Series comparison

-[PULL 00/10] tcg patch queue
+[PULL for-7.2 0/2] tcg patch queue
-The following changes since commit 0e32462630687a18039464511bd0447ada5709c3:
+The following changes since commit 60ab36907ded2918d33683f2b66f603b7400d8f3:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-6.0-pull-request' into staging (2021-01-22 10:35:55 +0000)
+  Update VERSION for v7.2.0-rc0 (2022-11-08 15:53:41 -0500)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210123
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221109
-for you to fetch changes up to 2e34067e9959f149a904cf1255985d3b68b52566:
+for you to fetch changes up to 344b63b380541a63c02ef7a8a6ae66cb0b6f0273:
-  tcg: Toggle page execution for Apple Silicon (2021-01-22 12:48:01 -1000)
+  accel/tcg: Split out setjmp_gen_code (2022-11-09 12:29:03 +1100)
 ----------------------------------------------------------------
-Fix tcg constant segv.
+Fix -Werror=clobbered issue with tb_gen_code
 Optimize inline dup_const for MO_64.
 Update the cpu running flag in cpu_exec_step_atomic
 Some tidy up of tcg vs other accelerators
 ----------------------------------------------------------------
-Douglas Crosher (1):
+Richard Henderson (2):
-      tcg: update the cpu running flag in cpu_exec_step_atomic
+      tcg: Move TCG_TARGET_HAS_direct_jump init to tb_gen_code
       accel/tcg: Split out setjmp_gen_code
-Philippe Mathieu-Daudé (4):
+ accel/tcg/translate-all.c | 68 +++++++++++++++++++++++------------------------
-      accel/tcg: Make cpu_gen_init() static
+ tcg/tcg.c                 | 12 +++++++++
-      accel/tcg: Restrict tb_gen_code() from other accelerators
+files changed, 45 insertions(+), 35 deletions(-)
       accel/tcg: Declare missing cpu_loop_exit*() stubs
       accel/tcg: Restrict cpu_io_recompile() from other accelerators
 Richard Henderson (4):
       qemu/compiler: Split out qemu_build_not_reached_always
       tcg: Optimize inline dup_const for MO_64
       tcg: Increase the static number of temporaries
       accel/tcg: Move tb_flush_jmp_cache() to cputlb.c
 Roman Bolshakov (1):
       tcg: Toggle page execution for Apple Silicon
  accel/tcg/internal.h      | 20 ++++++++++++++++++++
  include/exec/exec-all.h   | 11 -----------
  include/qemu/compiler.h   |  5 +++--
  include/qemu/osdep.h      | 28 ++++++++++++++++++++++++++++
  include/tcg/tcg.h         |  5 +++--
  accel/stubs/tcg-stub.c    | 10 ++++++++++
  accel/tcg/cpu-exec.c      |  7 +++++++
  accel/tcg/cputlb.c        | 19 +++++++++++++++++++
  accel/tcg/translate-all.c | 23 +++++------------------
  tcg/tcg.c                 |  7 ++++---
 files changed, 99 insertions(+), 36 deletions(-)
  create mode 100644 accel/tcg/internal.h

-[PULL 01/10] tcg: update the cpu running flag in cpu_exec_step_atomic
+Deleted patch
-From: Douglas Crosher <dtc-ubuntu@scieneer.com>
-The cpu_exec_step_atomic() function is called with the cpu->running
-clear and proceeds to run target code without setting this flag. If
-this target code generates an exception then handle_cpu_signal() will
-unnecessarily abort.  For example if atomic code generates a memory
-protection fault.
-This patch at least sets and clears this running flag, and adds some
-assertions to help detect other cases.
-Signed-off-by: Douglas Crosher <dtc-ubuntu@scieneer.com>
-Message-Id: <a272c656-f7c5-019d-1cc0-499b8f80f2fc@scieneer.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/cpu-exec.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-     if (sigsetjmp(cpu->jmp_env, 0) == 0) {
-         start_exclusive();
-+        g_assert(cpu == current_cpu);
-+        g_assert(!cpu->running);
-+        cpu->running = true;
-         tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
-         if (tb == NULL) {
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-      */
-     g_assert(cpu_in_exclusive_context(cpu));
-     parallel_cpus = true;
-+    cpu->running = false;
-     end_exclusive();
- }
---
-.25.1

