_op_shls_vec:
+         insn = shls_insn[vece];
+         goto gen_simd;
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_shlv_vec:
+     case INDEX_op_shrv_vec:
+     case INDEX_op_sarv_vec:
++    case INDEX_op_rotlv_vec:
++    case INDEX_op_rotrv_vec:
+     case INDEX_op_shls_vec:
+     case INDEX_op_shrs_vec:
+     case INDEX_op_sars_vec:
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+         return 0;
+     case INDEX_op_rotlv_vec:
+     case INDEX_op_rotrv_vec:
+-        return have_avx2 && vece >= MO_32 ? -1 : 0;
++        switch (vece) {
++        case MO_32:
++        case MO_64:
++            return have_avx512vl ? 1 : have_avx2 ? -1 : 0;
++        }
++        return 0;
+     case INDEX_op_mul_vec:
+         if (vece == MO_8) {
+--
+.25.1

-New patch
+[PULL 14/30] tcg/i386: Support avx512vbmi2 vector shift-double instructions
+We will use VPSHLD, VPSHLDV and VPSHRDV for 16-bit rotates.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target-con-set.h |  1 +
+ tcg/i386/tcg-target.opc.h     |  3 +++
+ tcg/i386/tcg-target.c.inc     | 38 +++++++++++++++++++++++++++++++++++
+files changed, 42 insertions(+)
+diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target-con-set.h
++++ b/tcg/i386/tcg-target-con-set.h
+@@ -XXX,XX +XXX,XX @@ C_O1_I2(r, r, rI)
+ C_O1_I2(x, x, x)
+ C_N1_I2(r, r, r)
+ C_N1_I2(r, r, rW)
++C_O1_I3(x, 0, x, x)
+ C_O1_I3(x, x, x, x)
+ C_O1_I4(r, r, re, r, 0)
+ C_O1_I4(r, r, r, ri, ri)
+diff --git a/tcg/i386/tcg-target.opc.h b/tcg/i386/tcg-target.opc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.opc.h
++++ b/tcg/i386/tcg-target.opc.h
+@@ -XXX,XX +XXX,XX @@ DEF(x86_psrldq_vec, 1, 1, 1, IMPLVEC)
+ DEF(x86_vperm2i128_vec, 1, 2, 1, IMPLVEC)
+ DEF(x86_punpckl_vec, 1, 2, 0, IMPLVEC)
+ DEF(x86_punpckh_vec, 1, 2, 0, IMPLVEC)
++DEF(x86_vpshldi_vec, 1, 2, 1, IMPLVEC)
++DEF(x86_vpshldv_vec, 1, 3, 0, IMPLVEC)
++DEF(x86_vpshrdv_vec, 1, 3, 0, IMPLVEC)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_VPROLVQ     (0x15 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPRORVD     (0x14 | P_EXT38 | P_DATA16 | P_EVEX)
+ #define OPC_VPRORVQ     (0x14 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHLDW     (0x70 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHLDD     (0x71 | P_EXT3A | P_DATA16 | P_EVEX)
++#define OPC_VPSHLDQ     (0x71 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHLDVW    (0x70 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHLDVD    (0x71 | P_EXT38 | P_DATA16 | P_EVEX)
++#define OPC_VPSHLDVQ    (0x71 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHRDVW    (0x72 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
++#define OPC_VPSHRDVD    (0x73 | P_EXT38 | P_DATA16 | P_EVEX)
++#define OPC_VPSHRDVQ    (0x73 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
+ #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     static int const sars_insn[4] = {
+         OPC_UD2, OPC_PSRAW, OPC_PSRAD, OPC_VPSRAQ
+     };
++    static int const vpshldi_insn[4] = {
++        OPC_UD2, OPC_VPSHLDW, OPC_VPSHLDD, OPC_VPSHLDQ
++    };
++    static int const vpshldv_insn[4] = {
++        OPC_UD2, OPC_VPSHLDVW, OPC_VPSHLDVD, OPC_VPSHLDVQ
++    };
++    static int const vpshrdv_insn[4] = {
++        OPC_UD2, OPC_VPSHRDVW, OPC_VPSHRDVD, OPC_VPSHRDVQ
++    };
+     static int const abs_insn[4] = {
+         /* TODO: AVX512 adds support for MO_64.  */
+         OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_UD2
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     case INDEX_op_x86_packus_vec:
+         insn = packus_insn[vece];
+         goto gen_simd;
++    case INDEX_op_x86_vpshldv_vec:
++        insn = vpshldv_insn[vece];
++        a1 = a2;
++        a2 = args[3];
++        goto gen_simd;
++    case INDEX_op_x86_vpshrdv_vec:
++        insn = vpshrdv_insn[vece];
++        a1 = a2;
++        a2 = args[3];
++        goto gen_simd;
+ #if TCG_TARGET_REG_BITS == 32
+     case INDEX_op_dup2_vec:
+         /* First merge the two 32-bit inputs to a single 64-bit element. */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         insn = OPC_VPERM2I128;
+         sub = args[3];
+         goto gen_simd_imm8;
++    case INDEX_op_x86_vpshldi_vec:
++        insn = vpshldi_insn[vece];
++        sub = args[3];
++        goto gen_simd_imm8;
+     gen_simd_imm8:
++        tcg_debug_assert(insn != OPC_UD2);
+         if (type == TCG_TYPE_V256) {
+             insn |= P_VEXL;
+         }
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_x86_vperm2i128_vec:
+     case INDEX_op_x86_punpckl_vec:
+     case INDEX_op_x86_punpckh_vec:
++    case INDEX_op_x86_vpshldi_vec:
+ #if TCG_TARGET_REG_BITS == 32
+     case INDEX_op_dup2_vec:
+ #endif
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_x86_psrldq_vec:
+         return C_O1_I1(x, x);
++    case INDEX_op_x86_vpshldv_vec:
++    case INDEX_op_x86_vpshrdv_vec:
++        return C_O1_I3(x, 0, x, x);
++
+     case INDEX_op_x86_vpblendvb_vec:
+         return C_O1_I3(x, x, x, x);
+--
+.25.1

-New patch
+[PULL 15/30] tcg/i386: Expand vector word rotate as avx512vbmi2 shift-double
+While there are no specific 16-bit rotate instructions, there
+are double-word shifts, which can perform the same operation.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 18 +++++++++++++++++-
+file changed, 17 insertions(+), 1 deletion(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_rotlv_vec:
+     case INDEX_op_rotrv_vec:
+         switch (vece) {
++        case MO_16:
++            return have_avx512vbmi2 ? -1 : 0;
+         case MO_32:
+         case MO_64:
+             return have_avx512vl ? 1 : have_avx2 ? -1 : 0;
+@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotli(TCGType type, unsigned vece,
+         return;
+     }
++    if (have_avx512vbmi2) {
++        vec_gen_4(INDEX_op_x86_vpshldi_vec, type, vece,
++                  tcgv_vec_arg(v0), tcgv_vec_arg(v1), tcgv_vec_arg(v1), imm);
++        return;
++    }
++
+     t = tcg_temp_new_vec(type);
+     tcg_gen_shli_vec(vece, t, v1, imm);
+     tcg_gen_shri_vec(vece, v0, v1, (8 << vece) - imm);
+@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotls(TCGType type, unsigned vece,
+ static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
+                             TCGv_vec v1, TCGv_vec sh, bool right)
+ {
+-    TCGv_vec t = tcg_temp_new_vec(type);
++    TCGv_vec t;
++    if (have_avx512vbmi2) {
++        vec_gen_4(right ? INDEX_op_x86_vpshrdv_vec : INDEX_op_x86_vpshldv_vec,
++                  type, vece, tcgv_vec_arg(v0), tcgv_vec_arg(v1),
++                  tcgv_vec_arg(v1), tcgv_vec_arg(sh));
++        return;
++    }
++
++    t = tcg_temp_new_vec(type);
+     tcg_gen_dupi_vec(vece, t, 8 << vece);
+     tcg_gen_sub_vec(vece, t, t, sh);
+     if (right) {
+--
+.25.1

-New patch
+[PULL 16/30] tcg/i386: Remove rotls_vec from tcg_target_op_def
+There is no such instruction on x86, so we should
+not be pretending it has arguments.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 1 -
+file changed, 1 deletion(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_shls_vec:
+     case INDEX_op_shrs_vec:
+     case INDEX_op_sars_vec:
+-    case INDEX_op_rotls_vec:
+     case INDEX_op_cmp_vec:
+     case INDEX_op_x86_shufps_vec:
+     case INDEX_op_x86_blend_vec:
+--
+.25.1

-New patch
+[PULL 17/30] tcg/i386: Expand scalar rotate with avx512 insns
+Expand 32-bit and 64-bit scalar rotate with VPRO[LR]V;
+expand 16-bit scalar rotate with VPSHLDV.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 49 +++++++++++++++++++++++----------------
+file changed, 29 insertions(+), 20 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotli(TCGType type, unsigned vece,
+     tcg_temp_free_vec(t);
+ }
+-static void expand_vec_rotls(TCGType type, unsigned vece,
+-                             TCGv_vec v0, TCGv_vec v1, TCGv_i32 lsh)
+-{
+-    TCGv_i32 rsh;
+-    TCGv_vec t;
+-
+-    tcg_debug_assert(vece != MO_8);
+-
+-    t = tcg_temp_new_vec(type);
+-    rsh = tcg_temp_new_i32();
+-
+-    tcg_gen_neg_i32(rsh, lsh);
+-    tcg_gen_andi_i32(rsh, rsh, (8 << vece) - 1);
+-    tcg_gen_shls_vec(vece, t, v1, lsh);
+-    tcg_gen_shrs_vec(vece, v0, v1, rsh);
+-    tcg_gen_or_vec(vece, v0, v0, t);
+-    tcg_temp_free_vec(t);
+-    tcg_temp_free_i32(rsh);
+-}
+-
+ static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
+                             TCGv_vec v1, TCGv_vec sh, bool right)
+ {
+@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
+     tcg_temp_free_vec(t);
+ }
++static void expand_vec_rotls(TCGType type, unsigned vece,
++                             TCGv_vec v0, TCGv_vec v1, TCGv_i32 lsh)
++{
++    TCGv_vec t = tcg_temp_new_vec(type);
++
++    tcg_debug_assert(vece != MO_8);
++
++    if (vece >= MO_32 ? have_avx512vl : have_avx512vbmi2) {
++        tcg_gen_dup_i32_vec(vece, t, lsh);
++        if (vece >= MO_32) {
++            tcg_gen_rotlv_vec(vece, v0, v1, t);
++        } else {
++            expand_vec_rotv(type, vece, v0, v1, t, false);
++        }
++    } else {
++        TCGv_i32 rsh = tcg_temp_new_i32();
++
++        tcg_gen_neg_i32(rsh, lsh);
++        tcg_gen_andi_i32(rsh, rsh, (8 << vece) - 1);
++        tcg_gen_shls_vec(vece, t, v1, lsh);
++        tcg_gen_shrs_vec(vece, v0, v1, rsh);
++        tcg_gen_or_vec(vece, v0, v0, t);
++
++        tcg_temp_free_i32(rsh);
++    }
++
++    tcg_temp_free_vec(t);
++}
++
+ static void expand_vec_mul(TCGType type, unsigned vece,
+                            TCGv_vec v0, TCGv_vec v1, TCGv_vec v2)
+ {
+--
+.25.1

-New patch
+[PULL 18/30] tcg/i386: Implement avx512 min/max/abs
+AVX512VL has VPABSQ, VPMAXSQ, VPMAXUQ, VPMINSQ, VPMINUQ.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.c.inc | 18 +++++++++++-------
+file changed, 11 insertions(+), 7 deletions(-)
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_PABSB       (0x1c | P_EXT38 | P_DATA16)
+ #define OPC_PABSW       (0x1d | P_EXT38 | P_DATA16)
+ #define OPC_PABSD       (0x1e | P_EXT38 | P_DATA16)
++#define OPC_VPABSQ      (0x1f | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PACKSSDW    (0x6b | P_EXT | P_DATA16)
+ #define OPC_PACKSSWB    (0x63 | P_EXT | P_DATA16)
+ #define OPC_PACKUSDW    (0x2b | P_EXT38 | P_DATA16)
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_PMAXSB      (0x3c | P_EXT38 | P_DATA16)
+ #define OPC_PMAXSW      (0xee | P_EXT | P_DATA16)
+ #define OPC_PMAXSD      (0x3d | P_EXT38 | P_DATA16)
++#define OPC_VPMAXSQ     (0x3d | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PMAXUB      (0xde | P_EXT | P_DATA16)
+ #define OPC_PMAXUW      (0x3e | P_EXT38 | P_DATA16)
+ #define OPC_PMAXUD      (0x3f | P_EXT38 | P_DATA16)
++#define OPC_VPMAXUQ     (0x3f | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PMINSB      (0x38 | P_EXT38 | P_DATA16)
+ #define OPC_PMINSW      (0xea | P_EXT | P_DATA16)
+ #define OPC_PMINSD      (0x39 | P_EXT38 | P_DATA16)
++#define OPC_VPMINSQ     (0x39 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PMINUB      (0xda | P_EXT | P_DATA16)
+ #define OPC_PMINUW      (0x3a | P_EXT38 | P_DATA16)
+ #define OPC_PMINUD      (0x3b | P_EXT38 | P_DATA16)
++#define OPC_VPMINUQ     (0x3b | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_PMOVSXBW    (0x20 | P_EXT38 | P_DATA16)
+ #define OPC_PMOVSXWD    (0x23 | P_EXT38 | P_DATA16)
+ #define OPC_PMOVSXDQ    (0x25 | P_EXT38 | P_DATA16)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         OPC_PACKUSWB, OPC_PACKUSDW, OPC_UD2, OPC_UD2
+     };
+     static int const smin_insn[4] = {
+-        OPC_PMINSB, OPC_PMINSW, OPC_PMINSD, OPC_UD2
++        OPC_PMINSB, OPC_PMINSW, OPC_PMINSD, OPC_VPMINSQ
+     };
+     static int const smax_insn[4] = {
+-        OPC_PMAXSB, OPC_PMAXSW, OPC_PMAXSD, OPC_UD2
++        OPC_PMAXSB, OPC_PMAXSW, OPC_PMAXSD, OPC_VPMAXSQ
+     };
+     static int const umin_insn[4] = {
+-        OPC_PMINUB, OPC_PMINUW, OPC_PMINUD, OPC_UD2
++        OPC_PMINUB, OPC_PMINUW, OPC_PMINUD, OPC_VPMINUQ
+     };
+     static int const umax_insn[4] = {
+-        OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
++        OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_VPMAXUQ
+     };
+     static int const rotlv_insn[4] = {
+         OPC_UD2, OPC_UD2, OPC_VPROLVD, OPC_VPROLVQ
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         OPC_UD2, OPC_VPSHRDVW, OPC_VPSHRDVD, OPC_VPSHRDVQ
+     };
+     static int const abs_insn[4] = {
+-        /* TODO: AVX512 adds support for MO_64.  */
+-        OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_UD2
++        OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_VPABSQ
+     };
+     TCGType type = vecl + TCG_TYPE_V64;
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_umin_vec:
+     case INDEX_op_umax_vec:
+     case INDEX_op_abs_vec:
+-        return vece <= MO_32;
++        return vece <= MO_32 || have_avx512vl;
+     default:
+         return 0;
+--
+.25.1

-[PULL 07/11] tcg/i386: Fix dupi for avx2 32-bit hosts
+[PULL 19/30] tcg/i386: Implement avx512 multiply
-The previous change wrongly stated that 32-bit avx2 should have
+AVX512DQ has VPMULLQ.
 used VPBROADCASTW.  But that's a 16-bit broadcast and we want a
 -bit broadcast.
-Fixes: 7b60ef3264e
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/i386/tcg-target.c.inc | 2 +-
+ tcg/i386/tcg-target.c.inc | 12 ++++++------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type,
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
-         new_pool_label(s, arg, R_386_PC32, s->code_ptr - 4, -4);
+ #define OPC_PMOVZXDQ    (0x35 | P_EXT38 | P_DATA16)
-     } else {
+ #define OPC_PMULLW      (0xd5 | P_EXT | P_DATA16)
-         if (have_avx2) {
+ #define OPC_PMULLD      (0x40 | P_EXT38 | P_DATA16)
--            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTW + vex_l, ret);
++#define OPC_VPMULLQ     (0x40 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
-+            tcg_out_vex_modrm_pool(s, OPC_VPBROADCASTD + vex_l, ret);
+ #define OPC_POR         (0xeb | P_EXT | P_DATA16)
-         } else {
+ #define OPC_PSHUFB      (0x00 | P_EXT38 | P_DATA16)
-             tcg_out_vex_modrm_pool(s, OPC_VBROADCASTSS, ret);
+ #define OPC_PSHUFD      (0x70 | P_EXT | P_DATA16)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
          OPC_PSUBUB, OPC_PSUBUW, OPC_UD2, OPC_UD2
      };
      static int const mul_insn[4] = {
 -        OPC_UD2, OPC_PMULLW, OPC_PMULLD, OPC_UD2
 +        OPC_UD2, OPC_PMULLW, OPC_PMULLD, OPC_VPMULLQ
      };
      static int const shift_imm_insn[4] = {
          OPC_UD2, OPC_PSHIFTW_Ib, OPC_PSHIFTD_Ib, OPC_PSHIFTQ_Ib
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
          return 0;
      case INDEX_op_mul_vec:
 -        if (vece == MO_8) {
 -            /* We can expand the operation for MO_8.  */
 +        switch (vece) {
 +        case MO_8:
              return -1;
 -        }
 -        if (vece == MO_64) {
 -            return 0;
 +        case MO_64:
 +            return have_avx512dq;
          }
+         return 1;
 --
 .25.1

-New patch
+[PULL 20/30] tcg/i386: Implement more logical operations for avx512
+AVX512VL has a general ternary logic operation, VPTERNLOGQ,
+which can implement NOT, ORC, NAND, NOR, EQV.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.h     | 10 +++++-----
+ tcg/i386/tcg-target.c.inc | 34 ++++++++++++++++++++++++++++++++++
+files changed, 39 insertions(+), 5 deletions(-)
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
+ #define TCG_TARGET_HAS_v256             have_avx2
+ #define TCG_TARGET_HAS_andc_vec         1
+-#define TCG_TARGET_HAS_orc_vec          0
+-#define TCG_TARGET_HAS_nand_vec         0
+-#define TCG_TARGET_HAS_nor_vec          0
+-#define TCG_TARGET_HAS_eqv_vec          0
+-#define TCG_TARGET_HAS_not_vec          0
++#define TCG_TARGET_HAS_orc_vec          have_avx512vl
++#define TCG_TARGET_HAS_nand_vec         have_avx512vl
++#define TCG_TARGET_HAS_nor_vec          have_avx512vl
++#define TCG_TARGET_HAS_eqv_vec          have_avx512vl
++#define TCG_TARGET_HAS_not_vec          have_avx512vl
+ #define TCG_TARGET_HAS_neg_vec          0
+ #define TCG_TARGET_HAS_abs_vec          1
+ #define TCG_TARGET_HAS_roti_vec         have_avx512vl
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+ #define OPC_VPSRLVW     (0x10 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
+ #define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
++#define OPC_VPTERNLOGQ  (0x25 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
+ #define OPC_VZEROUPPER  (0x77 | P_EXT)
+ #define OPC_XCHG_ax_r32    (0x90)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         insn = vpshldi_insn[vece];
+         sub = args[3];
+         goto gen_simd_imm8;
++
++    case INDEX_op_not_vec:
++        insn = OPC_VPTERNLOGQ;
++        a2 = a1;
++        sub = 0x33; /* !B */
++        goto gen_simd_imm8;
++    case INDEX_op_nor_vec:
++        insn = OPC_VPTERNLOGQ;
++        sub = 0x11; /* norCB */
++        goto gen_simd_imm8;
++    case INDEX_op_nand_vec:
++        insn = OPC_VPTERNLOGQ;
++        sub = 0x77; /* nandCB */
++        goto gen_simd_imm8;
++    case INDEX_op_eqv_vec:
++        insn = OPC_VPTERNLOGQ;
++        sub = 0x99; /* xnorCB */
++        goto gen_simd_imm8;
++    case INDEX_op_orc_vec:
++        insn = OPC_VPTERNLOGQ;
++        sub = 0xdd; /* orB!C */
++        goto gen_simd_imm8;
++
+     gen_simd_imm8:
+         tcg_debug_assert(insn != OPC_UD2);
+         if (type == TCG_TYPE_V256) {
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_or_vec:
+     case INDEX_op_xor_vec:
+     case INDEX_op_andc_vec:
++    case INDEX_op_orc_vec:
++    case INDEX_op_nand_vec:
++    case INDEX_op_nor_vec:
++    case INDEX_op_eqv_vec:
+     case INDEX_op_ssadd_vec:
+     case INDEX_op_usadd_vec:
+     case INDEX_op_sssub_vec:
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_abs_vec:
+     case INDEX_op_dup_vec:
++    case INDEX_op_not_vec:
+     case INDEX_op_shli_vec:
+     case INDEX_op_shri_vec:
+     case INDEX_op_sari_vec:
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_or_vec:
+     case INDEX_op_xor_vec:
+     case INDEX_op_andc_vec:
++    case INDEX_op_orc_vec:
++    case INDEX_op_nand_vec:
++    case INDEX_op_nor_vec:
++    case INDEX_op_eqv_vec:
++    case INDEX_op_not_vec:
+         return 1;
+     case INDEX_op_cmp_vec:
+     case INDEX_op_cmpsel_vec:
+--
+.25.1

-New patch
+[PULL 21/30] tcg/i386: Implement bitsel for avx512
+The general ternary logic operation can implement BITSEL.
+Funnel the 4-operand operation into three variants of the
+-operand instruction, depending on input operand overlap.
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/i386/tcg-target.h     |  2 +-
+ tcg/i386/tcg-target.c.inc | 20 +++++++++++++++++++-
+files changed, 20 insertions(+), 2 deletions(-)
+diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.h
++++ b/tcg/i386/tcg-target.h
+@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
+ #define TCG_TARGET_HAS_mul_vec          1
+ #define TCG_TARGET_HAS_sat_vec          1
+ #define TCG_TARGET_HAS_minmax_vec       1
+-#define TCG_TARGET_HAS_bitsel_vec       0
++#define TCG_TARGET_HAS_bitsel_vec       have_avx512vl
+ #define TCG_TARGET_HAS_cmpsel_vec       -1
+ #define TCG_TARGET_deposit_i32_valid(ofs, len) \
+diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/i386/tcg-target.c.inc
++++ b/tcg/i386/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+     TCGType type = vecl + TCG_TYPE_V64;
+     int insn, sub;
+-    TCGArg a0, a1, a2;
++    TCGArg a0, a1, a2, a3;
+     a0 = args[0];
+     a1 = args[1];
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
+         sub = 0xdd; /* orB!C */
+         goto gen_simd_imm8;
++    case INDEX_op_bitsel_vec:
++        insn = OPC_VPTERNLOGQ;
++        a3 = args[3];
++        if (a0 == a1) {
++            a1 = a2;
++            a2 = a3;
++            sub = 0xca; /* A?B:C */
++        } else if (a0 == a2) {
++            a2 = a3;
++            sub = 0xe2; /* B?A:C */
++        } else {
++            tcg_out_mov(s, type, a0, a3);
++            sub = 0xb8; /* B?C:A */
++        }
++        goto gen_simd_imm8;
++
+     gen_simd_imm8:
+         tcg_debug_assert(insn != OPC_UD2);
+         if (type == TCG_TYPE_V256) {
+@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
+     case INDEX_op_x86_vpshrdv_vec:
+         return C_O1_I3(x, 0, x, x);
++    case INDEX_op_bitsel_vec:
+     case INDEX_op_x86_vpblendvb_vec:
+         return C_O1_I3(x, x, x, x);
+@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
+     case INDEX_op_nor_vec:
+     case INDEX_op_eqv_vec:
+     case INDEX_op_not_vec:
++    case INDEX_op_bitsel_vec:
+         return 1;
+     case INDEX_op_cmp_vec:
+     case INDEX_op_cmpsel_vec:
+--
+.25.1

-[PULL 05/11] tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
+[PULL 22/30] tcg: Add TCG_TARGET_SIGNED_ADDR32
-These are easier to set and test when they have their own fields.
+Define as 0 for all tcg hosts.  Put this in a separate header,
-Reduce the size of alias_index and sort_index to 4 bits, which is
+because we'll want this in places that do not ordinarily have
-sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
+access to all of tcg/tcg.h.
 constants within the ct field.
-Move all initialization to allocation time, rather than init
+Reviewed-by: WANG Xuerui <git@xen0n.name>
-individual fields in process_op_defs.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h | 14 +++++++-------
+ tcg/aarch64/tcg-target-sa32.h     | 1 +
- tcg/tcg.c         | 28 ++++++++++++----------------
+ tcg/arm/tcg-target-sa32.h         | 1 +
-files changed, 19 insertions(+), 23 deletions(-)
+ tcg/i386/tcg-target-sa32.h        | 1 +
  tcg/loongarch64/tcg-target-sa32.h | 1 +
  tcg/mips/tcg-target-sa32.h        | 1 +
  tcg/ppc/tcg-target-sa32.h         | 1 +
  tcg/riscv/tcg-target-sa32.h       | 1 +
  tcg/s390x/tcg-target-sa32.h       | 1 +
  tcg/sparc/tcg-target-sa32.h       | 1 +
  tcg/tci/tcg-target-sa32.h         | 1 +
  tcg/tcg.c                         | 4 ++++
 files changed, 14 insertions(+)
  create mode 100644 tcg/aarch64/tcg-target-sa32.h
  create mode 100644 tcg/arm/tcg-target-sa32.h
  create mode 100644 tcg/i386/tcg-target-sa32.h
  create mode 100644 tcg/loongarch64/tcg-target-sa32.h
  create mode 100644 tcg/mips/tcg-target-sa32.h
  create mode 100644 tcg/ppc/tcg-target-sa32.h
  create mode 100644 tcg/riscv/tcg-target-sa32.h
  create mode 100644 tcg/s390x/tcg-target-sa32.h
  create mode 100644 tcg/sparc/tcg-target-sa32.h
  create mode 100644 tcg/tci/tcg-target-sa32.h
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/tcg/aarch64/tcg-target-sa32.h b/tcg/aarch64/tcg-target-sa32.h
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/include/tcg/tcg.h
+index XXXXXXX..XXXXXXX
-+++ b/include/tcg/tcg.h
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
++++ b/tcg/aarch64/tcg-target-sa32.h
- void tcg_dump_info(void);
+@@ -0,0 +1 @@
- void tcg_dump_op_count(void);
++#define TCG_TARGET_SIGNED_ADDR32 0
+diff --git a/tcg/arm/tcg-target-sa32.h b/tcg/arm/tcg-target-sa32.h
--#define TCG_CT_ALIAS  0x80
+new file mode 100644
--#define TCG_CT_IALIAS 0x40
+index XXXXXXX..XXXXXXX
--#define TCG_CT_NEWREG 0x20 /* output requires a new register */
+--- /dev/null
--#define TCG_CT_CONST  0x02 /* any constant of register size */
++++ b/tcg/arm/tcg-target-sa32.h
-+#define TCG_CT_CONST  1 /* any constant of register size */
+@@ -0,0 +1 @@
++#define TCG_TARGET_SIGNED_ADDR32 0
- typedef struct TCGArgConstraint {
+diff --git a/tcg/i386/tcg-target-sa32.h b/tcg/i386/tcg-target-sa32.h
--    uint16_t ct;
+new file mode 100644
--    uint8_t alias_index;
+index XXXXXXX..XXXXXXX
--    uint8_t sort_index;
+--- /dev/null
-+    unsigned ct : 16;
++++ b/tcg/i386/tcg-target-sa32.h
-+    unsigned alias_index : 4;
+@@ -0,0 +1 @@
-+    unsigned sort_index : 4;
++#define TCG_TARGET_SIGNED_ADDR32 0
-+    bool oalias : 1;
+diff --git a/tcg/loongarch64/tcg-target-sa32.h b/tcg/loongarch64/tcg-target-sa32.h
-+    bool ialias : 1;
+new file mode 100644
-+    bool newreg : 1;
+index XXXXXXX..XXXXXXX
-     TCGRegSet regs;
+--- /dev/null
- } TCGArgConstraint;
++++ b/tcg/loongarch64/tcg-target-sa32.h
+@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/mips/tcg-target-sa32.h b/tcg/mips/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/mips/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/ppc/tcg-target-sa32.h b/tcg/ppc/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/ppc/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/riscv/tcg-target-sa32.h b/tcg/riscv/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/riscv/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/s390x/tcg-target-sa32.h b/tcg/s390x/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/s390x/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/sparc/tcg-target-sa32.h b/tcg/sparc/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/sparc/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/tci/tcg-target-sa32.h b/tcg/tci/tcg-target-sa32.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tcg/tci/tcg-target-sa32.h
@@ -0,0 +1 @@
 +#define TCG_TARGET_SIGNED_ADDR32 0
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@
-         total_args += n;
+ #include "exec/log.h"
-     }
+ #include "tcg/tcg-ldst.h"
+ #include "tcg-internal.h"
--    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
++#include "tcg-target-sa32.h"
-+    args_ct = g_new0(TCGArgConstraint, total_args);
++
++/* Sanity check for TCG_TARGET_SIGNED_ADDR32. */
-     for(op = 0; op < NB_OPS; op++) {
++QEMU_BUILD_BUG_ON(TCG_TARGET_REG_BITS == 32 && TCG_TARGET_SIGNED_ADDR32);
-         def = &tcg_op_defs[op];
-@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
+ #ifdef CONFIG_TCG_INTERPRETER
-     const TCGArgConstraint *arg_ct = &def->args_ct[k];
+ #include <ffi.h>
      int n;
 -    if (arg_ct->ct & TCG_CT_ALIAS) {
 +    if (arg_ct->oalias) {
          /* an alias is equivalent to a single register */
          n = 1;
      } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
              /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].regs = 0;
 -            def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
                  case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                          tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                          tcg_debug_assert(oarg < def->nb_oargs);
                          tcg_debug_assert(def->args_ct[oarg].regs != 0);
 -                        /* TCG_CT_ALIAS is for the output arguments.
 -                           The input is tagged with TCG_CT_IALIAS. */
                          def->args_ct[i] = def->args_ct[oarg];
 -                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
 +                        /* The output sets oalias.  */
 +                        def->args_ct[oarg].oalias = true;
                          def->args_ct[oarg].alias_index = i;
 -                        def->args_ct[i].ct |= TCG_CT_IALIAS;
 +                        /* The input sets ialias. */
 +                        def->args_ct[i].ialias = true;
                          def->args_ct[i].alias_index = oarg;
                      }
                      ct_str++;
                      break;
                  case '&':
 -                    def->args_ct[i].ct |= TCG_CT_NEWREG;
 +                    def->args_ct[i].newreg = true;
                      ct_str++;
                      break;
                  case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      set = *pset;
                      set &= ct->regs;
 -                    if (ct->ct & TCG_CT_IALIAS) {
 +                    if (ct->ialias) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          }
          i_preferred_regs = o_preferred_regs = 0;
 -        if (arg_ct->ct & TCG_CT_IALIAS) {
 +        if (arg_ct->ialias) {
              o_preferred_regs = op->output_pref[arg_ct->alias_index];
              if (ts->fixed_reg) {
                  /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
                          i2 = def->args_ct[nb_oargs + k2].sort_index;
 -                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
 -                            reg == new_args[i2]) {
 +                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                              goto allocate_in_reg;
                          }
                      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              /* ENV should not be modified.  */
              tcg_debug_assert(!ts->fixed_reg);
 -            if ((arg_ct->ct & TCG_CT_ALIAS)
 -                && !const_args[arg_ct->alias_index]) {
 +            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
 -            } else if (arg_ct->ct & TCG_CT_NEWREG) {
 +            } else if (arg_ct->newreg) {
                  reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
 --
 .25.1

-New patch
+[PULL 23/30] accel/tcg: Split out g2h_tlbe
+Create a new function to combine a CPUTLBEntry addend
+with the guest address to form a host address.
+Reviewed-by: WANG Xuerui <git@xen0n.name>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cputlb.c | 24 ++++++++++++++----------
+file changed, 14 insertions(+), 10 deletions(-)
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@ static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
+     return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
+ }
++static inline uintptr_t g2h_tlbe(const CPUTLBEntry *tlb, target_ulong gaddr)
++{
++    return tlb->addend + (uintptr_t)gaddr;
++}
++
+ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
+                              size_t max_entries)
+ {
+@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
+     if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
+                  TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
+-        addr &= TARGET_PAGE_MASK;
+-        addr += tlb_entry->addend;
++        addr = g2h_tlbe(tlb_entry, addr & TARGET_PAGE_MASK);
+         if ((addr - start) < length) {
+ #if TCG_OVERSIZED_GUEST
+             tlb_entry->addr_write |= TLB_NOTDIRTY;
+@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+         return -1;
+     }
+-    p = (void *)((uintptr_t)addr + entry->addend);
++    p = (void *)g2h_tlbe(entry, addr);
+     if (hostp) {
+         *hostp = p;
+     }
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
+     }
+     /* Everything else is RAM. */
+-    *phost = (void *)((uintptr_t)addr + entry->addend);
++    *phost = (void *)g2h_tlbe(entry, addr);
+     return flags;
+ }
+@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
+             data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+         } else {
+             data->is_io = false;
+-            data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
++            data->v.ram.hostaddr = (void *)g2h_tlbe(tlbe, addr);
+         }
+         return true;
+     } else {
+@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
+         goto stop_the_world;
+     }
+-    hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
++    hostaddr = (void *)g2h_tlbe(tlbe, addr);
+     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
+         notdirty_write(env_cpu(env), addr, size,
+@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+                             access_type, op ^ (need_swap * MO_BSWAP));
+         }
+-        haddr = (void *)((uintptr_t)addr + entry->addend);
++        haddr = (void *)g2h_tlbe(entry, addr);
+         /*
+          * Keep these two load_memop separate to ensure that the compiler
+@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+         return res & MAKE_64BIT_MASK(0, size * 8);
+     }
+-    haddr = (void *)((uintptr_t)addr + entry->addend);
++    haddr = (void *)g2h_tlbe(entry, addr);
+     return load_memop(haddr, op);
+ }
+@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+             notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
+         }
+-        haddr = (void *)((uintptr_t)addr + entry->addend);
++        haddr = (void *)g2h_tlbe(entry, addr);
+         /*
+          * Keep these two store_memop separate to ensure that the compiler
+@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
+         return;
+     }
+-    haddr = (void *)((uintptr_t)addr + entry->addend);
++    haddr = (void *)g2h_tlbe(entry, addr);
+     store_memop(haddr, val, op);
+ }
+--
+.25.1

-New patch
+[PULL 24/30] accel/tcg: Support TCG_TARGET_SIGNED_ADDR32 for softmmu
+When TCG_TARGET_SIGNED_ADDR32 is set, adjust the tlb addend to
+allow the 32-bit guest address to be sign extended within the
+-bit host register instead of zero extended.
+This will simplify tcg hosts like MIPS, RISC-V, and LoongArch,
+which naturally sign-extend 32-bit values, in contrast to x86_64
+and AArch64 which zero-extend them.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ accel/tcg/cputlb.c | 12 +++++++++++-
+file changed, 11 insertions(+), 1 deletion(-)
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/plugin-memory.h"
+ #endif
+ #include "tcg/tcg-ldst.h"
++#include "tcg-target-sa32.h"
+ /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
+ /* #define DEBUG_TLB */
+@@ -XXX,XX +XXX,XX @@ static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
+ static inline uintptr_t g2h_tlbe(const CPUTLBEntry *tlb, target_ulong gaddr)
+ {
++    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
++        return tlb->addend + (int32_t)gaddr;
++    }
+     return tlb->addend + (uintptr_t)gaddr;
+ }
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+     desc->iotlb[index].attrs = attrs;
+     /* Now calculate the new entry */
+-    tn.addend = addend - vaddr_page;
++
++    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
++        tn.addend = addend - (int32_t)vaddr_page;
++    } else {
++        tn.addend = addend - vaddr_page;
++    }
++
+     if (prot & PAGE_READ) {
+         tn.addr_read = address;
+         if (wp_flags & BP_MEM_READ) {
+--
+.25.1

-[PULL 01/11] tcg: Adjust simd_desc size encoding
+[PULL 25/30] accel/tcg: Add guest_base_signed_addr32 for user-only
-With larger vector sizes, it turns out oprsz == maxsz, and we only
+While the host may prefer to treat 32-bit addresses as signed,
-need to represent mismatch for oprsz <= 32.  We do, however, need
+there are edge cases of guests that cannot be implemented with
-to represent larger oprsz and do so without reducing SIMD_DATA_BITS.
+addresses 0x7fff_ffff and 0x8000_0000 being non-consecutive.
-Reduce the size of the oprsz field and increase the maxsz field.
+Therefore, default to guest_base_signed_addr32 false, and allow
-Steal the oprsz value of 24 to indicate equality with maxsz.
+probe_guest_base to determine whether it is possible to set it
 to true.  A tcg backend which sets TCG_TARGET_SIGNED_ADDR32 will
 have to cope with either setting for user-only.
-Tested-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
+ include/exec/cpu-all.h  | 16 ++++++++++++++++
- tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
+ include/exec/cpu_ldst.h |  3 ++-
-files changed, 52 insertions(+), 21 deletions(-)
+ bsd-user/main.c         |  4 ++++
  linux-user/main.c       |  3 +++
 files changed, 25 insertions(+), 1 deletion(-)
-diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
+diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg-gvec-desc.h
+--- a/include/exec/cpu-all.h
-+++ b/include/tcg/tcg-gvec-desc.h
++++ b/include/exec/cpu-all.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline void tswap64s(uint64_t *s)
- #ifndef TCG_TCG_GVEC_DESC_H
- #define TCG_TCG_GVEC_DESC_H
+ #if defined(CONFIG_USER_ONLY)
+ #include "exec/user/abitypes.h"
--/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
++#include "tcg-target-sa32.h"
--#define SIMD_OPRSZ_SHIFT   0
--#define SIMD_OPRSZ_BITS    5
+ /* On some host systems the guest address space is reserved on the host.
-+/*
+  * This allows the guest address space to be offset to a convenient location.
-+ * This configuration allows MAXSZ to represent 2048 bytes, and
+@@ -XXX,XX +XXX,XX @@ extern uintptr_t guest_base;
-+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+ extern bool have_guest_base;
-+ *
+ extern unsigned long reserved_va;
-+ * Encode this with:
-+ *   0, 1, 3 -> 8, 16, 32
++#if TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32
-+ *   2       -> maxsz
++extern bool guest_base_signed_addr32;
-+ *
++#else
-+ * This steals the input that would otherwise map to 24 to match maxsz.
++#define guest_base_signed_addr32  false
-+ */
++#endif
-+#define SIMD_MAXSZ_SHIFT   0
++
-+#define SIMD_MAXSZ_BITS    8
++static inline void set_guest_base_signed_addr32(void)
++{
--#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
++#ifdef guest_base_signed_addr32
--#define SIMD_MAXSZ_BITS    5
++    qemu_build_not_reached();
-+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
++#else
-+#define SIMD_OPRSZ_BITS    2
++    guest_base_signed_addr32 = true;
++#endif
 -#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
 +#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
  #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
  /* Create a descriptor from components.  */
  uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 -/* Extract the operation size from a descriptor.  */
 -static inline intptr_t simd_oprsz(uint32_t desc)
 -{
 -    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
 -}
 -
  /* Extract the max vector size from a descriptor.  */
  static inline intptr_t simd_maxsz(uint32_t desc)
  {
 -    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
 +    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
 +}
 +
-+/* Extract the operation size from a descriptor.  */
+ /*
-+static inline intptr_t simd_oprsz(uint32_t desc)
+  * Limit the guest addresses as best we can.
-+{
+  *
-+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
-+    intptr_t o = f * 8 + 8;
+index XXXXXXX..XXXXXXX 100644
-+    intptr_t m = simd_maxsz(desc);
+--- a/include/exec/cpu_ldst.h
-+    return f == 2 ? m : o;
++++ b/include/exec/cpu_ldst.h
@@ -XXX,XX +XXX,XX @@ static inline abi_ptr cpu_untagged_addr(CPUState *cs, abi_ptr x)
  /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
  static inline void *g2h_untagged(abi_ptr x)
  {
 -    return (void *)((uintptr_t)(x) + guest_base);
 +    uintptr_t hx = guest_base_signed_addr32 ? (int32_t)x : (uintptr_t)x;
 +    return (void *)(guest_base + hx);
  }
- /* Extract the operation-specific data from a descriptor.  */
+ static inline void *g2h(CPUState *cs, abi_ptr x)
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
+diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
+--- a/bsd-user/main.c
-+++ b/tcg/tcg-op-gvec.c
++++ b/bsd-user/main.c
-@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
+@@ -XXX,XX +XXX,XX @@
-    of the operand offsets so that we can check them all at once.  */
+ int singlestep;
- static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
+ uintptr_t guest_base;
- {
+ bool have_guest_base;
--    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
++#ifndef guest_base_signed_addr32
--    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
++bool guest_base_signed_addr32;
--    tcg_debug_assert(oprsz > 0);
++#endif
 -    tcg_debug_assert(oprsz <= maxsz);
 -    tcg_debug_assert((oprsz & opr_align) == 0);
 +    uint32_t max_align;
 +
-+    switch (oprsz) {
+ /*
-+    case 8:
+  * When running 32-on-64 we should make sure we can fit all of the possible
-+    case 16:
+  * guest address space into a contiguous chunk of virtual host memory.
-+    case 32:
+diff --git a/linux-user/main.c b/linux-user/main.c
-+        tcg_debug_assert(oprsz <= maxsz);
+index XXXXXXX..XXXXXXX 100644
-+        break;
+--- a/linux-user/main.c
-+    default:
++++ b/linux-user/main.c
-+        tcg_debug_assert(oprsz == maxsz);
+@@ -XXX,XX +XXX,XX @@ static const char *seed_optarg;
-+        break;
+ unsigned long mmap_min_addr;
-+    }
+ uintptr_t guest_base;
-+    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
+ bool have_guest_base;
-+
++#ifndef guest_base_signed_addr32
-+    max_align = maxsz >= 16 ? 15 : 7;
++bool guest_base_signed_addr32;
-     tcg_debug_assert((maxsz & max_align) == 0);
++#endif
-     tcg_debug_assert((ofs & max_align) == 0);
- }
+ /*
-@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
+  * Used to implement backwards-compatibility for the `-strace`, and
  {
      uint32_t desc = 0;
 -    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
 -    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
 -    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 +    check_size_align(oprsz, maxsz, 0);
 +    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
      oprsz = (oprsz / 8) - 1;
      maxsz = (maxsz / 8) - 1;
 +
 +    /*
 +     * We have just asserted in check_size_align that either
 +     * oprsz is {8,16,32} or matches maxsz.  Encode the final
 +     * case with '2', as that would otherwise map to 24.
 +     */
 +    if (oprsz == maxsz) {
 +        oprsz = 2;
 +    }
 +
      desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
      desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
      desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
 --
 .25.1