-[PULL 02/10] qemu/compiler: Split out qemu_build_not_reached_always
+Deleted patch
-Provide a symbol that can always be used to signal an error,
-regardless of optimization.  Usage of this should be protected
-by e.g. __builtin_constant_p, which guards for optimization.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/qemu/compiler.h | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
-+++ b/include/qemu/compiler.h
-@@ -XXX,XX +XXX,XX @@
-  * supports QEMU_ERROR, this will be reported at compile time; otherwise
-  * this will be reported at link time due to the missing symbol.
-  */
--#if defined(__OPTIMIZE__) && !defined(__NO_INLINE__)
- extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
--    qemu_build_not_reached(void);
-+    qemu_build_not_reached_always(void);
-+#if defined(__OPTIMIZE__) && !defined(__NO_INLINE__)
-+#define qemu_build_not_reached()  qemu_build_not_reached_always()
- #else
- #define qemu_build_not_reached()  g_assert_not_reached()
- #endif
---
-.25.1

-[PULL 03/10] tcg: Optimize inline dup_const for MO_64
+Deleted patch
-Avoid the out-of-line function call for immediate MO_64.
-In addition, diagnose all invalid constants at compile-time.
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg.h | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
-+++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ uint64_t dup_const(unsigned vece, uint64_t c);
-      ? (  (VECE) == MO_8  ? 0x0101010101010101ull * (uint8_t)(C)   \
-         : (VECE) == MO_16 ? 0x0001000100010001ull * (uint16_t)(C)  \
-         : (VECE) == MO_32 ? 0x0000000100000001ull * (uint32_t)(C)  \
--        : dup_const(VECE, C))                                      \
-+        : (VECE) == MO_64 ? (uint64_t)(C)                          \
-+        : (qemu_build_not_reached_always(), 0))                    \
-      : dup_const(VECE, C))
---
-.25.1

-[PULL 04/10] tcg: Increase the static number of temporaries
+Deleted patch
-This isn't a total or permanent solution to the problem of running
-out of temporaries, but it puts off the issue for a bit.
-Make the assert in tcg_temp_alloc unconditional.  If we do run out
-of temps, this can fail much later as a weird SIGSEGV, due to the
-buffer overrun of the temp array.
-Remove the inlines from tcg_temp_alloc and tcg_global_alloc.
-Buglink: https://bugs.launchpad.net/bugs/1912065
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/tcg/tcg.h | 2 +-
- tcg/tcg.c         | 6 +++---
-files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/tcg/tcg.h
-+++ b/include/tcg/tcg.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TCGPool {
- #define TCG_POOL_CHUNK_SIZE 32768
--#define TCG_MAX_TEMPS 512
-+#define TCG_MAX_TEMPS 1024
- #define TCG_MAX_INSNS 512
- /* when the size of the arguments of a called function is smaller than
-diff --git a/tcg/tcg.c b/tcg/tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg.c
-+++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
-     QSIMPLEQ_INIT(&s->labels);
- }
--static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
-+static TCGTemp *tcg_temp_alloc(TCGContext *s)
- {
-     int n = s->nb_temps++;
--    tcg_debug_assert(n < TCG_MAX_TEMPS);
-+    g_assert(n < TCG_MAX_TEMPS);
-     return memset(&s->temps[n], 0, sizeof(TCGTemp));
- }
--static inline TCGTemp *tcg_global_alloc(TCGContext *s)
-+static TCGTemp *tcg_global_alloc(TCGContext *s)
- {
-     TCGTemp *ts;
---
-.25.1