-[PULL 03/11] tcg: Move sorted_args into TCGArgConstraint.sort_index
+[PULL 26/30] linux-user: Support TCG_TARGET_SIGNED_ADDR32
-This uses an existing hole in the TCGArgConstraint structure
+When using reserved_va, which is the default for a 64-bit host
-and will be convenient for keeping the data in one place.
+and a 32-bit guest, set guest_base_signed_addr32 if requested
 by TCG_TARGET_SIGNED_ADDR32, and the executable layout allows.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h |  2 +-
+ include/exec/cpu-all.h |  4 ---
- tcg/tcg.c         | 35 +++++++++++++++++------------------
+ linux-user/elfload.c   | 62 ++++++++++++++++++++++++++++++++++--------
-files changed, 18 insertions(+), 19 deletions(-)
+files changed, 50 insertions(+), 16 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/include/exec/cpu-all.h
-+++ b/include/tcg/tcg.h
++++ b/include/exec/cpu-all.h
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+@@ -XXX,XX +XXX,XX @@ extern const TargetPageBits target_page;
- typedef struct TCGArgConstraint {
+ #define PAGE_RESET     0x0040
-     uint16_t ct;
+ /* For linux-user, indicates that the page is MAP_ANON. */
-     uint8_t alias_index;
+ #define PAGE_ANON      0x0080
-+    uint8_t sort_index;
+-
-     TCGRegSet regs;
+-#if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY)
- } TCGArgConstraint;
+-/* FIXME: Code that sets/uses this is broken and needs to go away.  */
+ #define PAGE_RESERVED  0x0100
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
+-#endif
-     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
+ /* Target-specific bits that will be used via page_get_flags().  */
-     uint8_t flags;
+ #define PAGE_TARGET_1  0x0200
-     TCGArgConstraint *args_ct;
+ #define PAGE_TARGET_2  0x0400
--    int *sorted_args;
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
  #if defined(CONFIG_DEBUG_TCG)
      int used;
  #endif
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
+--- a/linux-user/elfload.c
-+++ b/tcg/tcg.c
++++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ static void pgb_dynamic(const char *image_name, long align)
-     int op, total_args, n, i;
+ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
-     TCGOpDef *def;
+                             abi_ulong guest_hiaddr, long align)
-     TCGArgConstraint *args_ct;
+ {
--    int *sorted_args;
+-    int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
-     TCGTemp *ts;
++    int flags = (MAP_ANONYMOUS | MAP_PRIVATE |
++                 MAP_NORESERVE | MAP_FIXED_NOREPLACE);
-     memset(s, 0, sizeof(*s));
++    unsigned long local_rva = reserved_va;
-@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
++    bool protect_wrap = false;
      void *addr, *test;
 -    if (guest_hiaddr > reserved_va) {
 +    if (guest_hiaddr > local_rva) {
          error_report("%s: requires more than reserved virtual "
                       "address space (0x%" PRIx64 " > 0x%lx)",
 -                     image_name, (uint64_t)guest_hiaddr, reserved_va);
 +                     image_name, (uint64_t)guest_hiaddr, local_rva);
          exit(EXIT_FAILURE);
      }
-     args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+-    /* Widen the "image" to the entire reserved address space. */
--    sorted_args = g_malloc(sizeof(int) * total_args);
+-    pgb_static(image_name, 0, reserved_va, align);
++    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
-     for(op = 0; op < NB_OPS; op++) {
++        if (guest_loaddr < 0x80000000u && guest_hiaddr > 0x80000000u) {
-         def = &tcg_op_defs[op];
++            /*
-         def->args_ct = args_ct;
++             * The executable itself wraps on signed addresses.
--        def->sorted_args = sorted_args;
++             * Without per-page translation, we must keep the
-         n = def->nb_iargs + def->nb_oargs;
++             * guest address 0x7fff_ffff adjacent to 0x8000_0000
--        sorted_args += n;
++             * consecutive in host memory: unsigned addresses.
-         args_ct += n;
++             */
 +        } else {
 +            set_guest_base_signed_addr32();
 +            if (local_rva <= 0x80000000u) {
 +                /* No guest addresses are "negative": win! */
 +            } else {
 +                /* Begin by allocating the entire address space. */
 +                local_rva = 0xfffffffful + 1;
 +                protect_wrap = true;
 +            }
 +        }
 +    }
 -    /* osdep.h defines this as 0 if it's missing */
 -    flags |= MAP_FIXED_NOREPLACE;
 +    /* Widen the "image" to the entire reserved address space. */
 +    pgb_static(image_name, 0, local_rva, align);
 +    assert(guest_base != 0);
      /* Reserve the memory on the host. */
 -    assert(guest_base != 0);
      test = g2h_untagged(0);
 -    addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
 +    addr = mmap(test, local_rva, PROT_NONE, flags, -1, 0);
      if (addr == MAP_FAILED || addr != test) {
 +        /*
 +         * If protect_wrap, we could try again with the original reserved_va
 +         * setting, but the edge case of low ulimit vm setting on a 64-bit
 +         * host is probably useless.
 +         */
          error_report("Unable to reserve 0x%lx bytes of virtual address "
 -                     "space at %p (%s) for use as guest address space (check your"
 -                     "virtual memory ulimit setting, min_mmap_addr or reserve less "
 -                     "using -R option)", reserved_va, test, strerror(errno));
 +                     "space at %p (%s) for use as guest address space "
 +                     "(check your virtual memory ulimit setting, "
 +                     "min_mmap_addr or reserve less using -R option)",
 +                     local_rva, test, strerror(errno));
          exit(EXIT_FAILURE);
      }
-@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
++    if (protect_wrap) {
- /* sort from highest priority to lowest */
++        /*
- static void sort_constraints(TCGOpDef *def, int start, int n)
++         * Prevent the page just before 0x80000000 from being allocated.
- {
++         * This prevents a single guest object/allocation from crossing
--    int i, j, p1, p2, tmp;
++         * the signed wrap, and thus being discontiguous in host memory.
-+    int i, j;
++         */
-+    TCGArgConstraint *a = def->args_ct;
++        page_set_flags(0x7fffffff & TARGET_PAGE_MASK, 0x80000000u,
++                       PAGE_RESERVED);
--    for(i = 0; i < n; i++)
++        /* Adjust guest_base so that 0 is in the middle of the reservation. */
--        def->sorted_args[start + i] = start + i;
++        guest_base += 0x80000000ul;
 -    if (n <= 1)
 +    for (i = 0; i < n; i++) {
 +        a[start + i].sort_index = start + i;
 +    }
-+    if (n <= 1) {
++
-         return;
+     qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %p for %lu bytes\n",
--    for(i = 0; i < n - 1; i++) {
+                   __func__, addr, reserved_va);
--        for(j = i + 1; j < n; j++) {
+ }
 -            p1 = get_constraint_priority(def, def->sorted_args[start + i]);
 -            p2 = get_constraint_priority(def, def->sorted_args[start + j]);
 +    }
 +    for (i = 0; i < n - 1; i++) {
 +        for (j = i + 1; j < n; j++) {
 +            int p1 = get_constraint_priority(def, a[start + i].sort_index);
 +            int p2 = get_constraint_priority(def, a[start + j].sort_index);
              if (p1 < p2) {
 -                tmp = def->sorted_args[start + i];
 -                def->sorted_args[start + i] = def->sorted_args[start + j];
 -                def->sorted_args[start + j] = tmp;
 +                int tmp = a[start + i].sort_index;
 +                a[start + i].sort_index = a[start + j].sort_index;
 +                a[start + j].sort_index = tmp;
              }
          }
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
      for (k = 0; k < nb_iargs; k++) {
          TCGRegSet i_preferred_regs, o_preferred_regs;
 -        i = def->sorted_args[nb_oargs + k];
 +        i = def->args_ct[nb_oargs + k].sort_index;
          arg = op->args[i];
          arg_ct = &def->args_ct[i];
          ts = arg_temp(arg);
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      int k2, i2;
                      reg = ts->reg;
                      for (k2 = 0 ; k2 < k ; k2++) {
 -                        i2 = def->sorted_args[nb_oargs + k2];
 +                        i2 = def->args_ct[nb_oargs + k2].sort_index;
                          if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
                              reg == new_args[i2]) {
                              goto allocate_in_reg;
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
          /* satisfy the output constraints */
          for(k = 0; k < nb_oargs; k++) {
 -            i = def->sorted_args[k];
 +            i = def->args_ct[k].sort_index;
              arg = op->args[i];
              arg_ct = &def->args_ct[i];
              ts = arg_temp(arg);
 --
 .25.1

-New patch
+[PULL 27/30] tcg/aarch64: Support TCG_TARGET_SIGNED_ADDR32
+AArch64 has both sign and zero-extending addressing modes, which
+means that either treatment of guest addresses is equally efficient.
+Enabling this for AArch64 gives us testing of the feature in CI.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ tcg/aarch64/tcg-target-sa32.h |  8 +++-
+ tcg/aarch64/tcg-target.c.inc  | 81 ++++++++++++++++++++++++-----------
+files changed, 64 insertions(+), 25 deletions(-)
+diff --git a/tcg/aarch64/tcg-target-sa32.h b/tcg/aarch64/tcg-target-sa32.h
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target-sa32.h
++++ b/tcg/aarch64/tcg-target-sa32.h
+@@ -1 +1,7 @@
+-#define TCG_TARGET_SIGNED_ADDR32 0
++/*
++ * AArch64 has both SXTW and UXTW addressing modes, which means that
++ * it is agnostic to how guest addresses should be represented.
++ * Because aarch64 is more common than the other hosts that will
++ * want to use this feature, enable it for continuous testing.
++ */
++#define TCG_TARGET_SIGNED_ADDR32 1
+diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/tcg/aarch64/tcg-target.c.inc
++++ b/tcg/aarch64/tcg-target.c.inc
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     LDST_LD_S_W = 3,  /* load and sign-extend into Wt */
+ } AArch64LdstType;
++/*
++ * See aarch64/instrs/extendreg/DecodeRegExtend
++ * But note that option<1> == 0 is UNDEFINED for LDR/STR.
++ */
++typedef enum {
++    LDST_EXT_UXTW = 2,  /* zero-extend from uint32_t */
++    LDST_EXT_UXTX = 3,  /* zero-extend from uint64_t (i.e. no extension) */
++    LDST_EXT_SXTW = 6,  /* sign-extend from int32_t */
++} AArch64LdstExt;
++
+ /* We encode the format of the insn into the beginning of the name, so that
+    we can have the preprocessor help "typecheck" the insn vs the output
+    function.  Arm didn't provide us with nice names for the formats, so we
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_insn_3617(TCGContext *s, AArch64Insn insn, bool q,
+ }
+ static void tcg_out_insn_3310(TCGContext *s, AArch64Insn insn,
+-                              TCGReg rd, TCGReg base, TCGType ext,
++                              TCGReg rd, TCGReg base, AArch64LdstExt option,
+                               TCGReg regoff)
+ {
+     /* Note the AArch64Insn constants above are for C3.3.12.  Adjust.  */
+     tcg_out32(s, insn | I3312_TO_I3310 | regoff << 16 |
+-              0x4000 | ext << 13 | base << 5 | (rd & 0x1f));
++              option << 13 | base << 5 | (rd & 0x1f));
+ }
+ static void tcg_out_insn_3312(TCGContext *s, AArch64Insn insn,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, AArch64Insn insn, TCGReg rd,
+     /* Worst-case scenario, move offset to temp register, use reg offset.  */
+     tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, offset);
+-    tcg_out_ldst_r(s, insn, rd, rn, TCG_TYPE_I64, TCG_REG_TMP);
++    tcg_out_ldst_r(s, insn, rd, rn, LDST_EXT_UXTX, TCG_REG_TMP);
+ }
+ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
+@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
+ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
+                                    TCGReg data_r, TCGReg addr_r,
+-                                   TCGType otype, TCGReg off_r)
++                                   AArch64LdstExt option, TCGReg off_r)
+ {
+     switch (memop & MO_SSIZE) {
+     case MO_UB:
+-        tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, option, off_r);
+         break;
+     case MO_SB:
+         tcg_out_ldst_r(s, ext ? I3312_LDRSBX : I3312_LDRSBW,
+-                       data_r, addr_r, otype, off_r);
++                       data_r, addr_r, option, off_r);
+         break;
+     case MO_UW:
+-        tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, option, off_r);
+         break;
+     case MO_SW:
+         tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
+-                       data_r, addr_r, otype, off_r);
++                       data_r, addr_r, option, off_r);
+         break;
+     case MO_UL:
+-        tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, option, off_r);
+         break;
+     case MO_SL:
+-        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, option, off_r);
+         break;
+     case MO_UQ:
+-        tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, option, off_r);
+         break;
+     default:
+         tcg_abort();
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
+ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
+                                    TCGReg data_r, TCGReg addr_r,
+-                                   TCGType otype, TCGReg off_r)
++                                   AArch64LdstExt option, TCGReg off_r)
+ {
+     switch (memop & MO_SIZE) {
+     case MO_8:
+-        tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, option, off_r);
+         break;
+     case MO_16:
+-        tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, option, off_r);
+         break;
+     case MO_32:
+-        tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, option, off_r);
+         break;
+     case MO_64:
+-        tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
++        tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, option, off_r);
+         break;
+     default:
+         tcg_abort();
+     }
+ }
++/*
++ * Bits for the option field of LDR/STR (register),
++ * for application to a guest address.
++ */
++static AArch64LdstExt ldst_ext_option(void)
++{
++#ifdef CONFIG_USER_ONLY
++    bool signed_addr32 = guest_base_signed_addr32;
++#else
++    bool signed_addr32 = TCG_TARGET_SIGNED_ADDR32;
++#endif
++
++    if (TARGET_LONG_BITS == 64) {
++        return LDST_EXT_UXTX;
++    } else if (signed_addr32) {
++        return LDST_EXT_SXTW;
++    } else {
++        return LDST_EXT_UXTW;
++    }
++}
++
+ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+                             MemOpIdx oi, TCGType ext)
+ {
+     MemOp memop = get_memop(oi);
+-    const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
++    AArch64LdstExt option = ldst_ext_option();
+     /* Byte swapping is left to middle-end expansion. */
+     tcg_debug_assert((memop & MO_BSWAP) == 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+     tcg_out_tlb_read(s, addr_reg, memop, &label_ptr, mem_index, 1);
+     tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
+-                           TCG_REG_X1, otype, addr_reg);
++                           TCG_REG_X1, option, addr_reg);
+     add_qemu_ldst_label(s, true, oi, ext, data_reg, addr_reg,
+                         s->code_ptr, label_ptr);
+ #else /* !CONFIG_SOFTMMU */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+     }
+     if (USE_GUEST_BASE) {
+         tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
+-                               TCG_REG_GUEST_BASE, otype, addr_reg);
++                               TCG_REG_GUEST_BASE, option, addr_reg);
+     } else {
++        /* This case is always a 64-bit guest with no extension. */
+         tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
+-                               addr_reg, TCG_TYPE_I64, TCG_REG_XZR);
++                               addr_reg, LDST_EXT_UXTX, TCG_REG_XZR);
+     }
+ #endif /* CONFIG_SOFTMMU */
+ }
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+                             MemOpIdx oi)
+ {
+     MemOp memop = get_memop(oi);
+-    const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
++    AArch64LdstExt option = ldst_ext_option();
+     /* Byte swapping is left to middle-end expansion. */
+     tcg_debug_assert((memop & MO_BSWAP) == 0);
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+     tcg_out_tlb_read(s, addr_reg, memop, &label_ptr, mem_index, 0);
+     tcg_out_qemu_st_direct(s, memop, data_reg,
+-                           TCG_REG_X1, otype, addr_reg);
++                           TCG_REG_X1, option, addr_reg);
+     add_qemu_ldst_label(s, false, oi, (memop & MO_SIZE)== MO_64,
+                         data_reg, addr_reg, s->code_ptr, label_ptr);
+ #else /* !CONFIG_SOFTMMU */
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
+     }
+     if (USE_GUEST_BASE) {
+         tcg_out_qemu_st_direct(s, memop, data_reg,
+-                               TCG_REG_GUEST_BASE, otype, addr_reg);
++                               TCG_REG_GUEST_BASE, option, addr_reg);
+     } else {
++        /* This case is always a 64-bit guest with no extension. */
+         tcg_out_qemu_st_direct(s, memop, data_reg,
+-                               addr_reg, TCG_TYPE_I64, TCG_REG_XZR);
++                               addr_reg, LDST_EXT_UXTX, TCG_REG_XZR);
+     }
+ #endif /* CONFIG_SOFTMMU */
+ }
+--
+.25.1

-[PULL 02/11] tcg: Drop union from TCGArgConstraint
+[PULL 28/30] tcg/mips: Support TCG_TARGET_SIGNED_ADDR32
-The union is unused; let "regs" appear in the main structure
+All 32-bit mips operations sign-extend the output, so we are easily
-without the "u.regs" wrapping.
+able to keep TCG_TYPE_I32 values sign-extended in host registers.
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h            |  4 +---
+ tcg/mips/tcg-target-sa32.h |  8 ++++++++
- tcg/tcg.c                    | 22 +++++++++++-----------
+ tcg/mips/tcg-target.c.inc  | 10 ++--------
- tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
+files changed, 10 insertions(+), 8 deletions(-)
  tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
  tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
  tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
  tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
  tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
  tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
  tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
  tcg/tci/tcg-target.c.inc     |  2 +-
 files changed, 91 insertions(+), 93 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/tcg/mips/tcg-target-sa32.h b/tcg/mips/tcg-target-sa32.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/tcg/mips/tcg-target-sa32.h
-+++ b/include/tcg/tcg.h
++++ b/tcg/mips/tcg-target-sa32.h
-@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
+@@ -1 +1,9 @@
- typedef struct TCGArgConstraint {
++/*
-     uint16_t ct;
++ * Do not set TCG_TARGET_SIGNED_ADDR32 for mips32;
-     uint8_t alias_index;
++ * TCG expects this to only be set for 64-bit hosts.
--    union {
++ */
--        TCGRegSet regs;
++#ifdef __mips64
--    } u;
++#define TCG_TARGET_SIGNED_ADDR32 1
-+    TCGRegSet regs;
++#else
- } TCGArgConstraint;
+ #define TCG_TARGET_SIGNED_ADDR32 0
++#endif
  #define TCG_MAX_OP_ARGS 16
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
              return 0;
          n = 0;
          for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
 -            if (tcg_regset_test_reg(arg_ct->u.regs, i))
 +            if (tcg_regset_test_reg(arg_ct->regs, i))
                  n++;
          }
      }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
              /* Incomplete TCGTargetOpDef entry. */
              tcg_debug_assert(ct_str != NULL);
 -            def->args_ct[i].u.regs = 0;
 +            def->args_ct[i].regs = 0;
              def->args_ct[i].ct = 0;
              while (*ct_str != '\0') {
                  switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                      pset = la_temp_pref(ts);
                      set = *pset;
 -                    set &= ct->u.regs;
 +                    set &= ct->regs;
                      if (ct->ct & TCG_CT_IALIAS) {
                          set &= op->output_pref[ct->alias_index];
                      }
                      /* If the combination is not possible, restart.  */
                      if (set == 0) {
 -                        set = ct->u.regs;
 +                        set = ct->regs;
                      }
                      *pset = set;
                  }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
          return;
      }
 -    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
 -    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
 +    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
 +    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
      /* Allocate the output register now.  */
      if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
              }
          }
 -        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
 +        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
          reg = ts->reg;
 -        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
 +        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
              /* nothing to do : the constraint is satisfied */
          } else {
          allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 and move the temporary register into it */
              temp_load(s, ts, tcg_target_available_regs[ts->type],
                        i_allocated_regs, 0);
 -            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
 +            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                  o_preferred_regs, ts->indirect_base);
              if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                  /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                  && !const_args[arg_ct->alias_index]) {
                  reg = new_args[arg_ct->alias_index];
              } else if (arg_ct->ct & TCG_CT_NEWREG) {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs,
                                      i_allocated_regs | o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              } else {
 -                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
 +                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                      op->output_pref[k], ts->indirect_base);
              }
              tcg_regset_set_reg(o_allocated_regs, reg);
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r': /* general registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffffu;
 +        ct->regs |= 0xffffffffu;
          break;
      case 'w': /* advsimd registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= 0xffffffff00000000ull;
 +        ct->regs |= 0xffffffff00000000ull;
          break;
      case 'l': /* qemu_ld / qemu_st address, data_reg */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffffu;
 +        ct->regs = 0xffffffffu;
  #ifdef CONFIG_SOFTMMU
          /* x0 and x1 will be overwritten when reading the tlb entry,
             and x2, and x3 for helper args, better to avoid using them. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
  #endif
          break;
      case 'A': /* Valid for arithmetic immediate (positive or negative).  */
 diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/arm/tcg-target.c.inc
 +++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      /* qemu_ld address */
      case 'l':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
  #ifdef CONFIG_SOFTMMU
          /* r0-r2,lr will be overwritten when reading the tlb entry,
             so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
      /* qemu_st address & data */
      case 's':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
             and r0-r1 doing the byte swapping, so don't use these. */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
  #if defined(CONFIG_SOFTMMU)
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
  #if TARGET_LONG_BITS == 64
          /* Avoid clashes with registers being used for helper args */
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #endif
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
  #endif
          break;
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch(*ct_str++) {
      case 'a':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
          break;
      case 'b':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
          break;
      case 'c':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
          break;
      case 'd':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
          break;
      case 'S':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
          break;
      case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
 +        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
          break;
      case 'q':
          /* A register that can be used as a byte operand.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
          break;
      case 'Q':
          /* A register with an addressable second byte (e.g. %ah).  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xf;
 +        ct->regs = 0xf;
          break;
      case 'r':
          /* A general register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_GENERAL_REGS;
 +        ct->regs |= ALL_GENERAL_REGS;
          break;
      case 'W':
          /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'x':
          /* A vector register.  */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs |= ALL_VECTOR_REGS;
 +        ct->regs |= ALL_VECTOR_REGS;
          break;
          /* qemu_ld/st address constraint */
      case 'L':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
 +        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
          break;
      case 'e':
 diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/mips/tcg-target.c.inc
 +++ b/tcg/mips/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
-     switch(*ct_str++) {
+                      TCG_TMP0, TCG_TMP3, cmp_off);
-     case 'r':
+     }
-         ct->ct |= TCG_CT_REG;
--        ct->u.regs = 0xffffffff;
+-    /* Zero extend a 32-bit guest address for a 64-bit host. */
-+        ct->regs = 0xffffffff;
+-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-         break;
+-        tcg_out_ext32u(s, base, addrl);
-     case 'L': /* qemu_ld input arg constraint */
+-        addrl = base;
-         ct->ct |= TCG_CT_REG;
+-    }
--        ct->u.regs = 0xffffffff;
+-
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+     /*
-+        ct->regs = 0xffffffff;
+      * Mask the page bits, keeping the alignment bits to compare against.
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
+      * For unaligned accesses, compare against the end of the access to
- #if defined(CONFIG_SOFTMMU)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
-         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
+                         data_regl, data_regh, addr_regl, addr_regh,
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+                         s->code_ptr, label_ptr);
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+ #else
-         }
+-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
- #endif
++    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
-         break;
+         tcg_out_ext32u(s, base, addr_regl);
-     case 'S': /* qemu_st constraint */
+         addr_regl = base;
-         ct->ct |= TCG_CT_REG;
+     }
--        ct->u.regs = 0xffffffff;
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
--        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+                         data_regl, data_regh, addr_regl, addr_regh,
-+        ct->regs = 0xffffffff;
+                         s->code_ptr, label_ptr);
-+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
+ #else
- #if defined(CONFIG_SOFTMMU)
+-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
++    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+         tcg_out_ext32u(s, base, addr_regl);
--            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+         addr_regl = base;
-+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+     }
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
          } else {
 -            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
 +            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
          }
  #endif
          break;
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'A': case 'B': case 'C': case 'D':
          ct->ct |= TCG_CT_REG;
 -        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
 +        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
          break;
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'v':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff00000000ull;
 +        ct->regs = 0xffffffff00000000ull;
          break;
      case 'L':                   /* qemu_ld constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
  #endif
          break;
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0xffffffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
  #ifdef CONFIG_SOFTMMU
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
  #endif
          break;
      case 'I':
 diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/riscv/tcg-target.c.inc
 +++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'L':
          /* qemu_ld/qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
  #if defined(CONFIG_SOFTMMU)
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
 -        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
 +        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
  #endif
          break;
      case 'I':
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':                  /* all registers */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 +        ct->regs = 0xffff;
          break;
      case 'L':                  /* qemu_ld/st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffff;
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
 +        ct->regs = 0xffff;
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
          break;
      case 'a':                  /* force R2 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
          break;
      case 'b':                  /* force R3 for division */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0;
 -        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
 +        ct->regs = 0;
 +        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
          break;
      case 'A':
          ct->ct |= TCG_CT_CONST_S33;
 diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/sparc/tcg-target.c.inc
 +++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      switch (*ct_str++) {
      case 'r':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          break;
      case 'R':
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          break;
      case 'A': /* qemu_ld/st address constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
 +        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
      reserve_helpers:
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
 -        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
 +        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
          break;
      case 's': /* qemu_st data 32-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = 0xffffffff;
 +        ct->regs = 0xffffffff;
          goto reserve_helpers;
      case 'S': /* qemu_st data 64-bit constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = ALL_64;
 +        ct->regs = ALL_64;
          goto reserve_helpers;
      case 'I':
          ct->ct |= TCG_CT_CONST_S11;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
      case 'L':                   /* qemu_ld constraint */
      case 'S':                   /* qemu_st constraint */
          ct->ct |= TCG_CT_REG;
 -        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
 +        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
          break;
      default:
          return NULL;
 --
 .25.1

-[PULL 08/11] tcg: Fix generation of dupi_vec for 32-bit host
+[PULL 29/30] tcg/riscv: Support TCG_TARGET_SIGNED_ADDR32
-The definition of INDEX_op_dupi_vec is that it operates on
+All RV64 32-bit operations sign-extend the output, so we are easily
-units of tcg_target_ulong -- in this case 32 bits.  It does
+able to keep TCG_TYPE_I32 values sign-extended in host registers.
 not work to use this for a uint64_t value that happens to be
 small enough to fit in tcg_target_ulong.
-Fixes: d2fd745fe8b
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Fixes: db432672dc5
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tcg-op-vec.c | 12 ++++++++----
+ tcg/riscv/tcg-target-sa32.h | 6 +++++-
-file changed, 8 insertions(+), 4 deletions(-)
+ tcg/riscv/tcg-target.c.inc  | 8 ++------
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
+diff --git a/tcg/riscv/tcg-target-sa32.h b/tcg/riscv/tcg-target-sa32.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-vec.c
+--- a/tcg/riscv/tcg-target-sa32.h
-+++ b/tcg/tcg-op-vec.c
++++ b/tcg/riscv/tcg-target-sa32.h
-@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
+@@ -1 +1,5 @@
+-#define TCG_TARGET_SIGNED_ADDR32 0
- void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
++/*
- {
++ * Do not set TCG_TARGET_SIGNED_ADDR32 for RV32;
--    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
++ * TCG expects this to only be set for 64-bit hosts.
--        do_dupi_vec(r, MO_32, a);
++ */
--    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
++#define TCG_TARGET_SIGNED_ADDR32  (__riscv_xlen == 64)
-+    if (TCG_TARGET_REG_BITS == 64) {
+diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
-         do_dupi_vec(r, MO_64, a);
+index XXXXXXX..XXXXXXX 100644
-+    } else if (a == dup_const(MO_32, a)) {
+--- a/tcg/riscv/tcg-target.c.inc
-+        do_dupi_vec(r, MO_32, a);
++++ b/tcg/riscv/tcg-target.c.inc
-     } else {
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
-         TCGv_i64 c = tcg_const_i64(a);
+     tcg_out_opc_branch(s, OPC_BNE, TCG_REG_TMP0, TCG_REG_TMP1, 0);
-         tcg_gen_dup_i64_vec(MO_64, r, c);
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
+     /* TLB Hit - translate address using addend.  */
+-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
- void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
+-        tcg_out_ext32u(s, TCG_REG_TMP0, addrl);
- {
+-        addrl = TCG_REG_TMP0;
--    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+-    }
-+    if (vece == MO_64) {
+     tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_REG_TMP2, addrl);
 +        tcg_gen_dup64i_vec(r, a);
 +    } else {
 +        do_dupi_vec(r, MO_REG, dup_const(vece, a));
 +    }
  }
- void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
                          data_regl, data_regh, addr_regl, addr_regh,
                          s->code_ptr, label_ptr);
  #else
 -    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
 +    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
          tcg_out_ext32u(s, base, addr_regl);
          addr_regl = base;
      }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
                          data_regl, data_regh, addr_regl, addr_regh,
                          s->code_ptr, label_ptr);
  #else
 -    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
 +    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
          tcg_out_ext32u(s, base, addr_regl);
          addr_regl = base;
      }
 --
 .25.1

-[PULL 06/11] tcg: Remove TCGOpDef.used
+[PULL 30/30] tcg/loongarch64: Support TCG_TARGET_SIGNED_ADDR32
-The last user of this field disappeared in f69d277ece4.
+All 32-bit LoongArch operations sign-extend the output, so we are easily
 able to keep TCG_TYPE_I32 values sign-extended in host registers.
+Cc: WANG Xuerui <git@xen0n.name>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/tcg/tcg.h | 3 ---
+ tcg/loongarch64/tcg-target-sa32.h |  2 +-
-file changed, 3 deletions(-)
+ tcg/loongarch64/tcg-target.c.inc  | 15 ++++++---------
 files changed, 7 insertions(+), 10 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
+diff --git a/tcg/loongarch64/tcg-target-sa32.h b/tcg/loongarch64/tcg-target-sa32.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
+--- a/tcg/loongarch64/tcg-target-sa32.h
-+++ b/include/tcg/tcg.h
++++ b/tcg/loongarch64/tcg-target-sa32.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGOpDef {
+@@ -1 +1 @@
-     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
+-#define TCG_TARGET_SIGNED_ADDR32 0
-     uint8_t flags;
++#define TCG_TARGET_SIGNED_ADDR32 1
-     TCGArgConstraint *args_ct;
+diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
--#if defined(CONFIG_DEBUG_TCG)
+index XXXXXXX..XXXXXXX 100644
--    int used;
+--- a/tcg/loongarch64/tcg-target.c.inc
 +++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
      return tcg_out_fail_alignment(s, l);
  }
 -#endif /* CONFIG_SOFTMMU */
 -
  /*
   * `ext32u` the address register into the temp register given,
   * if target is 32-bit, no-op otherwise.
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
  static TCGReg tcg_out_zext_addr_if_32_bit(TCGContext *s,
                                            TCGReg addr, TCGReg tmp)
  {
 -    if (TARGET_LONG_BITS == 32) {
 +    if (TARGET_LONG_BITS == 32 && !guest_base_signed_addr32) {
          tcg_out_ext32u(s, tmp, addr);
          return tmp;
      }
      return addr;
  }
 +#endif /* CONFIG_SOFTMMU */
  static void tcg_out_qemu_ld_indexed(TCGContext *s, TCGReg rd, TCGReg rj,
                                     TCGReg rk, MemOp opc, TCGType type)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
      tcg_insn_unit *label_ptr[1];
  #else
      unsigned a_bits;
 -#endif
- } TCGOpDef;
+     TCGReg base;
++#endif
- extern TCGOpDef tcg_op_defs[];
      data_regl = *args++;
      addr_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
  #if defined(CONFIG_SOFTMMU)
      tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 1);
 -    base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
 -    tcg_out_qemu_ld_indexed(s, data_regl, base, TCG_REG_TMP2, opc, type);
 +    tcg_out_qemu_ld_indexed(s, data_regl, addr_regl, TCG_REG_TMP2, opc, type);
      add_qemu_ldst_label(s, 1, oi, type,
                          data_regl, addr_regl,
                          s->code_ptr, label_ptr);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
      tcg_insn_unit *label_ptr[1];
  #else
      unsigned a_bits;
 -#endif
      TCGReg base;
 +#endif
      data_regl = *args++;
      addr_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
  #if defined(CONFIG_SOFTMMU)
      tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 0);
 -    base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
 -    tcg_out_qemu_st_indexed(s, data_regl, base, TCG_REG_TMP2, opc);
 +    tcg_out_qemu_st_indexed(s, data_regl, addr_regl, TCG_REG_TMP2, opc);
      add_qemu_ldst_label(s, 0, oi,
 , /* type param is unused for stores */
                          data_regl, addr_regl,
 --
 .25.1

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://github.com/rth7680/qemu.git tags/pull-tcg-20201008

for you to fetch changes up to 62475e9d007d83db4d0a6ccebcda8914f392e9c9:

accel/tcg: Fix computing of is_write for MIPS (2020-10-08 05:57:32 -0500)

----------------------------------------------------------------
Extend maximum gvec vector size
Fix i386 avx2 dupi
Fix mips host user-only write detection
Misc cleanups.

----------------------------------------------------------------
Kele Huang (1):
      accel/tcg: Fix computing of is_write for MIPS

Richard Henderson (10):
      tcg: Adjust simd_desc size encoding
      tcg: Drop union from TCGArgConstraint
      tcg: Move sorted_args into TCGArgConstraint.sort_index
      tcg: Remove TCG_CT_REG
      tcg: Move some TCG_CT_* bits to TCGArgConstraint bitfields
      tcg: Remove TCGOpDef.used
      tcg/i386: Fix dupi for avx2 32-bit hosts
      tcg: Fix generation of dupi_vec for 32-bit host
      tcg/optimize: Fold dup2_vec
      tcg: Remove TCG_TARGET_HAS_cmp_vec

With larger vector sizes, it turns out oprsz == maxsz, and we only
need to represent mismatch for oprsz <= 32.  We do, however, need
to represent larger oprsz and do so without reducing SIMD_DATA_BITS.

Reduce the size of the oprsz field and increase the maxsz field.
Steal the oprsz value of 24 to indicate equality with maxsz.

Tested-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-gvec-desc.h | 38 ++++++++++++++++++++++++-------------
 tcg/tcg-op-gvec.c           | 35 ++++++++++++++++++++++++++--------
 2 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/include/tcg/tcg-gvec-desc.h b/include/tcg/tcg-gvec-desc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-gvec-desc.h
+++ b/include/tcg/tcg-gvec-desc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TCG_TCG_GVEC_DESC_H
 #define TCG_TCG_GVEC_DESC_H
 
-/* ??? These bit widths are set for ARM SVE, maxing out at 256 byte vectors. */
-#define SIMD_OPRSZ_SHIFT   0
-#define SIMD_OPRSZ_BITS    5
+/*
+ * This configuration allows MAXSZ to represent 2048 bytes, and
+ * OPRSZ to match MAXSZ, or represent the smaller values 8, 16, or 32.
+ *
+ * Encode this with:
+ *   0, 1, 3 -> 8, 16, 32
+ *   2       -> maxsz
+ *
+ * This steals the input that would otherwise map to 24 to match maxsz.
+ */
+#define SIMD_MAXSZ_SHIFT   0
+#define SIMD_MAXSZ_BITS    8
 
-#define SIMD_MAXSZ_SHIFT   (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
-#define SIMD_MAXSZ_BITS    5
+#define SIMD_OPRSZ_SHIFT   (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_OPRSZ_BITS    2
 
-#define SIMD_DATA_SHIFT    (SIMD_MAXSZ_SHIFT + SIMD_MAXSZ_BITS)
+#define SIMD_DATA_SHIFT    (SIMD_OPRSZ_SHIFT + SIMD_OPRSZ_BITS)
 #define SIMD_DATA_BITS     (32 - SIMD_DATA_SHIFT)
 
 /* Create a descriptor from components.  */
 uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data);
 
-/* Extract the operation size from a descriptor.  */
-static inline intptr_t simd_oprsz(uint32_t desc)
-{
-    return (extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS) + 1) * 8;
-}
-
 /* Extract the max vector size from a descriptor.  */
 static inline intptr_t simd_maxsz(uint32_t desc)
 {
-    return (extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) + 1) * 8;
+    return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
+}
+
+/* Extract the operation size from a descriptor.  */
+static inline intptr_t simd_oprsz(uint32_t desc)
+{
+    uint32_t f = extract32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS);
+    intptr_t o = f * 8 + 8;
+    intptr_t m = simd_maxsz(desc);
+    return f == 2 ? m : o;
 }
 
 /* Extract the operation-specific data from a descriptor.  */
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ static const TCGOpcode vecop_list_empty[1] = { 0 };
    of the operand offsets so that we can check them all at once.  */
 static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
 {
-    uint32_t opr_align = oprsz >= 16 ? 15 : 7;
-    uint32_t max_align = maxsz >= 16 || oprsz >= 16 ? 15 : 7;
-    tcg_debug_assert(oprsz > 0);
-    tcg_debug_assert(oprsz <= maxsz);
-    tcg_debug_assert((oprsz & opr_align) == 0);
+    uint32_t max_align;
+
+    switch (oprsz) {
+    case 8:
+    case 16:
+    case 32:
+        tcg_debug_assert(oprsz <= maxsz);
+        break;
+    default:
+        tcg_debug_assert(oprsz == maxsz);
+        break;
+    }
+    tcg_debug_assert(maxsz <= (8 << SIMD_MAXSZ_BITS));
+
+    max_align = maxsz >= 16 ? 15 : 7;
     tcg_debug_assert((maxsz & max_align) == 0);
     tcg_debug_assert((ofs & max_align) == 0);
 }
@@ -XXX,XX +XXX,XX @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
 {
     uint32_t desc = 0;
 
-    assert(oprsz % 8 == 0 && oprsz <= (8 << SIMD_OPRSZ_BITS));
-    assert(maxsz % 8 == 0 && maxsz <= (8 << SIMD_MAXSZ_BITS));
-    assert(data == sextract32(data, 0, SIMD_DATA_BITS));
+    check_size_align(oprsz, maxsz, 0);
+    tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
 
     oprsz = (oprsz / 8) - 1;
     maxsz = (maxsz / 8) - 1;
+
+    /*
+     * We have just asserted in check_size_align that either
+     * oprsz is {8,16,32} or matches maxsz.  Encode the final
+     * case with '2', as that would otherwise map to 24.
+     */
+    if (oprsz == maxsz) {
+        oprsz = 2;
+    }
+
     desc = deposit32(desc, SIMD_OPRSZ_SHIFT, SIMD_OPRSZ_BITS, oprsz);
     desc = deposit32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS, maxsz);
     desc = deposit32(desc, SIMD_DATA_SHIFT, SIMD_DATA_BITS, data);
-- 
2.25.1

The union is unused; let "regs" appear in the main structure
without the "u.regs" wrapping.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h            |  4 +---
 tcg/tcg.c                    | 22 +++++++++++-----------
 tcg/aarch64/tcg-target.c.inc | 14 +++++++-------
 tcg/arm/tcg-target.c.inc     | 26 +++++++++++++-------------
 tcg/i386/tcg-target.c.inc    | 26 +++++++++++++-------------
 tcg/mips/tcg-target.c.inc    | 18 +++++++++---------
 tcg/ppc/tcg-target.c.inc     | 24 ++++++++++++------------
 tcg/riscv/tcg-target.c.inc   | 14 +++++++-------
 tcg/s390/tcg-target.c.inc    | 18 +++++++++---------
 tcg/sparc/tcg-target.c.inc   | 16 ++++++++--------
 tcg/tci/tcg-target.c.inc     |  2 +-
 11 files changed, 91 insertions(+), 93 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 typedef struct TCGArgConstraint {
     uint16_t ct;
     uint8_t alias_index;
-    union {
-        TCGRegSet regs;
-    } u;
+    TCGRegSet regs;
 } TCGArgConstraint;
 
 #define TCG_MAX_OP_ARGS 16
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
             return 0;
         n = 0;
         for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->u.regs, i))
+            if (tcg_regset_test_reg(arg_ct->regs, i))
                 n++;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].u.regs = 0;
+            def->args_ct[i].regs = 0;
             def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     pset = la_temp_pref(ts);
                     set = *pset;
 
-                    set &= ct->u.regs;
+                    set &= ct->regs;
                     if (ct->ct & TCG_CT_IALIAS) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
                     if (set == 0) {
-                        set = ct->u.regs;
+                        set = ct->regs;
                     }
                     *pset = set;
                 }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
         return;
     }
 
-    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].u.regs;
-    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].u.regs;
+    dup_out_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[0].regs;
+    dup_in_regs = tcg_op_defs[INDEX_op_dup_vec].args_ct[1].regs;
 
     /* Allocate the output register now.  */
     if (ots->val_type != TEMP_VAL_REG) {
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             }
         }
 
-        temp_load(s, ts, arg_ct->u.regs, i_allocated_regs, i_preferred_regs);
+        temp_load(s, ts, arg_ct->regs, i_allocated_regs, i_preferred_regs);
         reg = ts->reg;
 
-        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+        if (tcg_regset_test_reg(arg_ct->regs, reg)) {
             /* nothing to do : the constraint is satisfied */
         } else {
         allocate_in_reg:
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                and move the temporary register into it */
             temp_load(s, ts, tcg_target_available_regs[ts->type],
                       i_allocated_regs, 0);
-            reg = tcg_reg_alloc(s, arg_ct->u.regs, i_allocated_regs,
+            reg = tcg_reg_alloc(s, arg_ct->regs, i_allocated_regs,
                                 o_preferred_regs, ts->indirect_base);
             if (!tcg_out_mov(s, ts->type, reg, ts->reg)) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                 && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
             } else if (arg_ct->ct & TCG_CT_NEWREG) {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             } else {
-                reg = tcg_reg_alloc(s, arg_ct->u.regs, o_allocated_regs,
+                reg = tcg_reg_alloc(s, arg_ct->regs, o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
             }
             tcg_regset_set_reg(o_allocated_regs, reg);
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r': /* general registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffffu;
+        ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= 0xffffffff00000000ull;
+        ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffffu;
+        ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
            and x2, and x3 for helper args, better to avoid using them. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_X3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_X3);
 #endif
         break;
     case 'A': /* Valid for arithmetic immediate (positive or negative).  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
            so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
     /* qemu_st address & data */
     case 's':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R1);
 #if defined(CONFIG_SOFTMMU)
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
 #if TARGET_LONG_BITS == 64
         /* Avoid clashes with registers being used for helper args */
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #endif
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R14);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R14);
 #endif
         break;
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'a':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
+        tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xf;
+        ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_GENERAL_REGS;
+        ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
         /* With TZCNT/LZCNT, we can have operand-size as an input.  */
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'x':
         /* A vector register.  */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs |= ALL_VECTOR_REGS;
+        ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_L1);
+        ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
         break;
 
     case 'e':
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch(*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
         }
 #endif
         break;
     case 'S': /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_A0);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
         if (TCG_TARGET_REG_BITS < TARGET_LONG_BITS) {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A2);
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A3);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A2);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A3);
         } else {
-            tcg_regset_reset_reg(ct->u.regs, TCG_REG_A1);
+            tcg_regset_reset_reg(ct->regs, TCG_REG_A1);
         }
 #endif
         break;
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
         ct->ct |= TCG_CT_REG;
-        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
+        tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'v':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff00000000ull;
+        ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0xffffffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R6);
 #endif
         break;
     case 'I':
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[0]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[1]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[2]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[3]);
-        tcg_regset_reset_reg(ct->u.regs, tcg_target_call_iarg_regs[4]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[0]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[1]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[2]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[3]);
+        tcg_regset_reset_reg(ct->regs, tcg_target_call_iarg_regs[4]);
 #endif
         break;
     case 'I':
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':                  /* all registers */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
+        ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffff;
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        ct->regs = 0xffff;
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R2);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0;
-        tcg_regset_set_reg(ct->u.regs, TCG_REG_R3);
+        ct->regs = 0;
+        tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
     case 'A':
         ct->ct |= TCG_CT_CONST_S33;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     switch (*ct_str++) {
     case 'r':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         break;
     case 'R':
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
+        ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
-        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O1);
+        tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = 0xffffffff;
+        ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = ALL_64;
+        ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
         ct->ct |= TCG_CT_CONST_S11;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
         ct->ct |= TCG_CT_REG;
-        ct->u.regs = BIT(TCG_TARGET_NB_REGS) - 1;
+        ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
         return NULL;
-- 
2.25.1

This uses an existing hole in the TCGArgConstraint structure
and will be convenient for keeping the data in one place.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h |  2 +-
 tcg/tcg.c         | 35 +++++++++++++++++------------------
 2 files changed, 18 insertions(+), 19 deletions(-)

This wasn't actually used for anything, really.  All variable
operands must accept registers, and which are indicated by the
set in TCGArgConstraint.regs.

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_dump_op_count(void);
 #define TCG_CT_ALIAS  0x80
 #define TCG_CT_IALIAS 0x40
 #define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_REG    0x01
 #define TCG_CT_CONST  0x02 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
 /* we give more priority to constraints with less registers */
 static int get_constraint_priority(const TCGOpDef *def, int k)
 {
-    const TCGArgConstraint *arg_ct;
+    const TCGArgConstraint *arg_ct = &def->args_ct[k];
+    int n;
 
-    int i, n;
-    arg_ct = &def->args_ct[k];
     if (arg_ct->ct & TCG_CT_ALIAS) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
-        if (!(arg_ct->ct & TCG_CT_REG))
-            return 0;
-        n = 0;
-        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
-            if (tcg_regset_test_reg(arg_ct->regs, i))
-                n++;
-        }
+        n = ctpop64(arg_ct->regs);
     }
     return TCG_TARGET_NB_REGS - n + 1;
 }
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         int oarg = *ct_str - '0';
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
-                        tcg_debug_assert(def->args_ct[oarg].ct & TCG_CT_REG);
+                        tcg_debug_assert(def->args_ct[oarg].regs != 0);
                         /* TCG_CT_ALIAS is for the output arguments.
                            The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r': /* general registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffffu;
         break;
     case 'w': /* advsimd registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= 0xffffffff00000000ull;
         break;
     case 'l': /* qemu_ld / qemu_st address, data_reg */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffffu;
 #ifdef CONFIG_SOFTMMU
         /* x0 and x1 will be overwritten when reading the tlb entry,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
 
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
 
     /* qemu_ld address */
     case 'l':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
 #ifdef CONFIG_SOFTMMU
         /* r0-r2,lr will be overwritten when reading the tlb entry,
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 
     /* qemu_st address & data */
     case 's':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         /* r0-r2 will be overwritten when reading the tlb entry (softmmu only)
            and r0-r1 doing the byte swapping, so don't use these. */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'a':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EAX);
         break;
     case 'b':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EBX);
         break;
     case 'c':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ECX);
         break;
     case 'd':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDX);
         break;
     case 'S':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_ESI);
         break;
     case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, TCG_REG_EDI);
         break;
     case 'q':
         /* A register that can be used as a byte operand.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xf;
         break;
     case 'Q':
         /* A register with an addressable second byte (e.g. %ah).  */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xf;
         break;
     case 'r':
         /* A general register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_GENERAL_REGS;
         break;
     case 'W':
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         break;
     case 'x':
         /* A vector register.  */
-        ct->ct |= TCG_CT_REG;
         ct->regs |= ALL_VECTOR_REGS;
         break;
 
         /* qemu_ld/st address constraint */
     case 'L':
-        ct->ct |= TCG_CT_REG;
         ct->regs = TCG_TARGET_REG_BITS == 64 ? 0xffff : 0xff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_L0);
         tcg_regset_reset_reg(ct->regs, TCG_REG_L1);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch(*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L': /* qemu_ld input arg constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S': /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_A0);
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'A': case 'B': case 'C': case 'D':
-        ct->ct |= TCG_CT_REG;
         tcg_regset_set_reg(ct->regs, 3 + ct_str[0] - 'A');
         break;
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'v':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff00000000ull;
         break;
     case 'L':                   /* qemu_ld constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 #endif
         break;
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
 #ifdef CONFIG_SOFTMMU
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'L':
         /* qemu_ld/qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         /* qemu_ld/qemu_st uses TCG_REG_TMP0 */
 #if defined(CONFIG_SOFTMMU)
diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':                  /* all registers */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         break;
     case 'L':                  /* qemu_ld/st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffff;
         tcg_regset_reset_reg(ct->regs, TCG_REG_R2);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R3);
         tcg_regset_reset_reg(ct->regs, TCG_REG_R4);
         break;
     case 'a':                  /* force R2 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R2);
         break;
     case 'b':                  /* force R3 for division */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0;
         tcg_regset_set_reg(ct->regs, TCG_REG_R3);
         break;
diff --git a/tcg/sparc/tcg-target.c.inc b/tcg/sparc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/sparc/tcg-target.c.inc
+++ b/tcg/sparc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
 {
     switch (*ct_str++) {
     case 'r':
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         break;
     case 'R':
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         break;
     case 'A': /* qemu_ld/st address constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = TARGET_LONG_BITS == 64 ? ALL_64 : 0xffffffff;
     reserve_helpers:
         tcg_regset_reset_reg(ct->regs, TCG_REG_O0);
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
         tcg_regset_reset_reg(ct->regs, TCG_REG_O2);
         break;
     case 's': /* qemu_st data 32-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = 0xffffffff;
         goto reserve_helpers;
     case 'S': /* qemu_st data 64-bit constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = ALL_64;
         goto reserve_helpers;
     case 'I':
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const char *target_parse_constraint(TCGArgConstraint *ct,
     case 'r':
     case 'L':                   /* qemu_ld constraint */
     case 'S':                   /* qemu_st constraint */
-        ct->ct |= TCG_CT_REG;
         ct->regs = BIT(TCG_TARGET_NB_REGS) - 1;
         break;
     default:
-- 
2.25.1

These are easier to set and test when they have their own fields.
Reduce the size of alias_index and sort_index to 4 bits, which is
sufficient for TCG_MAX_OP_ARGS.  This leaves only the bits indicating
constants within the ct field.