-[PULL 10/10] tcg: Toggle page execution for Apple Silicon
+[PULL 1/2] tcg: Move TCG_TARGET_HAS_direct_jump init to tb_gen_code
-From: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Pages can't be both write and executable at the same time on Apple
 Silicon. macOS provides public API to switch write protection [1] for
 JIT applications, like TCG.
 . https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon
 Tested-by: Alexander Graf <agraf@csgraf.de>
 Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
 Message-Id: <20210113032806.18220-1-r.bolshakov@yadro.com>
 [rth: Inline the qemu_thread_jit_* functions;
  drop the MAP_JIT change for a follow-on patch.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu/osdep.h      | 28 ++++++++++++++++++++++++++++
+ accel/tcg/translate-all.c | 10 ----------
- accel/tcg/cpu-exec.c      |  2 ++
+ tcg/tcg.c                 | 12 ++++++++++++
- accel/tcg/translate-all.c |  3 +++
+files changed, 12 insertions(+), 10 deletions(-)
  tcg/tcg.c                 |  1 +
 files changed, 34 insertions(+)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
- #include "sysemu/os-posix.h"
- #endif
-+#ifdef __APPLE__
-+#include <AvailabilityMacros.h>
-+#endif
-+
- #include "glib-compat.h"
- #include "qemu/typedefs.h"
-@@ -XXX,XX +XXX,XX @@ char *qemu_get_host_name(Error **errp);
-  */
- size_t qemu_get_host_physmem(void);
-+/*
-+ * Toggle write/execute on the pages marked MAP_JIT
-+ * for the current thread.
-+ */
-+#if defined(MAC_OS_VERSION_11_0) && \
-+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_11_0
-+static inline void qemu_thread_jit_execute(void)
-+{
-+    if (__builtin_available(macOS 11.0, *)) {
-+        pthread_jit_write_protect_np(true);
-+    }
-+}
-+
-+static inline void qemu_thread_jit_write(void)
-+{
-+    if (__builtin_available(macOS 11.0, *)) {
-+        pthread_jit_write_protect_np(false);
-+    }
-+}
-+#else
-+static inline void qemu_thread_jit_write(void) {}
-+static inline void qemu_thread_jit_execute(void) {}
-+#endif
-+
- #endif
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-     }
- #endif /* DEBUG_DISAS */
-+    qemu_thread_jit_execute();
-     ret = tcg_qemu_tb_exec(env, tb_ptr);
-     cpu->can_do_io = 1;
-     /*
-@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
- {
-     uintptr_t old;
-+    qemu_thread_jit_write();
-     assert(n < ARRAY_SIZE(tb->jmp_list_next));
-     qemu_spin_lock(&tb_next->jmp_lock);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
- static void tb_phys_invalidate__locked(TranslationBlock *tb)
- {
-+    qemu_thread_jit_write();
-     do_tb_phys_invalidate(tb, true);
-+    qemu_thread_jit_execute();
- }
- /* invalidate one TB
 @@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
- #endif
+     trace_translate_block(tb, pc, tb->tc.ptr);
-     assert_memory_lock();
+     /* generate machine code */
-+    qemu_thread_jit_write();
+-    tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
+-    tb->jmp_reset_offset[1] = TB_JMP_RESET_OFFSET_INVALID;
-     phys_pc = get_page_addr_code(env, pc);
+-    tcg_ctx->tb_jmp_reset_offset = tb->jmp_reset_offset;
+-    if (TCG_TARGET_HAS_direct_jump) {
 -        tcg_ctx->tb_jmp_insn_offset = tb->jmp_target_arg;
 -        tcg_ctx->tb_jmp_target_addr = NULL;
 -    } else {
 -        tcg_ctx->tb_jmp_insn_offset = NULL;
 -        tcg_ctx->tb_jmp_target_addr = tb->jmp_target_arg;
 -    }
  #ifdef CONFIG_PROFILER
      qatomic_set(&prof->tb_count, prof->tb_count + 1);
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
-@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
+@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
-     s->pool_labels = NULL;
+     }
  #endif
-+    qemu_thread_jit_write();
++    /* Initialize goto_tb jump offsets. */
-     /* Generate the prologue.  */
++    tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
-     tcg_target_qemu_prologue(s);
++    tb->jmp_reset_offset[1] = TB_JMP_RESET_OFFSET_INVALID;
++    tcg_ctx->tb_jmp_reset_offset = tb->jmp_reset_offset;
 +    if (TCG_TARGET_HAS_direct_jump) {
 +        tcg_ctx->tb_jmp_insn_offset = tb->jmp_target_arg;
 +        tcg_ctx->tb_jmp_target_addr = NULL;
 +    } else {
 +        tcg_ctx->tb_jmp_insn_offset = NULL;
 +        tcg_ctx->tb_jmp_target_addr = tb->jmp_target_arg;
 +    }
 +
      tcg_reg_alloc_start(s);
      /*
 --
-.25.1
+.34.1