Move all initialization to allocation time, rather than init
individual fields in process_op_defs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 14 +++++++-------
 tcg/tcg.c         | 28 ++++++++++++----------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(void);
 void tcg_dump_op_count(void);
 
-#define TCG_CT_ALIAS  0x80
-#define TCG_CT_IALIAS 0x40
-#define TCG_CT_NEWREG 0x20 /* output requires a new register */
-#define TCG_CT_CONST  0x02 /* any constant of register size */
+#define TCG_CT_CONST  1 /* any constant of register size */
 
 typedef struct TCGArgConstraint {
-    uint16_t ct;
-    uint8_t alias_index;
-    uint8_t sort_index;
+    unsigned ct : 16;
+    unsigned alias_index : 4;
+    unsigned sort_index : 4;
+    bool oalias : 1;
+    bool ialias : 1;
+    bool newreg : 1;
     TCGRegSet regs;
 } TCGArgConstraint;
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_context_init(TCGContext *s)
         total_args += n;
     }
 
-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    args_ct = g_new0(TCGArgConstraint, total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
@@ -XXX,XX +XXX,XX @@ static int get_constraint_priority(const TCGOpDef *def, int k)
     const TCGArgConstraint *arg_ct = &def->args_ct[k];
     int n;
 
-    if (arg_ct->ct & TCG_CT_ALIAS) {
+    if (arg_ct->oalias) {
         /* an alias is equivalent to a single register */
         n = 1;
     } else {
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
             /* Incomplete TCGTargetOpDef entry. */
             tcg_debug_assert(ct_str != NULL);
 
-            def->args_ct[i].regs = 0;
-            def->args_ct[i].ct = 0;
             while (*ct_str != '\0') {
                 switch(*ct_str) {
                 case '0' ... '9':
@@ -XXX,XX +XXX,XX @@ static void process_op_defs(TCGContext *s)
                         tcg_debug_assert(ct_str == tdefs->args_ct_str[i]);
                         tcg_debug_assert(oarg < def->nb_oargs);
                         tcg_debug_assert(def->args_ct[oarg].regs != 0);
-                        /* TCG_CT_ALIAS is for the output arguments.
-                           The input is tagged with TCG_CT_IALIAS. */
                         def->args_ct[i] = def->args_ct[oarg];
-                        def->args_ct[oarg].ct |= TCG_CT_ALIAS;
+                        /* The output sets oalias.  */
+                        def->args_ct[oarg].oalias = true;
                         def->args_ct[oarg].alias_index = i;
-                        def->args_ct[i].ct |= TCG_CT_IALIAS;
+                        /* The input sets ialias. */
+                        def->args_ct[i].ialias = true;
                         def->args_ct[i].alias_index = oarg;
                     }
                     ct_str++;
                     break;
                 case '&':
-                    def->args_ct[i].ct |= TCG_CT_NEWREG;
+                    def->args_ct[i].newreg = true;
                     ct_str++;
                     break;
                 case 'i':
@@ -XXX,XX +XXX,XX @@ static void liveness_pass_1(TCGContext *s)
                     set = *pset;
 
                     set &= ct->regs;
-                    if (ct->ct & TCG_CT_IALIAS) {
+                    if (ct->ialias) {
                         set &= op->output_pref[ct->alias_index];
                     }
                     /* If the combination is not possible, restart.  */
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
 
         i_preferred_regs = o_preferred_regs = 0;
-        if (arg_ct->ct & TCG_CT_IALIAS) {
+        if (arg_ct->ialias) {
             o_preferred_regs = op->output_pref[arg_ct->alias_index];
             if (ts->fixed_reg) {
                 /* if fixed register, we must allocate a new register
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                     reg = ts->reg;
                     for (k2 = 0 ; k2 < k ; k2++) {
                         i2 = def->args_ct[nb_oargs + k2].sort_index;
-                        if ((def->args_ct[i2].ct & TCG_CT_IALIAS) &&
-                            reg == new_args[i2]) {
+                        if (def->args_ct[i2].ialias && reg == new_args[i2]) {
                             goto allocate_in_reg;
                         }
                     }
@@ -XXX,XX +XXX,XX @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
             /* ENV should not be modified.  */
             tcg_debug_assert(!ts->fixed_reg);
 
-            if ((arg_ct->ct & TCG_CT_ALIAS)
-                && !const_args[arg_ct->alias_index]) {
+            if (arg_ct->oalias && !const_args[arg_ct->alias_index]) {
                 reg = new_args[arg_ct->alias_index];
-            } else if (arg_ct->ct & TCG_CT_NEWREG) {
+            } else if (arg_ct->newreg) {
                 reg = tcg_reg_alloc(s, arg_ct->regs,
                                     i_allocated_regs | o_allocated_regs,
                                     op->output_pref[k], ts->indirect_base);
-- 
2.25.1

The definition of INDEX_op_dupi_vec is that it operates on
units of tcg_target_ulong -- in this case 32 bits.  It does
not work to use this for a uint64_t value that happens to be
small enough to fit in tcg_target_ulong.

Fixes: d2fd745fe8b
Fixes: db432672dc5
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ TCGv_vec tcg_const_ones_vec_matching(TCGv_vec m)
 
 void tcg_gen_dup64i_vec(TCGv_vec r, uint64_t a)
 {
-    if (TCG_TARGET_REG_BITS == 32 && a == deposit64(a, 32, 32, a)) {
-        do_dupi_vec(r, MO_32, a);
-    } else if (TCG_TARGET_REG_BITS == 64 || a == (uint64_t)(int32_t)a) {
+    if (TCG_TARGET_REG_BITS == 64) {
         do_dupi_vec(r, MO_64, a);
+    } else if (a == dup_const(MO_32, a)) {
+        do_dupi_vec(r, MO_32, a);
     } else {
         TCGv_i64 c = tcg_const_i64(a);
         tcg_gen_dup_i64_vec(MO_64, r, c);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_dup8i_vec(TCGv_vec r, uint32_t a)
 
 void tcg_gen_dupi_vec(unsigned vece, TCGv_vec r, uint64_t a)
 {
-    do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    if (vece == MO_64) {
+        tcg_gen_dup64i_vec(r, a);
+    } else {
+        do_dupi_vec(r, MO_REG, dup_const(vece, a));
+    }
 }
 
 void tcg_gen_dup_i64_vec(unsigned vece, TCGv_vec r, TCGv_i64 a)
-- 
2.25.1

When the two arguments are identical, this can be reduced to
dup_vec or to mov_vec from a tcg_constant_vec.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
             }
             goto do_default;
 
+        case INDEX_op_dup2_vec:
+            assert(TCG_TARGET_REG_BITS == 32);
+            if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
+                tmp = arg_info(op->args[1])->val;
+                if (tmp == arg_info(op->args[2])->val) {
+                    tcg_opt_gen_movi(s, op, op->args[0], tmp);
+                    break;
+                }
+            } else if (args_are_copies(op->args[1], op->args[2])) {
+                op->opc = INDEX_op_dup_vec;
+                TCGOP_VECE(op) = MO_32;
+                nb_iargs = 1;
+            }
+            goto do_default;
+
         CASE_OP_32_64(not):
         CASE_OP_32_64(neg):
         CASE_OP_32_64(ext8s):
-- 
2.25.1

The cmp_vec opcode is mandatory; this symbol is unused.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.h | 1 -
 tcg/i386/tcg-target.h    | 1 -
 tcg/ppc/tcg-target.h     | 1 -
 3 files changed, 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_avx2;
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          1
 #define TCG_TARGET_HAS_shv_vec          have_avx2
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
 #define TCG_TARGET_HAS_shi_vec          0
 #define TCG_TARGET_HAS_shs_vec          0
 #define TCG_TARGET_HAS_shv_vec          1
-#define TCG_TARGET_HAS_cmp_vec          1
 #define TCG_TARGET_HAS_mul_vec          1
 #define TCG_TARGET_HAS_sat_vec          1
 #define TCG_TARGET_HAS_minmax_vec       1
-- 
2.25.1

From: Kele Huang <kele.hwang@gmail.com>

Detect all MIPS store instructions in cpu_signal_handler for all available
MIPS versions, and set is_write if encountering such store instructions.

This fixed the error while dealing with self-modified code for MIPS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Kele Huang <kele.hwang@gmail.com>
Signed-off-by: Xu Zou <iwatchnima@gmail.com>
Message-Id: <20201002081420.10814-1-kele.hwang@gmail.com>
[rth: Use uintptr_t for pc to fix n32 build error.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
 #elif defined(__mips__)
 
+#if defined(__misp16) || defined(__mips_micromips)
+#error "Unsupported encoding"
+#endif
+
 int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
     siginfo_t *info = pinfo;
     ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.pc;
-    int is_write;
+    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
+    int is_write = 0;
+
+    /* Detect all store instructions at program counter. */
+    switch((insn >> 26) & 077) {
+    case 050: /* SB */
+    case 051: /* SH */
+    case 052: /* SWL */
+    case 053: /* SW */
+    case 054: /* SDL */
+    case 055: /* SDR */
+    case 056: /* SWR */
+    case 070: /* SC */
+    case 071: /* SWC1 */
+    case 074: /* SCD */
+    case 075: /* SDC1 */
+    case 077: /* SD */
+#if !defined(__mips_isa_rev) || __mips_isa_rev < 6
+    case 072: /* SWC2 */
+    case 076: /* SDC2 */
+#endif
+        is_write = 1;
+        break;
+    case 023: /* COP1X */
+        /* Required in all versions of MIPS64 since
+           MIPS64r1 and subsequent versions of MIPS32r2. */
+        switch (insn & 077) {
+        case 010: /* SWXC1 */
+        case 011: /* SDXC1 */
+        case 015: /* SUXC1 */
+            is_write = 1;
+        }
+        break;
+    }
 
-    /* XXX: compute is_write */
-    is_write = 0;
     return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }
 
-- 
2.25.1

The following changes since commit 36eae3a732a1f2aa81391e871ac0e9bb3233e7d7:

Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-migration-20220302b' into staging (2022-03-02 20:55:48 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220303

for you to fetch changes up to f23e6de25c31cadd9a3b7122f9384e6b259ce37f:

tcg/loongarch64: Support TCG_TARGET_SIGNED_ADDR32 (2022-03-03 10:47:20 -1000)

----------------------------------------------------------------
Reorder do_constant_folding_cond test to satisfy valgrind.
Fix value of MAX_OPC_PARAM_IARGS.
Add opcodes for vector nand, nor, eqv.
Support vector nand, nor, eqv on PPC and S390X hosts.
Support AVX512VL, AVX512BW, AVX512DQ, and AVX512VBMI2.
Support 32-bit guest addresses as signed values.

----------------------------------------------------------------
Alex Bennée (1):
      tcg/optimize: only read val after const check

Richard Henderson (28):
      tcg: Add opcodes for vector nand, nor, eqv
      tcg/ppc: Implement vector NAND, NOR, EQV
      tcg/s390x: Implement vector NAND, NOR, EQV
      tcg/i386: Detect AVX512
      tcg/i386: Add tcg_out_evex_opc
      tcg/i386: Use tcg_can_emit_vec_op in expand_vec_cmp_noinv
      tcg/i386: Implement avx512 variable shifts
      tcg/i386: Implement avx512 scalar shift
      tcg/i386: Implement avx512 immediate sari shift
      tcg/i386: Implement avx512 immediate rotate
      tcg/i386: Implement avx512 variable rotate
      tcg/i386: Support avx512vbmi2 vector shift-double instructions
      tcg/i386: Expand vector word rotate as avx512vbmi2 shift-double
      tcg/i386: Remove rotls_vec from tcg_target_op_def
      tcg/i386: Expand scalar rotate with avx512 insns
      tcg/i386: Implement avx512 min/max/abs
      tcg/i386: Implement avx512 multiply
      tcg/i386: Implement more logical operations for avx512
      tcg/i386: Implement bitsel for avx512
      tcg: Add TCG_TARGET_SIGNED_ADDR32
      accel/tcg: Split out g2h_tlbe
      accel/tcg: Support TCG_TARGET_SIGNED_ADDR32 for softmmu
      accel/tcg: Add guest_base_signed_addr32 for user-only
      linux-user: Support TCG_TARGET_SIGNED_ADDR32
      tcg/aarch64: Support TCG_TARGET_SIGNED_ADDR32
      tcg/mips: Support TCG_TARGET_SIGNED_ADDR32
      tcg/riscv: Support TCG_TARGET_SIGNED_ADDR32
      tcg/loongarch64: Support TCG_TARGET_SIGNED_ADDR32

Ziqiao Kong (1):
      tcg: Set MAX_OPC_PARAM_IARGS to 7

include/exec/cpu-all.h            |  20 +-
 include/exec/cpu_ldst.h           |   3 +-
 include/qemu/cpuid.h              |  20 +-
 include/tcg/tcg-opc.h             |   3 +
 include/tcg/tcg.h                 |   5 +-
 tcg/aarch64/tcg-target-sa32.h     |   7 +
 tcg/aarch64/tcg-target.h          |   3 +
 tcg/arm/tcg-target-sa32.h         |   1 +
 tcg/arm/tcg-target.h              |   3 +
 tcg/i386/tcg-target-con-set.h     |   1 +
 tcg/i386/tcg-target-sa32.h        |   1 +
 tcg/i386/tcg-target.h             |  17 +-
 tcg/i386/tcg-target.opc.h         |   3 +
 tcg/loongarch64/tcg-target-sa32.h |   1 +
 tcg/mips/tcg-target-sa32.h        |   9 +
 tcg/ppc/tcg-target-sa32.h         |   1 +
 tcg/ppc/tcg-target.h              |   3 +
 tcg/riscv/tcg-target-sa32.h       |   5 +
 tcg/s390x/tcg-target-sa32.h       |   1 +
 tcg/s390x/tcg-target.h            |   3 +
 tcg/sparc/tcg-target-sa32.h       |   1 +
 tcg/tci/tcg-target-sa32.h         |   1 +
 accel/tcg/cputlb.c                |  36 ++--
 bsd-user/main.c                   |   4 +
 linux-user/elfload.c              |  62 ++++--
 linux-user/main.c                 |   3 +
 tcg/optimize.c                    |  20 +-
 tcg/tcg-op-vec.c                  |  27 ++-
 tcg/tcg.c                         |  10 +
 tcg/aarch64/tcg-target.c.inc      |  81 +++++---
 tcg/i386/tcg-target.c.inc         | 387 +++++++++++++++++++++++++++++++-------
 tcg/loongarch64/tcg-target.c.inc  |  15 +-
 tcg/mips/tcg-target.c.inc         |  10 +-
 tcg/ppc/tcg-target.c.inc          |  15 ++
 tcg/riscv/tcg-target.c.inc        |   8 +-
 tcg/s390x/tcg-target.c.inc        |  17 ++
 tcg/tci/tcg-target.c.inc          |   2 +-
 37 files changed, 640 insertions(+), 169 deletions(-)
 create mode 100644 tcg/aarch64/tcg-target-sa32.h
 create mode 100644 tcg/arm/tcg-target-sa32.h
 create mode 100644 tcg/i386/tcg-target-sa32.h
 create mode 100644 tcg/loongarch64/tcg-target-sa32.h
 create mode 100644 tcg/mips/tcg-target-sa32.h
 create mode 100644 tcg/ppc/tcg-target-sa32.h
 create mode 100644 tcg/riscv/tcg-target-sa32.h
 create mode 100644 tcg/s390x/tcg-target-sa32.h
 create mode 100644 tcg/sparc/tcg-target-sa32.h
 create mode 100644 tcg/tci/tcg-target-sa32.h

From: Alex Bennée <alex.bennee@linaro.org>

valgrind pointed out that arg_info()->val can be undefined which will
be the case if the arguments are not constant. The ordering of the
checks will have ensured we never relied on an undefined value but for
the sake of completeness re-order the code to be clear.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220209112142.3367525-1-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static bool do_constant_folding_cond_eq(TCGCond c)
 static int do_constant_folding_cond(TCGType type, TCGArg x,
                                     TCGArg y, TCGCond c)
 {
-    uint64_t xv = arg_info(x)->val;
-    uint64_t yv = arg_info(y)->val;
-
     if (arg_is_const(x) && arg_is_const(y)) {
+        uint64_t xv = arg_info(x)->val;
+        uint64_t yv = arg_info(y)->val;
+
         switch (type) {
         case TCG_TYPE_I32:
             return do_constant_folding_cond_32(xv, yv, c);
@@ -XXX,XX +XXX,XX @@ static int do_constant_folding_cond(TCGType type, TCGArg x,
         }
     } else if (args_are_copies(x, y)) {
         return do_constant_folding_cond_eq(c);
-    } else if (arg_is_const(y) && yv == 0) {
+    } else if (arg_is_const(y) && arg_info(y)->val == 0) {
         switch (c) {
         case TCG_COND_LTU:
             return 0;
-- 
2.25.1

From: Ziqiao Kong <ziqiaokong@gmail.com>

The last entry of DEF_HELPERS_FLAGS_n is DEF_HELPER_FLAGS_7 and
thus the MAX_OPC_PARAM_IARGS should be 7.

Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com>
Message-Id: <20220227113127.414533-2-ziqiaokong@gmail.com>
Fixes: e6cadf49c3d ("tcg: Add support for a helper with 7 arguments")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h        | 2 +-
 tcg/tci/tcg-target.c.inc | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@
 #else
 #define MAX_OPC_PARAM_PER_ARG 1
 #endif
-#define MAX_OPC_PARAM_IARGS 6
+#define MAX_OPC_PARAM_IARGS 7
 #define MAX_OPC_PARAM_OARGS 1
 #define MAX_OPC_PARAM_ARGS (MAX_OPC_PARAM_IARGS + MAX_OPC_PARAM_OARGS)
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R0,
 };
 
-#if MAX_OPC_PARAM_IARGS != 6
+#if MAX_OPC_PARAM_IARGS != 7
 # error Fix needed, number of supported input arguments changed!
 #endif
 
-- 
2.25.1

We've had placeholders for these opcodes for a while,
and should have support on ppc, s390x and avx512 hosts.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h    |  3 +++
 include/tcg/tcg.h        |  3 +++
 tcg/aarch64/tcg-target.h |  3 +++
 tcg/arm/tcg-target.h     |  3 +++
 tcg/i386/tcg-target.h    |  3 +++
 tcg/ppc/tcg-target.h     |  3 +++
 tcg/s390x/tcg-target.h   |  3 +++
 tcg/optimize.c           | 12 ++++++------
 tcg/tcg-op-vec.c         | 27 ++++++++++++++++++---------
 tcg/tcg.c                |  6 ++++++
 10 files changed, 51 insertions(+), 15 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -XXX,XX +XXX,XX @@ DEF(or_vec, 1, 2, 0, IMPLVEC)
 DEF(xor_vec, 1, 2, 0, IMPLVEC)
 DEF(andc_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_andc_vec))
 DEF(orc_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_orc_vec))
+DEF(nand_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_nand_vec))
+DEF(nor_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_nor_vec))
+DEF(eqv_vec, 1, 2, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_eqv_vec))
 DEF(not_vec, 1, 1, 0, IMPLVEC | IMPL(TCG_TARGET_HAS_not_vec))
 
 DEF(shli_vec, 1, 1, 1, IMPLVEC | IMPL(TCG_TARGET_HAS_shi_vec))
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_not_vec          0
 #define TCG_TARGET_HAS_andc_vec         0
 #define TCG_TARGET_HAS_orc_vec          0
+#define TCG_TARGET_HAS_nand_vec         0
+#define TCG_TARGET_HAS_nor_vec          0
+#define TCG_TARGET_HAS_eqv_vec          0
 #define TCG_TARGET_HAS_roti_vec         0
 #define TCG_TARGET_HAS_rots_vec         0
 #define TCG_TARGET_HAS_rotv_vec         0
diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 #define TCG_TARGET_HAS_andc_vec         1
 #define TCG_TARGET_HAS_orc_vec          1
+#define TCG_TARGET_HAS_nand_vec         0
+#define TCG_TARGET_HAS_nor_vec          0
+#define TCG_TARGET_HAS_eqv_vec          0
 #define TCG_TARGET_HAS_not_vec          1
 #define TCG_TARGET_HAS_neg_vec          1
 #define TCG_TARGET_HAS_abs_vec          1
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool use_neon_instructions;
 
 #define TCG_TARGET_HAS_andc_vec         1
 #define TCG_TARGET_HAS_orc_vec          1
+#define TCG_TARGET_HAS_nand_vec         0
+#define TCG_TARGET_HAS_nor_vec          0
+#define TCG_TARGET_HAS_eqv_vec          0
 #define TCG_TARGET_HAS_not_vec          1
 #define TCG_TARGET_HAS_neg_vec          1
 #define TCG_TARGET_HAS_abs_vec          1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
 
 #define TCG_TARGET_HAS_andc_vec         1
 #define TCG_TARGET_HAS_orc_vec          0
+#define TCG_TARGET_HAS_nand_vec         0
+#define TCG_TARGET_HAS_nor_vec          0
+#define TCG_TARGET_HAS_eqv_vec          0
 #define TCG_TARGET_HAS_not_vec          0
 #define TCG_TARGET_HAS_neg_vec          0
 #define TCG_TARGET_HAS_abs_vec          1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
 
 #define TCG_TARGET_HAS_andc_vec         1
 #define TCG_TARGET_HAS_orc_vec          have_isa_2_07
+#define TCG_TARGET_HAS_nand_vec         0
+#define TCG_TARGET_HAS_nor_vec          0
+#define TCG_TARGET_HAS_eqv_vec          0
 #define TCG_TARGET_HAS_not_vec          1
 #define TCG_TARGET_HAS_neg_vec          have_isa_3_00
 #define TCG_TARGET_HAS_abs_vec          0
diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities[3];
 
 #define TCG_TARGET_HAS_andc_vec       1
 #define TCG_TARGET_HAS_orc_vec        HAVE_FACILITY(VECTOR_ENH1)
+#define TCG_TARGET_HAS_nand_vec       0
+#define TCG_TARGET_HAS_nor_vec        0
+#define TCG_TARGET_HAS_eqv_vec        0
 #define TCG_TARGET_HAS_not_vec        1
 #define TCG_TARGET_HAS_neg_vec        1
 #define TCG_TARGET_HAS_abs_vec        1
diff --git a/tcg/optimize.c b/tcg/optimize.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     CASE_OP_32_64_VEC(orc):
         return x | ~y;
 
-    CASE_OP_32_64(eqv):
+    CASE_OP_32_64_VEC(eqv):
         return ~(x ^ y);
 
-    CASE_OP_32_64(nand):
+    CASE_OP_32_64_VEC(nand):
         return ~(x & y);
 
-    CASE_OP_32_64(nor):
+    CASE_OP_32_64_VEC(nor):
         return ~(x | y);
 
     case INDEX_op_clz_i32:
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_dup2_vec:
             done = fold_dup2(&ctx, op);
             break;
-        CASE_OP_32_64(eqv):
+        CASE_OP_32_64_VEC(eqv):
             done = fold_eqv(&ctx, op);
             break;
         CASE_OP_32_64(extract):
@@ -XXX,XX +XXX,XX @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(mulu2):
             done = fold_multiply2(&ctx, op);
             break;
-        CASE_OP_32_64(nand):
+        CASE_OP_32_64_VEC(nand):
             done = fold_nand(&ctx, op);
             break;
         CASE_OP_32_64(neg):
             done = fold_neg(&ctx, op);
             break;
-        CASE_OP_32_64(nor):
+        CASE_OP_32_64_VEC(nor):
             done = fold_nor(&ctx, op);
             break;
         CASE_OP_32_64_VEC(not):
diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_orc_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
 
 void tcg_gen_nand_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
 {
-    /* TODO: Add TCG_TARGET_HAS_nand_vec when adding a backend supports it. */
-    tcg_gen_and_vec(0, r, a, b);
-    tcg_gen_not_vec(0, r, r);
+    if (TCG_TARGET_HAS_nand_vec) {
+        vec_gen_op3(INDEX_op_nand_vec, 0, r, a, b);
+    } else {
+        tcg_gen_and_vec(0, r, a, b);
+        tcg_gen_not_vec(0, r, r);
+    }
 }
 
 void tcg_gen_nor_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
 {
-    /* TODO: Add TCG_TARGET_HAS_nor_vec when adding a backend supports it. */
-    tcg_gen_or_vec(0, r, a, b);
-    tcg_gen_not_vec(0, r, r);
+    if (TCG_TARGET_HAS_nor_vec) {
+        vec_gen_op3(INDEX_op_nor_vec, 0, r, a, b);
+    } else {
+        tcg_gen_or_vec(0, r, a, b);
+        tcg_gen_not_vec(0, r, r);
+    }
 }
 
 void tcg_gen_eqv_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
 {
-    /* TODO: Add TCG_TARGET_HAS_eqv_vec when adding a backend supports it. */
-    tcg_gen_xor_vec(0, r, a, b);
-    tcg_gen_not_vec(0, r, r);
+    if (TCG_TARGET_HAS_eqv_vec) {
+        vec_gen_op3(INDEX_op_eqv_vec, 0, r, a, b);
+    } else {
+        tcg_gen_xor_vec(0, r, a, b);
+        tcg_gen_not_vec(0, r, r);
+    }
 }
 
 static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ bool tcg_op_supported(TCGOpcode op)
         return have_vec && TCG_TARGET_HAS_andc_vec;
     case INDEX_op_orc_vec:
         return have_vec && TCG_TARGET_HAS_orc_vec;
+    case INDEX_op_nand_vec:
+        return have_vec && TCG_TARGET_HAS_nand_vec;
+    case INDEX_op_nor_vec:
+        return have_vec && TCG_TARGET_HAS_nor_vec;
+    case INDEX_op_eqv_vec:
+        return have_vec && TCG_TARGET_HAS_eqv_vec;
     case INDEX_op_mul_vec:
         return have_vec && TCG_TARGET_HAS_mul_vec;
     case INDEX_op_shli_vec:
-- 
2.25.1

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.h     |  6 +++---
 tcg/ppc/tcg-target.c.inc | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_vsx;
 
 #define TCG_TARGET_HAS_andc_vec         1
 #define TCG_TARGET_HAS_orc_vec          have_isa_2_07
-#define TCG_TARGET_HAS_nand_vec         0
-#define TCG_TARGET_HAS_nor_vec          0
-#define TCG_TARGET_HAS_eqv_vec          0
+#define TCG_TARGET_HAS_nand_vec         have_isa_2_07
+#define TCG_TARGET_HAS_nor_vec          1
+#define TCG_TARGET_HAS_eqv_vec          have_isa_2_07
 #define TCG_TARGET_HAS_not_vec          1
 #define TCG_TARGET_HAS_neg_vec          have_isa_3_00
 #define TCG_TARGET_HAS_abs_vec          0
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_xor_vec:
     case INDEX_op_andc_vec:
     case INDEX_op_not_vec:
+    case INDEX_op_nor_vec:
+    case INDEX_op_eqv_vec:
+    case INDEX_op_nand_vec:
         return 1;
     case INDEX_op_orc_vec:
         return have_isa_2_07;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_orc_vec:
         insn = VORC;
         break;
+    case INDEX_op_nand_vec:
+        insn = VNAND;
+        break;
+    case INDEX_op_nor_vec:
+        insn = VNOR;
+        break;
+    case INDEX_op_eqv_vec:
+        insn = VEQV;
+        break;
 
     case INDEX_op_cmp_vec:
         switch (args[3]) {
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_xor_vec:
     case INDEX_op_andc_vec:
     case INDEX_op_orc_vec:
+    case INDEX_op_nor_vec:
+    case INDEX_op_eqv_vec:
+    case INDEX_op_nand_vec:
     case INDEX_op_cmp_vec:
     case INDEX_op_ssadd_vec:
     case INDEX_op_sssub_vec:
-- 
2.25.1

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target.h     |  6 +++---
 tcg/s390x/tcg-target.c.inc | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern uint64_t s390_facilities[3];
 
 #define TCG_TARGET_HAS_andc_vec       1
 #define TCG_TARGET_HAS_orc_vec        HAVE_FACILITY(VECTOR_ENH1)
-#define TCG_TARGET_HAS_nand_vec       0
-#define TCG_TARGET_HAS_nor_vec        0
-#define TCG_TARGET_HAS_eqv_vec        0
+#define TCG_TARGET_HAS_nand_vec       HAVE_FACILITY(VECTOR_ENH1)
+#define TCG_TARGET_HAS_nor_vec        1
+#define TCG_TARGET_HAS_eqv_vec        HAVE_FACILITY(VECTOR_ENH1)
 #define TCG_TARGET_HAS_not_vec        1
 #define TCG_TARGET_HAS_neg_vec        1
 #define TCG_TARGET_HAS_abs_vec        1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ typedef enum S390Opcode {
     VRRc_VMXL   = 0xe7fd,
     VRRc_VN     = 0xe768,
     VRRc_VNC    = 0xe769,
+    VRRc_VNN    = 0xe76e,
     VRRc_VNO    = 0xe76b,
+    VRRc_VNX    = 0xe76c,
     VRRc_VO     = 0xe76a,
     VRRc_VOC    = 0xe76f,
     VRRc_VPKS   = 0xe797,   /* we leave the m5 cs field 0 */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_xor_vec:
         tcg_out_insn(s, VRRc, VX, a0, a1, a2, 0);
         break;
+    case INDEX_op_nand_vec:
+        tcg_out_insn(s, VRRc, VNN, a0, a1, a2, 0);
+        break;
+    case INDEX_op_nor_vec:
+        tcg_out_insn(s, VRRc, VNO, a0, a1, a2, 0);
+        break;
+    case INDEX_op_eqv_vec:
+        tcg_out_insn(s, VRRc, VNX, a0, a1, a2, 0);
+        break;
 
     case INDEX_op_shli_vec:
         tcg_out_insn(s, VRSa, VESL, a0, a2, TCG_REG_NONE, a1, vece);
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_and_vec:
     case INDEX_op_andc_vec:
     case INDEX_op_bitsel_vec:
+    case INDEX_op_eqv_vec:
+    case INDEX_op_nand_vec:
     case INDEX_op_neg_vec:
+    case INDEX_op_nor_vec:
     case INDEX_op_not_vec:
     case INDEX_op_or_vec:
     case INDEX_op_orc_vec:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_or_vec:
     case INDEX_op_orc_vec:
     case INDEX_op_xor_vec:
+    case INDEX_op_nand_vec:
+    case INDEX_op_nor_vec:
+    case INDEX_op_eqv_vec:
     case INDEX_op_cmp_vec:
     case INDEX_op_mul_vec:
     case INDEX_op_rotlv_vec:
-- 
2.25.1

There are some operation sizes in some subsets of AVX512 that
are missing from previous iterations of AVX.  Detect them.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/cpuid.h      | 20 +++++++++++++++++---
 tcg/i386/tcg-target.h     |  4 ++++
 tcg/i386/tcg-target.c.inc | 24 ++++++++++++++++++++++--
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/include/qemu/cpuid.h b/include/qemu/cpuid.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/cpuid.h
+++ b/include/qemu/cpuid.h
@@ -XXX,XX +XXX,XX @@
 #ifndef bit_AVX2
 #define bit_AVX2        (1 << 5)
 #endif
-#ifndef bit_AVX512F
-#define bit_AVX512F        (1 << 16)
-#endif
 #ifndef bit_BMI2
 #define bit_BMI2        (1 << 8)
 #endif
+#ifndef bit_AVX512F
+#define bit_AVX512F     (1 << 16)
+#endif
+#ifndef bit_AVX512DQ
+#define bit_AVX512DQ    (1 << 17)
+#endif
+#ifndef bit_AVX512BW
+#define bit_AVX512BW    (1 << 30)
+#endif
+#ifndef bit_AVX512VL
+#define bit_AVX512VL    (1u << 31)
+#endif
+
+/* Leaf 7, %ecx */
+#ifndef bit_AVX512VBMI2
+#define bit_AVX512VBMI2 (1 << 6)
+#endif
 
 /* Leaf 0x80000001, %ecx */
 #ifndef bit_LZCNT
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_bmi1;
 extern bool have_popcnt;
 extern bool have_avx1;
 extern bool have_avx2;
+extern bool have_avx512bw;
+extern bool have_avx512dq;
+extern bool have_avx512vbmi2;
+extern bool have_avx512vl;
 extern bool have_movbe;
 
 /* optional instructions */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ bool have_bmi1;
 bool have_popcnt;
 bool have_avx1;
 bool have_avx2;
+bool have_avx512bw;
+bool have_avx512dq;
+bool have_avx512vbmi2;
+bool have_avx512vl;
 bool have_movbe;
 
 #ifdef CONFIG_CPUID_H
@@ -XXX,XX +XXX,XX @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 static void tcg_target_init(TCGContext *s)
 {
 #ifdef CONFIG_CPUID_H
-    unsigned a, b, c, d, b7 = 0;
+    unsigned a, b, c, d, b7 = 0, c7 = 0;
     unsigned max = __get_cpuid_max(0, 0);
 
     if (max >= 7) {
         /* BMI1 is available on AMD Piledriver and Intel Haswell CPUs.  */
-        __cpuid_count(7, 0, a, b7, c, d);
+        __cpuid_count(7, 0, a, b7, c7, d);
         have_bmi1 = (b7 & bit_BMI) != 0;
         have_bmi2 = (b7 & bit_BMI2) != 0;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_target_init(TCGContext *s)
             if ((xcrl & 6) == 6) {
                 have_avx1 = (c & bit_AVX) != 0;
                 have_avx2 = (b7 & bit_AVX2) != 0;
+
+                /*
+                 * There are interesting instructions in AVX512, so long
+                 * as we have AVX512VL, which indicates support for EVEX
+                 * on sizes smaller than 512 bits.  We are required to
+                 * check that OPMASK and all extended ZMM state are enabled
+                 * even if we're not using them -- the insns will fault.
+                 */
+                if ((xcrl & 0xe0) == 0xe0
+                    && (b7 & bit_AVX512F)
+                    && (b7 & bit_AVX512VL)) {
+                    have_avx512vl = true;
+                    have_avx512bw = (b7 & bit_AVX512BW) != 0;
+                    have_avx512dq = (b7 & bit_AVX512DQ) != 0;
+                    have_avx512vbmi2 = (c7 & bit_AVX512VBMI2) != 0;
+                }
             }
         }
     }
-- 
2.25.1

The evex encoding is added here, for use in a subsequent patch.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 51 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 50 insertions(+), 1 deletion(-)

The condition for UMIN/UMAX availability is about to change;
use the canonical version.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool expand_vec_cmp_noinv(TCGType type, unsigned vece, TCGv_vec v0,
         fixup = NEED_SWAP | NEED_INV;
         break;
     case TCG_COND_LEU:
-        if (vece <= MO_32) {
+        if (tcg_can_emit_vec_op(INDEX_op_umin_vec, type, vece)) {
             fixup = NEED_UMIN;
         } else {
             fixup = NEED_BIAS | NEED_INV;
         }
         break;
     case TCG_COND_GTU:
-        if (vece <= MO_32) {
+        if (tcg_can_emit_vec_op(INDEX_op_umin_vec, type, vece)) {
             fixup = NEED_UMIN | NEED_INV;
         } else {
             fixup = NEED_BIAS;
         }
         break;
     case TCG_COND_GEU:
-        if (vece <= MO_32) {
+        if (tcg_can_emit_vec_op(INDEX_op_umax_vec, type, vece)) {
             fixup = NEED_UMAX;
         } else {
             fixup = NEED_BIAS | NEED_SWAP | NEED_INV;
         }
         break;
     case TCG_COND_LTU:
-        if (vece <= MO_32) {
+        if (tcg_can_emit_vec_op(INDEX_op_umax_vec, type, vece)) {
             fixup = NEED_UMAX | NEED_INV;
         } else {
             fixup = NEED_BIAS | NEED_SWAP;
-- 
2.25.1

AVX512VL has VPSRAVQ, and
AVX512BW has VPSLLVW, VPSRAVW, VPSRLVW.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
 #define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
 #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
+#define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
 #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
+#define OPC_VPSRAVW     (0x11 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSRAVD     (0x46 | P_EXT38 | P_DATA16)
+#define OPC_VPSRAVQ     (0x46 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSRLVW     (0x10 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
 #define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
     };
     static int const shlv_insn[4] = {
-        /* TODO: AVX512 adds support for MO_16.  */
-        OPC_UD2, OPC_UD2, OPC_VPSLLVD, OPC_VPSLLVQ
+        OPC_UD2, OPC_VPSLLVW, OPC_VPSLLVD, OPC_VPSLLVQ
     };
     static int const shrv_insn[4] = {
-        /* TODO: AVX512 adds support for MO_16.  */
-        OPC_UD2, OPC_UD2, OPC_VPSRLVD, OPC_VPSRLVQ
+        OPC_UD2, OPC_VPSRLVW, OPC_VPSRLVD, OPC_VPSRLVQ
     };
     static int const sarv_insn[4] = {
-        /* TODO: AVX512 adds support for MO_16, MO_64.  */
-        OPC_UD2, OPC_UD2, OPC_VPSRAVD, OPC_UD2
+        OPC_UD2, OPC_VPSRAVW, OPC_VPSRAVD, OPC_VPSRAVQ
     };
     static int const shls_insn[4] = {
         OPC_UD2, OPC_PSLLW, OPC_PSLLD, OPC_PSLLQ
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
 
     case INDEX_op_shlv_vec:
     case INDEX_op_shrv_vec:
-        return have_avx2 && vece >= MO_32;
+        switch (vece) {
+        case MO_16:
+            return have_avx512bw;
+        case MO_32:
+        case MO_64:
+            return have_avx2;
+        }
+        return 0;
     case INDEX_op_sarv_vec:
-        return have_avx2 && vece == MO_32;
+        switch (vece) {
+        case MO_16:
+            return have_avx512bw;
+        case MO_32:
+            return have_avx2;
+        case MO_64:
+            return have_avx512vl;
+        }
+        return 0;
     case INDEX_op_rotlv_vec:
     case INDEX_op_rotrv_vec:
         return have_avx2 && vece >= MO_32 ? -1 : 0;
-- 
2.25.1

AVX512VL has VPSRAQ.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

AVX512 has VPSRAQ with immediate operand, in the same form as
with AVX, but requires EVEX encoding and W1.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_shli_vec:
+        insn = shift_imm_insn[vece];
         sub = 6;
         goto gen_shift;
     case INDEX_op_shri_vec:
+        insn = shift_imm_insn[vece];
         sub = 2;
         goto gen_shift;
     case INDEX_op_sari_vec:
-        tcg_debug_assert(vece != MO_64);
+        if (vece == MO_64) {
+            insn = OPC_PSHIFTD_Ib | P_VEXW | P_EVEX;
+        } else {
+            insn = shift_imm_insn[vece];
+        }
         sub = 4;
     gen_shift:
         tcg_debug_assert(vece != MO_8);
-        insn = shift_imm_insn[vece];
         if (type == TCG_TYPE_V256) {
             insn |= P_VEXL;
         }
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
         return vece == MO_8 ? -1 : 1;
 
     case INDEX_op_sari_vec:
-        /* We must expand the operation for MO_8.  */
-        if (vece == MO_8) {
+        switch (vece) {
+        case MO_8:
             return -1;
-        }
-        /* We can emulate this for MO_64, but it does not pay off
-           unless we're producing at least 4 values.  */
-        if (vece == MO_64) {
+        case MO_16:
+        case MO_32:
+            return 1;
+        case MO_64:
+            if (have_avx512vl) {
+                return 1;
+            }
+            /*
+             * We can emulate this for MO_64, but it does not pay off
+             * unless we're producing at least 4 values.
+             */
             return type >= TCG_TYPE_V256 ? -1 : 0;
         }
-        return 1;
+        return 0;
 
     case INDEX_op_shls_vec:
     case INDEX_op_shrs_vec:
-- 
2.25.1

AVX512VL has VPROLD and VPROLQ, layered onto the same
opcode as PSHIFTD, but requires EVEX encoding and W1.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |  2 +-
 tcg/i386/tcg-target.c.inc | 15 +++++++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
 #define TCG_TARGET_HAS_not_vec          0
 #define TCG_TARGET_HAS_neg_vec          0
 #define TCG_TARGET_HAS_abs_vec          1
-#define TCG_TARGET_HAS_roti_vec         0
+#define TCG_TARGET_HAS_roti_vec         have_avx512vl
 #define TCG_TARGET_HAS_rots_vec         0
 #define TCG_TARGET_HAS_rotv_vec         0
 #define TCG_TARGET_HAS_shi_vec          1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_PSHUFLW     (0x70 | P_EXT | P_SIMDF2)
 #define OPC_PSHUFHW     (0x70 | P_EXT | P_SIMDF3)
 #define OPC_PSHIFTW_Ib  (0x71 | P_EXT | P_DATA16) /* /2 /6 /4 */
-#define OPC_PSHIFTD_Ib  (0x72 | P_EXT | P_DATA16) /* /2 /6 /4 */
+#define OPC_PSHIFTD_Ib  (0x72 | P_EXT | P_DATA16) /* /1 /2 /6 /4 */
 #define OPC_PSHIFTQ_Ib  (0x73 | P_EXT | P_DATA16) /* /2 /6 /4 */
 #define OPC_PSLLW       (0xf1 | P_EXT | P_DATA16)
 #define OPC_PSLLD       (0xf2 | P_EXT | P_DATA16)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
             insn = shift_imm_insn[vece];
         }
         sub = 4;
+        goto gen_shift;
+    case INDEX_op_rotli_vec:
+        insn = OPC_PSHIFTD_Ib | P_EVEX;  /* VPROL[DQ] */
+        if (vece == MO_64) {
+            insn |= P_VEXW;
+        }
+        sub = 1;
+        goto gen_shift;
     gen_shift:
         tcg_debug_assert(vece != MO_8);
         if (type == TCG_TYPE_V256) {
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_shli_vec:
     case INDEX_op_shri_vec:
     case INDEX_op_sari_vec:
+    case INDEX_op_rotli_vec:
     case INDEX_op_x86_psrldq_vec:
         return C_O1_I1(x, x);
 
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_xor_vec:
     case INDEX_op_andc_vec:
         return 1;
-    case INDEX_op_rotli_vec:
     case INDEX_op_cmp_vec:
     case INDEX_op_cmpsel_vec:
         return -1;
 
+    case INDEX_op_rotli_vec:
+        return have_avx512vl && vece >= MO_32 ? 1 : -1;
+
     case INDEX_op_shli_vec:
     case INDEX_op_shri_vec:
         /* We must expand the operation for MO_8.  */
-- 
2.25.1

AVX512VL has VPROLVD and VPRORVQ.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |  2 +-
 tcg/i386/tcg-target.c.inc | 25 ++++++++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
 #define TCG_TARGET_HAS_abs_vec          1
 #define TCG_TARGET_HAS_roti_vec         have_avx512vl
 #define TCG_TARGET_HAS_rots_vec         0
-#define TCG_TARGET_HAS_rotv_vec         0
+#define TCG_TARGET_HAS_rotv_vec         have_avx512vl
 #define TCG_TARGET_HAS_shi_vec          1
 #define TCG_TARGET_HAS_shs_vec          1
 #define TCG_TARGET_HAS_shv_vec          have_avx2
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
 #define OPC_VPERMQ      (0x00 | P_EXT3A | P_DATA16 | P_VEXW)
 #define OPC_VPERM2I128  (0x46 | P_EXT3A | P_DATA16 | P_VEXL)
+#define OPC_VPROLVD     (0x15 | P_EXT38 | P_DATA16 | P_EVEX)
+#define OPC_VPROLVQ     (0x15 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPRORVD     (0x14 | P_EXT38 | P_DATA16 | P_EVEX)
+#define OPC_VPRORVQ     (0x14 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
 #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     static int const umax_insn[4] = {
         OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
     };
+    static int const rotlv_insn[4] = {
+        OPC_UD2, OPC_UD2, OPC_VPROLVD, OPC_VPROLVQ
+    };
+    static int const rotrv_insn[4] = {
+        OPC_UD2, OPC_UD2, OPC_VPRORVD, OPC_VPRORVQ
+    };
     static int const shlv_insn[4] = {
         OPC_UD2, OPC_VPSLLVW, OPC_VPSLLVD, OPC_VPSLLVQ
     };
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_sarv_vec:
         insn = sarv_insn[vece];
         goto gen_simd;
+    case INDEX_op_rotlv_vec:
+        insn = rotlv_insn[vece];
+        goto gen_simd;
+    case INDEX_op_rotrv_vec:
+        insn = rotrv_insn[vece];
+        goto gen_simd;
     case INDEX_op_shls_vec:
         insn = shls_insn[vece];
         goto gen_simd;
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_shlv_vec:
     case INDEX_op_shrv_vec:
     case INDEX_op_sarv_vec:
+    case INDEX_op_rotlv_vec:
+    case INDEX_op_rotrv_vec:
     case INDEX_op_shls_vec:
     case INDEX_op_shrs_vec:
     case INDEX_op_sars_vec:
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
         return 0;
     case INDEX_op_rotlv_vec:
     case INDEX_op_rotrv_vec:
-        return have_avx2 && vece >= MO_32 ? -1 : 0;
+        switch (vece) {
+        case MO_32:
+        case MO_64:
+            return have_avx512vl ? 1 : have_avx2 ? -1 : 0;
+        }
+        return 0;
 
     case INDEX_op_mul_vec:
         if (vece == MO_8) {
-- 
2.25.1

We will use VPSHLD, VPSHLDV and VPSHRDV for 16-bit rotates.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h |  1 +
 tcg/i386/tcg-target.opc.h     |  3 +++
 tcg/i386/tcg-target.c.inc     | 38 +++++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@ C_O1_I2(r, r, rI)
 C_O1_I2(x, x, x)
 C_N1_I2(r, r, r)
 C_N1_I2(r, r, rW)
+C_O1_I3(x, 0, x, x)
 C_O1_I3(x, x, x, x)
 C_O1_I4(r, r, re, r, 0)
 C_O1_I4(r, r, r, ri, ri)
diff --git a/tcg/i386/tcg-target.opc.h b/tcg/i386/tcg-target.opc.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.opc.h
+++ b/tcg/i386/tcg-target.opc.h
@@ -XXX,XX +XXX,XX @@ DEF(x86_psrldq_vec, 1, 1, 1, IMPLVEC)
 DEF(x86_vperm2i128_vec, 1, 2, 1, IMPLVEC)
 DEF(x86_punpckl_vec, 1, 2, 0, IMPLVEC)
 DEF(x86_punpckh_vec, 1, 2, 0, IMPLVEC)
+DEF(x86_vpshldi_vec, 1, 2, 1, IMPLVEC)
+DEF(x86_vpshldv_vec, 1, 3, 0, IMPLVEC)
+DEF(x86_vpshrdv_vec, 1, 3, 0, IMPLVEC)
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPROLVQ     (0x15 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPRORVD     (0x14 | P_EXT38 | P_DATA16 | P_EVEX)
 #define OPC_VPRORVQ     (0x14 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHLDW     (0x70 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHLDD     (0x71 | P_EXT3A | P_DATA16 | P_EVEX)
+#define OPC_VPSHLDQ     (0x71 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHLDVW    (0x70 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHLDVD    (0x71 | P_EXT38 | P_DATA16 | P_EVEX)
+#define OPC_VPSHLDVQ    (0x71 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHRDVW    (0x72 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
+#define OPC_VPSHRDVD    (0x73 | P_EXT38 | P_DATA16 | P_EVEX)
+#define OPC_VPSHRDVQ    (0x73 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSLLVW     (0x12 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSLLVD     (0x47 | P_EXT38 | P_DATA16)
 #define OPC_VPSLLVQ     (0x47 | P_EXT38 | P_DATA16 | P_VEXW)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     static int const sars_insn[4] = {
         OPC_UD2, OPC_PSRAW, OPC_PSRAD, OPC_VPSRAQ
     };
+    static int const vpshldi_insn[4] = {
+        OPC_UD2, OPC_VPSHLDW, OPC_VPSHLDD, OPC_VPSHLDQ
+    };
+    static int const vpshldv_insn[4] = {
+        OPC_UD2, OPC_VPSHLDVW, OPC_VPSHLDVD, OPC_VPSHLDVQ
+    };
+    static int const vpshrdv_insn[4] = {
+        OPC_UD2, OPC_VPSHRDVW, OPC_VPSHRDVD, OPC_VPSHRDVQ
+    };
     static int const abs_insn[4] = {
         /* TODO: AVX512 adds support for MO_64.  */
         OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_UD2
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_x86_packus_vec:
         insn = packus_insn[vece];
         goto gen_simd;
+    case INDEX_op_x86_vpshldv_vec:
+        insn = vpshldv_insn[vece];
+        a1 = a2;
+        a2 = args[3];
+        goto gen_simd;
+    case INDEX_op_x86_vpshrdv_vec:
+        insn = vpshrdv_insn[vece];
+        a1 = a2;
+        a2 = args[3];
+        goto gen_simd;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_dup2_vec:
         /* First merge the two 32-bit inputs to a single 64-bit element. */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         insn = OPC_VPERM2I128;
         sub = args[3];
         goto gen_simd_imm8;
+    case INDEX_op_x86_vpshldi_vec:
+        insn = vpshldi_insn[vece];
+        sub = args[3];
+        goto gen_simd_imm8;
     gen_simd_imm8:
+        tcg_debug_assert(insn != OPC_UD2);
         if (type == TCG_TYPE_V256) {
             insn |= P_VEXL;
         }
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_x86_vperm2i128_vec:
     case INDEX_op_x86_punpckl_vec:
     case INDEX_op_x86_punpckh_vec:
+    case INDEX_op_x86_vpshldi_vec:
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_dup2_vec:
 #endif
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_x86_psrldq_vec:
         return C_O1_I1(x, x);
 
+    case INDEX_op_x86_vpshldv_vec:
+    case INDEX_op_x86_vpshrdv_vec:
+        return C_O1_I3(x, 0, x, x);
+
     case INDEX_op_x86_vpblendvb_vec:
         return C_O1_I3(x, x, x, x);
 
-- 
2.25.1

While there are no specific 16-bit rotate instructions, there
are double-word shifts, which can perform the same operation.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_rotlv_vec:
     case INDEX_op_rotrv_vec:
         switch (vece) {
+        case MO_16:
+            return have_avx512vbmi2 ? -1 : 0;
         case MO_32:
         case MO_64:
             return have_avx512vl ? 1 : have_avx2 ? -1 : 0;
@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotli(TCGType type, unsigned vece,
         return;
     }
 
+    if (have_avx512vbmi2) {
+        vec_gen_4(INDEX_op_x86_vpshldi_vec, type, vece,
+                  tcgv_vec_arg(v0), tcgv_vec_arg(v1), tcgv_vec_arg(v1), imm);
+        return;
+    }
+
     t = tcg_temp_new_vec(type);
     tcg_gen_shli_vec(vece, t, v1, imm);
     tcg_gen_shri_vec(vece, v0, v1, (8 << vece) - imm);
@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotls(TCGType type, unsigned vece,
 static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
                             TCGv_vec v1, TCGv_vec sh, bool right)
 {
-    TCGv_vec t = tcg_temp_new_vec(type);
+    TCGv_vec t;
 
+    if (have_avx512vbmi2) {
+        vec_gen_4(right ? INDEX_op_x86_vpshrdv_vec : INDEX_op_x86_vpshldv_vec,
+                  type, vece, tcgv_vec_arg(v0), tcgv_vec_arg(v1),
+                  tcgv_vec_arg(v1), tcgv_vec_arg(sh));
+        return;
+    }
+
+    t = tcg_temp_new_vec(type);
     tcg_gen_dupi_vec(vece, t, 8 << vece);
     tcg_gen_sub_vec(vece, t, t, sh);
     if (right) {
-- 
2.25.1

Expand 32-bit and 64-bit scalar rotate with VPRO[LR]V;
expand 16-bit scalar rotate with VPSHLDV.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 49 +++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotli(TCGType type, unsigned vece,
     tcg_temp_free_vec(t);
 }
 
-static void expand_vec_rotls(TCGType type, unsigned vece,
-                             TCGv_vec v0, TCGv_vec v1, TCGv_i32 lsh)
-{
-    TCGv_i32 rsh;
-    TCGv_vec t;
-
-    tcg_debug_assert(vece != MO_8);
-
-    t = tcg_temp_new_vec(type);
-    rsh = tcg_temp_new_i32();
-
-    tcg_gen_neg_i32(rsh, lsh);
-    tcg_gen_andi_i32(rsh, rsh, (8 << vece) - 1);
-    tcg_gen_shls_vec(vece, t, v1, lsh);
-    tcg_gen_shrs_vec(vece, v0, v1, rsh);
-    tcg_gen_or_vec(vece, v0, v0, t);
-    tcg_temp_free_vec(t);
-    tcg_temp_free_i32(rsh);
-}
-
 static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
                             TCGv_vec v1, TCGv_vec sh, bool right)
 {
@@ -XXX,XX +XXX,XX @@ static void expand_vec_rotv(TCGType type, unsigned vece, TCGv_vec v0,
     tcg_temp_free_vec(t);
 }
 
+static void expand_vec_rotls(TCGType type, unsigned vece,
+                             TCGv_vec v0, TCGv_vec v1, TCGv_i32 lsh)
+{
+    TCGv_vec t = tcg_temp_new_vec(type);
+
+    tcg_debug_assert(vece != MO_8);
+
+    if (vece >= MO_32 ? have_avx512vl : have_avx512vbmi2) {
+        tcg_gen_dup_i32_vec(vece, t, lsh);
+        if (vece >= MO_32) {
+            tcg_gen_rotlv_vec(vece, v0, v1, t);
+        } else {
+            expand_vec_rotv(type, vece, v0, v1, t, false);
+        }
+    } else {
+        TCGv_i32 rsh = tcg_temp_new_i32();
+
+        tcg_gen_neg_i32(rsh, lsh);
+        tcg_gen_andi_i32(rsh, rsh, (8 << vece) - 1);
+        tcg_gen_shls_vec(vece, t, v1, lsh);
+        tcg_gen_shrs_vec(vece, v0, v1, rsh);
+        tcg_gen_or_vec(vece, v0, v0, t);
+
+        tcg_temp_free_i32(rsh);
+    }
+
+    tcg_temp_free_vec(t);
+}
+
 static void expand_vec_mul(TCGType type, unsigned vece,
                            TCGv_vec v0, TCGv_vec v1, TCGv_vec v2)
 {
-- 
2.25.1

AVX512VL has VPABSQ, VPMAXSQ, VPMAXUQ, VPMINSQ, VPMINUQ.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_PABSB       (0x1c | P_EXT38 | P_DATA16)
 #define OPC_PABSW       (0x1d | P_EXT38 | P_DATA16)
 #define OPC_PABSD       (0x1e | P_EXT38 | P_DATA16)
+#define OPC_VPABSQ      (0x1f | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_PACKSSDW    (0x6b | P_EXT | P_DATA16)
 #define OPC_PACKSSWB    (0x63 | P_EXT | P_DATA16)
 #define OPC_PACKUSDW    (0x2b | P_EXT38 | P_DATA16)
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_PMAXSB      (0x3c | P_EXT38 | P_DATA16)
 #define OPC_PMAXSW      (0xee | P_EXT | P_DATA16)
 #define OPC_PMAXSD      (0x3d | P_EXT38 | P_DATA16)
+#define OPC_VPMAXSQ     (0x3d | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_PMAXUB      (0xde | P_EXT | P_DATA16)
 #define OPC_PMAXUW      (0x3e | P_EXT38 | P_DATA16)
 #define OPC_PMAXUD      (0x3f | P_EXT38 | P_DATA16)
+#define OPC_VPMAXUQ     (0x3f | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_PMINSB      (0x38 | P_EXT38 | P_DATA16)
 #define OPC_PMINSW      (0xea | P_EXT | P_DATA16)
 #define OPC_PMINSD      (0x39 | P_EXT38 | P_DATA16)
+#define OPC_VPMINSQ     (0x39 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_PMINUB      (0xda | P_EXT | P_DATA16)
 #define OPC_PMINUW      (0x3a | P_EXT38 | P_DATA16)
 #define OPC_PMINUD      (0x3b | P_EXT38 | P_DATA16)
+#define OPC_VPMINUQ     (0x3b | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_PMOVSXBW    (0x20 | P_EXT38 | P_DATA16)
 #define OPC_PMOVSXWD    (0x23 | P_EXT38 | P_DATA16)
 #define OPC_PMOVSXDQ    (0x25 | P_EXT38 | P_DATA16)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         OPC_PACKUSWB, OPC_PACKUSDW, OPC_UD2, OPC_UD2
     };
     static int const smin_insn[4] = {
-        OPC_PMINSB, OPC_PMINSW, OPC_PMINSD, OPC_UD2
+        OPC_PMINSB, OPC_PMINSW, OPC_PMINSD, OPC_VPMINSQ
     };
     static int const smax_insn[4] = {
-        OPC_PMAXSB, OPC_PMAXSW, OPC_PMAXSD, OPC_UD2
+        OPC_PMAXSB, OPC_PMAXSW, OPC_PMAXSD, OPC_VPMAXSQ
     };
     static int const umin_insn[4] = {
-        OPC_PMINUB, OPC_PMINUW, OPC_PMINUD, OPC_UD2
+        OPC_PMINUB, OPC_PMINUW, OPC_PMINUD, OPC_VPMINUQ
     };
     static int const umax_insn[4] = {
-        OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_UD2
+        OPC_PMAXUB, OPC_PMAXUW, OPC_PMAXUD, OPC_VPMAXUQ
     };
     static int const rotlv_insn[4] = {
         OPC_UD2, OPC_UD2, OPC_VPROLVD, OPC_VPROLVQ
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         OPC_UD2, OPC_VPSHRDVW, OPC_VPSHRDVD, OPC_VPSHRDVQ
     };
     static int const abs_insn[4] = {
-        /* TODO: AVX512 adds support for MO_64.  */
-        OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_UD2
+        OPC_PABSB, OPC_PABSW, OPC_PABSD, OPC_VPABSQ
     };
 
     TCGType type = vecl + TCG_TYPE_V64;
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_umin_vec:
     case INDEX_op_umax_vec:
     case INDEX_op_abs_vec:
-        return vece <= MO_32;
+        return vece <= MO_32 || have_avx512vl;
 
     default:
         return 0;
-- 
2.25.1

AVX512DQ has VPMULLQ.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

AVX512VL has a general ternary logic operation, VPTERNLOGQ,
which can implement NOT, ORC, NAND, NOR, EQV.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     | 10 +++++-----
 tcg/i386/tcg-target.c.inc | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -XXX,XX +XXX,XX @@ extern bool have_movbe;
 #define TCG_TARGET_HAS_v256             have_avx2
 
 #define TCG_TARGET_HAS_andc_vec         1
-#define TCG_TARGET_HAS_orc_vec          0
-#define TCG_TARGET_HAS_nand_vec         0
-#define TCG_TARGET_HAS_nor_vec          0
-#define TCG_TARGET_HAS_eqv_vec          0
-#define TCG_TARGET_HAS_not_vec          0
+#define TCG_TARGET_HAS_orc_vec          have_avx512vl
+#define TCG_TARGET_HAS_nand_vec         have_avx512vl
+#define TCG_TARGET_HAS_nor_vec          have_avx512vl
+#define TCG_TARGET_HAS_eqv_vec          have_avx512vl
+#define TCG_TARGET_HAS_not_vec          have_avx512vl
 #define TCG_TARGET_HAS_neg_vec          0
 #define TCG_TARGET_HAS_abs_vec          1
 #define TCG_TARGET_HAS_roti_vec         have_avx512vl
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_VPSRLVW     (0x10 | P_EXT38 | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VPSRLVD     (0x45 | P_EXT38 | P_DATA16)
 #define OPC_VPSRLVQ     (0x45 | P_EXT38 | P_DATA16 | P_VEXW)
+#define OPC_VPTERNLOGQ  (0x25 | P_EXT3A | P_DATA16 | P_VEXW | P_EVEX)
 #define OPC_VZEROUPPER  (0x77 | P_EXT)
 #define OPC_XCHG_ax_r32	(0x90)
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         insn = vpshldi_insn[vece];
         sub = args[3];
         goto gen_simd_imm8;
+
+    case INDEX_op_not_vec:
+        insn = OPC_VPTERNLOGQ;
+        a2 = a1;
+        sub = 0x33; /* !B */
+        goto gen_simd_imm8;
+    case INDEX_op_nor_vec:
+        insn = OPC_VPTERNLOGQ;
+        sub = 0x11; /* norCB */
+        goto gen_simd_imm8;
+    case INDEX_op_nand_vec:
+        insn = OPC_VPTERNLOGQ;
+        sub = 0x77; /* nandCB */
+        goto gen_simd_imm8;
+    case INDEX_op_eqv_vec:
+        insn = OPC_VPTERNLOGQ;
+        sub = 0x99; /* xnorCB */
+        goto gen_simd_imm8;
+    case INDEX_op_orc_vec:
+        insn = OPC_VPTERNLOGQ;
+        sub = 0xdd; /* orB!C */
+        goto gen_simd_imm8;
+
     gen_simd_imm8:
         tcg_debug_assert(insn != OPC_UD2);
         if (type == TCG_TYPE_V256) {
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_or_vec:
     case INDEX_op_xor_vec:
     case INDEX_op_andc_vec:
+    case INDEX_op_orc_vec:
+    case INDEX_op_nand_vec:
+    case INDEX_op_nor_vec:
+    case INDEX_op_eqv_vec:
     case INDEX_op_ssadd_vec:
     case INDEX_op_usadd_vec:
     case INDEX_op_sssub_vec:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_abs_vec:
     case INDEX_op_dup_vec:
+    case INDEX_op_not_vec:
     case INDEX_op_shli_vec:
     case INDEX_op_shri_vec:
     case INDEX_op_sari_vec:
@@ -XXX,XX +XXX,XX @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     case INDEX_op_or_vec:
     case INDEX_op_xor_vec:
     case INDEX_op_andc_vec:
+    case INDEX_op_orc_vec:
+    case INDEX_op_nand_vec:
+    case INDEX_op_nor_vec:
+    case INDEX_op_eqv_vec:
+    case INDEX_op_not_vec:
         return 1;
     case INDEX_op_cmp_vec:
     case INDEX_op_cmpsel_vec:
-- 
2.25.1

The general ternary logic operation can implement BITSEL.
Funnel the 4-operand operation into three variants of the
3-operand instruction, depending on input operand overlap.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.h     |  2 +-
 tcg/i386/tcg-target.c.inc | 20 +++++++++++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

Define as 0 for all tcg hosts.  Put this in a separate header,
because we'll want this in places that do not ordinarily have
access to all of tcg/tcg.h.

Reviewed-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-sa32.h     | 1 +
 tcg/arm/tcg-target-sa32.h         | 1 +
 tcg/i386/tcg-target-sa32.h        | 1 +
 tcg/loongarch64/tcg-target-sa32.h | 1 +
 tcg/mips/tcg-target-sa32.h        | 1 +
 tcg/ppc/tcg-target-sa32.h         | 1 +
 tcg/riscv/tcg-target-sa32.h       | 1 +
 tcg/s390x/tcg-target-sa32.h       | 1 +
 tcg/sparc/tcg-target-sa32.h       | 1 +
 tcg/tci/tcg-target-sa32.h         | 1 +
 tcg/tcg.c                         | 4 ++++
 11 files changed, 14 insertions(+)
 create mode 100644 tcg/aarch64/tcg-target-sa32.h
 create mode 100644 tcg/arm/tcg-target-sa32.h
 create mode 100644 tcg/i386/tcg-target-sa32.h
 create mode 100644 tcg/loongarch64/tcg-target-sa32.h
 create mode 100644 tcg/mips/tcg-target-sa32.h
 create mode 100644 tcg/ppc/tcg-target-sa32.h
 create mode 100644 tcg/riscv/tcg-target-sa32.h
 create mode 100644 tcg/s390x/tcg-target-sa32.h
 create mode 100644 tcg/sparc/tcg-target-sa32.h
 create mode 100644 tcg/tci/tcg-target-sa32.h

diff --git a/tcg/aarch64/tcg-target-sa32.h b/tcg/aarch64/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/aarch64/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/arm/tcg-target-sa32.h b/tcg/arm/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/arm/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/i386/tcg-target-sa32.h b/tcg/i386/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/i386/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/loongarch64/tcg-target-sa32.h b/tcg/loongarch64/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/loongarch64/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/mips/tcg-target-sa32.h b/tcg/mips/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/mips/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/ppc/tcg-target-sa32.h b/tcg/ppc/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/ppc/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/riscv/tcg-target-sa32.h b/tcg/riscv/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/riscv/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/s390x/tcg-target-sa32.h b/tcg/s390x/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/s390x/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/sparc/tcg-target-sa32.h b/tcg/sparc/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/sparc/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/tci/tcg-target-sa32.h b/tcg/tci/tcg-target-sa32.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tcg/tci/tcg-target-sa32.h
@@ -0,0 +1 @@
+#define TCG_TARGET_SIGNED_ADDR32 0
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "tcg/tcg-ldst.h"
 #include "tcg-internal.h"
+#include "tcg-target-sa32.h"
+
+/* Sanity check for TCG_TARGET_SIGNED_ADDR32. */
+QEMU_BUILD_BUG_ON(TCG_TARGET_REG_BITS == 32 && TCG_TARGET_SIGNED_ADDR32);
 
 #ifdef CONFIG_TCG_INTERPRETER
 #include <ffi.h>
-- 
2.25.1

Create a new function to combine a CPUTLBEntry addend
with the guest address to form a host address.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
     return fast->mask + (1 << CPU_TLB_ENTRY_BITS);
 }
 
+static inline uintptr_t g2h_tlbe(const CPUTLBEntry *tlb, target_ulong gaddr)
+{
+    return tlb->addend + (uintptr_t)gaddr;
+}
+
 static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
                              size_t max_entries)
 {
@@ -XXX,XX +XXX,XX @@ static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
 
     if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
                  TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
-        addr &= TARGET_PAGE_MASK;
-        addr += tlb_entry->addend;
+        addr = g2h_tlbe(tlb_entry, addr & TARGET_PAGE_MASK);
         if ((addr - start) < length) {
 #if TCG_OVERSIZED_GUEST
             tlb_entry->addr_write |= TLB_NOTDIRTY;
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
         return -1;
     }
 
-    p = (void *)((uintptr_t)addr + entry->addend);
+    p = (void *)g2h_tlbe(entry, addr);
     if (hostp) {
         *hostp = p;
     }
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     }
 
     /* Everything else is RAM. */
-    *phost = (void *)((uintptr_t)addr + entry->addend);
+    *phost = (void *)g2h_tlbe(entry, addr);
     return flags;
 }
 
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
             data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
         } else {
             data->is_io = false;
-            data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
+            data->v.ram.hostaddr = (void *)g2h_tlbe(tlbe, addr);
         }
         return true;
     } else {
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
         goto stop_the_world;
     }
 
-    hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
+    hostaddr = (void *)g2h_tlbe(tlbe, addr);
 
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
         notdirty_write(env_cpu(env), addr, size,
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
                             access_type, op ^ (need_swap * MO_BSWAP));
         }
 
-        haddr = (void *)((uintptr_t)addr + entry->addend);
+        haddr = (void *)g2h_tlbe(entry, addr);
 
         /*
          * Keep these two load_memop separate to ensure that the compiler
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
         return res & MAKE_64BIT_MASK(0, size * 8);
     }
 
-    haddr = (void *)((uintptr_t)addr + entry->addend);
+    haddr = (void *)g2h_tlbe(entry, addr);
     return load_memop(haddr, op);
 }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
         }
 
-        haddr = (void *)((uintptr_t)addr + entry->addend);
+        haddr = (void *)g2h_tlbe(entry, addr);
 
         /*
          * Keep these two store_memop separate to ensure that the compiler
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
         return;
     }
 
-    haddr = (void *)((uintptr_t)addr + entry->addend);
+    haddr = (void *)g2h_tlbe(entry, addr);
     store_memop(haddr, val, op);
 }
 
-- 
2.25.1

When TCG_TARGET_SIGNED_ADDR32 is set, adjust the tlb addend to
allow the 32-bit guest address to be sign extended within the
64-bit host register instead of zero extended.

This will simplify tcg hosts like MIPS, RISC-V, and LoongArch,
which naturally sign-extend 32-bit values, in contrast to x86_64
and AArch64 which zero-extend them.

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/plugin-memory.h"
 #endif
 #include "tcg/tcg-ldst.h"
+#include "tcg-target-sa32.h"
 
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
@@ -XXX,XX +XXX,XX @@ static inline size_t sizeof_tlb(CPUTLBDescFast *fast)
 
 static inline uintptr_t g2h_tlbe(const CPUTLBEntry *tlb, target_ulong gaddr)
 {
+    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
+        return tlb->addend + (int32_t)gaddr;
+    }
     return tlb->addend + (uintptr_t)gaddr;
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     desc->iotlb[index].attrs = attrs;
 
     /* Now calculate the new entry */
-    tn.addend = addend - vaddr_page;
+
+    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
+        tn.addend = addend - (int32_t)vaddr_page;
+    } else {
+        tn.addend = addend - vaddr_page;
+    }
+
     if (prot & PAGE_READ) {
         tn.addr_read = address;
         if (wp_flags & BP_MEM_READ) {
-- 
2.25.1

While the host may prefer to treat 32-bit addresses as signed,
there are edge cases of guests that cannot be implemented with
addresses 0x7fff_ffff and 0x8000_0000 being non-consecutive.

Therefore, default to guest_base_signed_addr32 false, and allow
probe_guest_base to determine whether it is possible to set it
to true.  A tcg backend which sets TCG_TARGET_SIGNED_ADDR32 will
have to cope with either setting for user-only.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h  | 16 ++++++++++++++++
 include/exec/cpu_ldst.h |  3 ++-
 bsd-user/main.c         |  4 ++++
 linux-user/main.c       |  3 +++
 4 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline void tswap64s(uint64_t *s)
 
 #if defined(CONFIG_USER_ONLY)
 #include "exec/user/abitypes.h"
+#include "tcg-target-sa32.h"
 
 /* On some host systems the guest address space is reserved on the host.
  * This allows the guest address space to be offset to a convenient location.
@@ -XXX,XX +XXX,XX @@ extern uintptr_t guest_base;
 extern bool have_guest_base;
 extern unsigned long reserved_va;
 
+#if TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32
+extern bool guest_base_signed_addr32;
+#else
+#define guest_base_signed_addr32  false
+#endif
+
+static inline void set_guest_base_signed_addr32(void)
+{
+#ifdef guest_base_signed_addr32
+    qemu_build_not_reached();
+#else
+    guest_base_signed_addr32 = true;
+#endif
+}
+
 /*
  * Limit the guest addresses as best we can.
  *
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -XXX,XX +XXX,XX @@ static inline abi_ptr cpu_untagged_addr(CPUState *cs, abi_ptr x)
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
 static inline void *g2h_untagged(abi_ptr x)
 {
-    return (void *)((uintptr_t)(x) + guest_base);
+    uintptr_t hx = guest_base_signed_addr32 ? (int32_t)x : (uintptr_t)x;
+    return (void *)(guest_base + hx);
 }
 
 static inline void *g2h(CPUState *cs, abi_ptr x)
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
 int singlestep;
 uintptr_t guest_base;
 bool have_guest_base;
+#ifndef guest_base_signed_addr32
+bool guest_base_signed_addr32;
+#endif
+
 /*
  * When running 32-on-64 we should make sure we can fit all of the possible
  * guest address space into a contiguous chunk of virtual host memory.
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ static const char *seed_optarg;
 unsigned long mmap_min_addr;
 uintptr_t guest_base;
 bool have_guest_base;
+#ifndef guest_base_signed_addr32
+bool guest_base_signed_addr32;
+#endif
 
 /*
  * Used to implement backwards-compatibility for the `-strace`, and
-- 
2.25.1

When using reserved_va, which is the default for a 64-bit host
and a 32-bit guest, set guest_base_signed_addr32 if requested
by TCG_TARGET_SIGNED_ADDR32, and the executable layout allows.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h |  4 ---
 linux-user/elfload.c   | 62 ++++++++++++++++++++++++++++++++++--------
 2 files changed, 50 insertions(+), 16 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ extern const TargetPageBits target_page;
 #define PAGE_RESET     0x0040
 /* For linux-user, indicates that the page is MAP_ANON. */
 #define PAGE_ANON      0x0080
-
-#if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY)
-/* FIXME: Code that sets/uses this is broken and needs to go away.  */
 #define PAGE_RESERVED  0x0100
-#endif
 /* Target-specific bits that will be used via page_get_flags().  */
 #define PAGE_TARGET_1  0x0200
 #define PAGE_TARGET_2  0x0400
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static void pgb_dynamic(const char *image_name, long align)
 static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
                             abi_ulong guest_hiaddr, long align)
 {
-    int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
+    int flags = (MAP_ANONYMOUS | MAP_PRIVATE |
+                 MAP_NORESERVE | MAP_FIXED_NOREPLACE);
+    unsigned long local_rva = reserved_va;
+    bool protect_wrap = false;
     void *addr, *test;
 
-    if (guest_hiaddr > reserved_va) {
+    if (guest_hiaddr > local_rva) {
         error_report("%s: requires more than reserved virtual "
                      "address space (0x%" PRIx64 " > 0x%lx)",
-                     image_name, (uint64_t)guest_hiaddr, reserved_va);
+                     image_name, (uint64_t)guest_hiaddr, local_rva);
         exit(EXIT_FAILURE);
     }
 
-    /* Widen the "image" to the entire reserved address space. */
-    pgb_static(image_name, 0, reserved_va, align);
+    if (TCG_TARGET_SIGNED_ADDR32 && TARGET_LONG_BITS == 32) {
+        if (guest_loaddr < 0x80000000u && guest_hiaddr > 0x80000000u) {
+            /*
+             * The executable itself wraps on signed addresses.
+             * Without per-page translation, we must keep the
+             * guest address 0x7fff_ffff adjacent to 0x8000_0000
+             * consecutive in host memory: unsigned addresses.
+             */
+        } else {
+            set_guest_base_signed_addr32();
+            if (local_rva <= 0x80000000u) {
+                /* No guest addresses are "negative": win! */
+            } else {
+                /* Begin by allocating the entire address space. */
+                local_rva = 0xfffffffful + 1;
+                protect_wrap = true;
+            }
+        }
+    }
 
-    /* osdep.h defines this as 0 if it's missing */
-    flags |= MAP_FIXED_NOREPLACE;
+    /* Widen the "image" to the entire reserved address space. */
+    pgb_static(image_name, 0, local_rva, align);
+    assert(guest_base != 0);
 
     /* Reserve the memory on the host. */
-    assert(guest_base != 0);
     test = g2h_untagged(0);
-    addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
+    addr = mmap(test, local_rva, PROT_NONE, flags, -1, 0);
     if (addr == MAP_FAILED || addr != test) {
+        /*
+         * If protect_wrap, we could try again with the original reserved_va
+         * setting, but the edge case of low ulimit vm setting on a 64-bit
+         * host is probably useless.
+         */
         error_report("Unable to reserve 0x%lx bytes of virtual address "
-                     "space at %p (%s) for use as guest address space (check your"
-                     "virtual memory ulimit setting, min_mmap_addr or reserve less "
-                     "using -R option)", reserved_va, test, strerror(errno));
+                     "space at %p (%s) for use as guest address space "
+                     "(check your virtual memory ulimit setting, "
+                     "min_mmap_addr or reserve less using -R option)",
+                     local_rva, test, strerror(errno));
         exit(EXIT_FAILURE);
     }
 
+    if (protect_wrap) {
+        /*
+         * Prevent the page just before 0x80000000 from being allocated.
+         * This prevents a single guest object/allocation from crossing
+         * the signed wrap, and thus being discontiguous in host memory.
+         */
+        page_set_flags(0x7fffffff & TARGET_PAGE_MASK, 0x80000000u,
+                       PAGE_RESERVED);
+        /* Adjust guest_base so that 0 is in the middle of the reservation. */
+        guest_base += 0x80000000ul;
+    }
+
     qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %p for %lu bytes\n",
                   __func__, addr, reserved_va);
 }
-- 
2.25.1

AArch64 has both sign and zero-extending addressing modes, which
means that either treatment of guest addresses is equally efficient.
Enabling this for AArch64 gives us testing of the feature in CI.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-sa32.h |  8 +++-
 tcg/aarch64/tcg-target.c.inc  | 81 ++++++++++++++++++++++++-----------
 2 files changed, 64 insertions(+), 25 deletions(-)

diff --git a/tcg/aarch64/tcg-target-sa32.h b/tcg/aarch64/tcg-target-sa32.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target-sa32.h
+++ b/tcg/aarch64/tcg-target-sa32.h
@@ -1 +1,7 @@
-#define TCG_TARGET_SIGNED_ADDR32 0
+/*
+ * AArch64 has both SXTW and UXTW addressing modes, which means that
+ * it is agnostic to how guest addresses should be represented.
+ * Because aarch64 is more common than the other hosts that will
+ * want to use this feature, enable it for continuous testing.
+ */
+#define TCG_TARGET_SIGNED_ADDR32 1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ typedef enum {
     LDST_LD_S_W = 3,  /* load and sign-extend into Wt */
 } AArch64LdstType;
 
+/*
+ * See aarch64/instrs/extendreg/DecodeRegExtend
+ * But note that option<1> == 0 is UNDEFINED for LDR/STR.
+ */
+typedef enum {
+    LDST_EXT_UXTW = 2,  /* zero-extend from uint32_t */
+    LDST_EXT_UXTX = 3,  /* zero-extend from uint64_t (i.e. no extension) */
+    LDST_EXT_SXTW = 6,  /* sign-extend from int32_t */
+} AArch64LdstExt;
+
 /* We encode the format of the insn into the beginning of the name, so that
    we can have the preprocessor help "typecheck" the insn vs the output
    function.  Arm didn't provide us with nice names for the formats, so we
@@ -XXX,XX +XXX,XX @@ static void tcg_out_insn_3617(TCGContext *s, AArch64Insn insn, bool q,
 }
 
 static void tcg_out_insn_3310(TCGContext *s, AArch64Insn insn,
-                              TCGReg rd, TCGReg base, TCGType ext,
+                              TCGReg rd, TCGReg base, AArch64LdstExt option,
                               TCGReg regoff)
 {
     /* Note the AArch64Insn constants above are for C3.3.12.  Adjust.  */
     tcg_out32(s, insn | I3312_TO_I3310 | regoff << 16 |
-              0x4000 | ext << 13 | base << 5 | (rd & 0x1f));
+              option << 13 | base << 5 | (rd & 0x1f));
 }
 
 static void tcg_out_insn_3312(TCGContext *s, AArch64Insn insn,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_ldst(TCGContext *s, AArch64Insn insn, TCGReg rd,
 
     /* Worst-case scenario, move offset to temp register, use reg offset.  */
     tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, offset);
-    tcg_out_ldst_r(s, insn, rd, rn, TCG_TYPE_I64, TCG_REG_TMP);
+    tcg_out_ldst_r(s, insn, rd, rn, LDST_EXT_UXTX, TCG_REG_TMP);
 }
 
 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
                                    TCGReg data_r, TCGReg addr_r,
-                                   TCGType otype, TCGReg off_r)
+                                   AArch64LdstExt option, TCGReg off_r)
 {
     switch (memop & MO_SSIZE) {
     case MO_UB:
-        tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_LDRB, data_r, addr_r, option, off_r);
         break;
     case MO_SB:
         tcg_out_ldst_r(s, ext ? I3312_LDRSBX : I3312_LDRSBW,
-                       data_r, addr_r, otype, off_r);
+                       data_r, addr_r, option, off_r);
         break;
     case MO_UW:
-        tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_LDRH, data_r, addr_r, option, off_r);
         break;
     case MO_SW:
         tcg_out_ldst_r(s, (ext ? I3312_LDRSHX : I3312_LDRSHW),
-                       data_r, addr_r, otype, off_r);
+                       data_r, addr_r, option, off_r);
         break;
     case MO_UL:
-        tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_LDRW, data_r, addr_r, option, off_r);
         break;
     case MO_SL:
-        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_LDRSWX, data_r, addr_r, option, off_r);
         break;
     case MO_UQ:
-        tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_LDRX, data_r, addr_r, option, off_r);
         break;
     default:
         tcg_abort();
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp memop, TCGType ext,
 
 static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
                                    TCGReg data_r, TCGReg addr_r,
-                                   TCGType otype, TCGReg off_r)
+                                   AArch64LdstExt option, TCGReg off_r)
 {
     switch (memop & MO_SIZE) {
     case MO_8:
-        tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_STRB, data_r, addr_r, option, off_r);
         break;
     case MO_16:
-        tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_STRH, data_r, addr_r, option, off_r);
         break;
     case MO_32:
-        tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_STRW, data_r, addr_r, option, off_r);
         break;
     case MO_64:
-        tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, otype, off_r);
+        tcg_out_ldst_r(s, I3312_STRX, data_r, addr_r, option, off_r);
         break;
     default:
         tcg_abort();
     }
 }
 
+/*
+ * Bits for the option field of LDR/STR (register),
+ * for application to a guest address.
+ */
+static AArch64LdstExt ldst_ext_option(void)
+{
+#ifdef CONFIG_USER_ONLY
+    bool signed_addr32 = guest_base_signed_addr32;
+#else
+    bool signed_addr32 = TCG_TARGET_SIGNED_ADDR32;
+#endif
+
+    if (TARGET_LONG_BITS == 64) {
+        return LDST_EXT_UXTX;
+    } else if (signed_addr32) {
+        return LDST_EXT_SXTW;
+    } else {
+        return LDST_EXT_UXTW;
+    }
+}
+
 static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
                             MemOpIdx oi, TCGType ext)
 {
     MemOp memop = get_memop(oi);
-    const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
+    AArch64LdstExt option = ldst_ext_option();
 
     /* Byte swapping is left to middle-end expansion. */
     tcg_debug_assert((memop & MO_BSWAP) == 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 
     tcg_out_tlb_read(s, addr_reg, memop, &label_ptr, mem_index, 1);
     tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
-                           TCG_REG_X1, otype, addr_reg);
+                           TCG_REG_X1, option, addr_reg);
     add_qemu_ldst_label(s, true, oi, ext, data_reg, addr_reg,
                         s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     }
     if (USE_GUEST_BASE) {
         tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
-                               TCG_REG_GUEST_BASE, otype, addr_reg);
+                               TCG_REG_GUEST_BASE, option, addr_reg);
     } else {
+        /* This case is always a 64-bit guest with no extension. */
         tcg_out_qemu_ld_direct(s, memop, ext, data_reg,
-                               addr_reg, TCG_TYPE_I64, TCG_REG_XZR);
+                               addr_reg, LDST_EXT_UXTX, TCG_REG_XZR);
     }
 #endif /* CONFIG_SOFTMMU */
 }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
                             MemOpIdx oi)
 {
     MemOp memop = get_memop(oi);
-    const TCGType otype = TARGET_LONG_BITS == 64 ? TCG_TYPE_I64 : TCG_TYPE_I32;
+    AArch64LdstExt option = ldst_ext_option();
 
     /* Byte swapping is left to middle-end expansion. */
     tcg_debug_assert((memop & MO_BSWAP) == 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 
     tcg_out_tlb_read(s, addr_reg, memop, &label_ptr, mem_index, 0);
     tcg_out_qemu_st_direct(s, memop, data_reg,
-                           TCG_REG_X1, otype, addr_reg);
+                           TCG_REG_X1, option, addr_reg);
     add_qemu_ldst_label(s, false, oi, (memop & MO_SIZE)== MO_64,
                         data_reg, addr_reg, s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     }
     if (USE_GUEST_BASE) {
         tcg_out_qemu_st_direct(s, memop, data_reg,
-                               TCG_REG_GUEST_BASE, otype, addr_reg);
+                               TCG_REG_GUEST_BASE, option, addr_reg);
     } else {
+        /* This case is always a 64-bit guest with no extension. */
         tcg_out_qemu_st_direct(s, memop, data_reg,
-                               addr_reg, TCG_TYPE_I64, TCG_REG_XZR);
+                               addr_reg, LDST_EXT_UXTX, TCG_REG_XZR);
     }
 #endif /* CONFIG_SOFTMMU */
 }
-- 
2.25.1

All 32-bit mips operations sign-extend the output, so we are easily
able to keep TCG_TYPE_I32 values sign-extended in host registers.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target-sa32.h |  8 ++++++++
 tcg/mips/tcg-target.c.inc  | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/tcg/mips/tcg-target-sa32.h b/tcg/mips/tcg-target-sa32.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target-sa32.h
+++ b/tcg/mips/tcg-target-sa32.h
@@ -1 +1,9 @@
+/*
+ * Do not set TCG_TARGET_SIGNED_ADDR32 for mips32;
+ * TCG expects this to only be set for 64-bit hosts.
+ */
+#ifdef __mips64
+#define TCG_TARGET_SIGNED_ADDR32 1
+#else
 #define TCG_TARGET_SIGNED_ADDR32 0
+#endif
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg base, TCGReg addrl,
                      TCG_TMP0, TCG_TMP3, cmp_off);
     }
 
-    /* Zero extend a 32-bit guest address for a 64-bit host. */
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-        tcg_out_ext32u(s, base, addrl);
-        addrl = base;
-    }
-
     /*
      * Mask the page bits, keeping the alignment bits to compare against.
      * For unaligned accesses, compare against the end of the access to
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
-- 
2.25.1

All RV64 32-bit operations sign-extend the output, so we are easily
able to keep TCG_TYPE_I32 values sign-extended in host registers.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target-sa32.h | 6 +++++-
 tcg/riscv/tcg-target.c.inc  | 8 ++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tcg/riscv/tcg-target-sa32.h b/tcg/riscv/tcg-target-sa32.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target-sa32.h
+++ b/tcg/riscv/tcg-target-sa32.h
@@ -1 +1,5 @@
-#define TCG_TARGET_SIGNED_ADDR32 0
+/*
+ * Do not set TCG_TARGET_SIGNED_ADDR32 for RV32;
+ * TCG expects this to only be set for 64-bit hosts.
+ */
+#define TCG_TARGET_SIGNED_ADDR32  (__riscv_xlen == 64)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
     tcg_out_opc_branch(s, OPC_BNE, TCG_REG_TMP0, TCG_REG_TMP1, 0);
 
     /* TLB Hit - translate address using addend.  */
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-        tcg_out_ext32u(s, TCG_REG_TMP0, addrl);
-        addrl = TCG_REG_TMP0;
-    }
     tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_REG_TMP2, addrl);
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS && !guest_base_signed_addr32) {
         tcg_out_ext32u(s, base, addr_regl);
         addr_regl = base;
     }
-- 
2.25.1

All 32-bit LoongArch operations sign-extend the output, so we are easily
able to keep TCG_TYPE_I32 values sign-extended in host registers.

Cc: WANG Xuerui <git@xen0n.name>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target-sa32.h |  2 +-
 tcg/loongarch64/tcg-target.c.inc  | 15 ++++++---------
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/tcg/loongarch64/tcg-target-sa32.h b/tcg/loongarch64/tcg-target-sa32.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target-sa32.h
+++ b/tcg/loongarch64/tcg-target-sa32.h
@@ -1 +1 @@
-#define TCG_TARGET_SIGNED_ADDR32 0
+#define TCG_TARGET_SIGNED_ADDR32 1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     return tcg_out_fail_alignment(s, l);
 }
 
-#endif /* CONFIG_SOFTMMU */
-
 /*
  * `ext32u` the address register into the temp register given,
  * if target is 32-bit, no-op otherwise.
@@ -XXX,XX +XXX,XX @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
 static TCGReg tcg_out_zext_addr_if_32_bit(TCGContext *s,
                                           TCGReg addr, TCGReg tmp)
 {
-    if (TARGET_LONG_BITS == 32) {
+    if (TARGET_LONG_BITS == 32 && !guest_base_signed_addr32) {
         tcg_out_ext32u(s, tmp, addr);
         return tmp;
     }
     return addr;
 }
+#endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld_indexed(TCGContext *s, TCGReg rd, TCGReg rj,
                                    TCGReg rk, MemOp opc, TCGType type)
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
     tcg_insn_unit *label_ptr[1];
 #else
     unsigned a_bits;
-#endif
     TCGReg base;
+#endif
 
     data_regl = *args++;
     addr_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, TCGType type)
 
 #if defined(CONFIG_SOFTMMU)
     tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 1);
-    base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
-    tcg_out_qemu_ld_indexed(s, data_regl, base, TCG_REG_TMP2, opc, type);
+    tcg_out_qemu_ld_indexed(s, data_regl, addr_regl, TCG_REG_TMP2, opc, type);
     add_qemu_ldst_label(s, 1, oi, type,
                         data_regl, addr_regl,
                         s->code_ptr, label_ptr);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
     tcg_insn_unit *label_ptr[1];
 #else
     unsigned a_bits;
-#endif
     TCGReg base;
+#endif
 
     data_regl = *args++;
     addr_regl = *args++;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args)
 
 #if defined(CONFIG_SOFTMMU)
     tcg_out_tlb_load(s, addr_regl, oi, label_ptr, 0);
-    base = tcg_out_zext_addr_if_32_bit(s, addr_regl, TCG_REG_TMP0);
-    tcg_out_qemu_st_indexed(s, data_regl, base, TCG_REG_TMP2, opc);
+    tcg_out_qemu_st_indexed(s, data_regl, addr_regl, TCG_REG_TMP2, opc);
     add_qemu_ldst_label(s, 0, oi,
                         0, /* type param is unused for stores */
                         data_regl, addr_regl,
-- 
2.25.1