-[PULL 05/10] accel/tcg: Make cpu_gen_init() static
+[PULL 2/2] accel/tcg: Split out setjmp_gen_code
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Isolate the code protected by setjmp.  Fixes:
-cpu_gen_init() is TCG specific, only used in tcg/translate-all.c.
+translate-all.c: In function ‘tb_gen_code’:
-No need to export it to other accelerators, declare it statically.
+translate-all.c:748:51: error: argument ‘cflags’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]
-Reviewed-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210117164813.4101761-2-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h   | 2 --
+ accel/tcg/translate-all.c | 58 ++++++++++++++++++++++-----------------
- accel/tcg/translate-all.c | 2 +-
+file changed, 33 insertions(+), 25 deletions(-)
 files changed, 1 insertion(+), 3 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
- void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
-                           target_ulong *data);
--void cpu_gen_init(void);
--
- /**
-  * cpu_restore_state:
-  * @cpu: the vCPU state is to be restore to
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static void page_table_config_init(void)
+@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
-     assert(v_l2_levels >= 0);
- }
+ #endif /* !CONFIG_USER_ONLY */
--void cpu_gen_init(void)
++/*
-+static void cpu_gen_init(void)
++ * Isolate the portion of code gen which can setjmp/longjmp.
- {
++ * Return the size of the generated code, or negative on error.
-     tcg_context_init(&tcg_init_ctx);
++ */
- }
++static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
 +                           target_ulong pc, void *host_pc,
 +                           int *max_insns, int64_t *ti)
 +{
 +    int ret = sigsetjmp(tcg_ctx->jmp_trans, 0);
 +    if (unlikely(ret != 0)) {
 +        return ret;
 +    }
 +
 +    tcg_func_start(tcg_ctx);
 +
 +    tcg_ctx->cpu = env_cpu(env);
 +    gen_intermediate_code(env_cpu(env), tb, *max_insns, pc, host_pc);
 +    assert(tb->size != 0);
 +    tcg_ctx->cpu = NULL;
 +    *max_insns = tb->icount;
 +
 +#ifdef CONFIG_PROFILER
 +    qatomic_set(&tcg_ctx->prof.tb_count, tcg_ctx->prof.tb_count + 1);
 +    qatomic_set(&tcg_ctx->prof.interm_time,
 +                tcg_ctx->prof.interm_time + profile_getclock() - *ti);
 +    *ti = profile_getclock();
 +#endif
 +
 +    return tcg_gen_code(tcg_ctx, tb, pc);
 +}
 +
  /* Called with mmap_lock held for user mode emulation.  */
  TranslationBlock *tb_gen_code(CPUState *cpu,
                                target_ulong pc, target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      int gen_code_size, search_size, max_insns;
  #ifdef CONFIG_PROFILER
      TCGProfile *prof = &tcg_ctx->prof;
 -    int64_t ti;
  #endif
 +    int64_t ti;
      void *host_pc;
      assert_memory_lock();
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      ti = profile_getclock();
  #endif
 -    gen_code_size = sigsetjmp(tcg_ctx->jmp_trans, 0);
 -    if (unlikely(gen_code_size != 0)) {
 -        goto error_return;
 -    }
 -
 -    tcg_func_start(tcg_ctx);
 -
 -    tcg_ctx->cpu = env_cpu(env);
 -    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
 -    assert(tb->size != 0);
 -    tcg_ctx->cpu = NULL;
 -    max_insns = tb->icount;
 -
      trace_translate_block(tb, pc, tb->tc.ptr);
 -    /* generate machine code */
 -
 -#ifdef CONFIG_PROFILER
 -    qatomic_set(&prof->tb_count, prof->tb_count + 1);
 -    qatomic_set(&prof->interm_time,
 -                prof->interm_time + profile_getclock() - ti);
 -    ti = profile_getclock();
 -#endif
 -
 -    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
 +    gen_code_size = setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
      if (unlikely(gen_code_size < 0)) {
 - error_return:
          switch (gen_code_size) {
          case -1:
              /*
 --
-.25.1
+.34.1

-[PULL 06/10] accel/tcg: Move tb_flush_jmp_cache() to cputlb.c
+Deleted patch
-Move and make the function static, as the only users
-are here in cputlb.c.
-Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/exec-all.h   |  3 ---
- accel/tcg/cputlb.c        | 18 ++++++++++++++++++
- accel/tcg/translate-all.c | 17 -----------------
-files changed, 18 insertions(+), 20 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
- void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
- void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
--/* exec.c */
--void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr);
--
- MemoryRegionSection *
- address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
-                                   hwaddr *xlat, hwaddr *plen,
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "exec/cpu_ldst.h"
- #include "exec/cputlb.h"
-+#include "exec/tb-hash.h"
- #include "exec/memory-internal.h"
- #include "exec/ram_addr.h"
- #include "tcg/tcg.h"
-@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
-     desc->window_max_entries = max_entries;
- }
-+static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
-+{
-+    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
-+
-+    for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
-+        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
-+    }
-+}
-+
-+static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
-+{
-+    /* Discard jump cache entries for any tb which might potentially
-+       overlap the flushed page.  */
-+    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
-+    tb_jmp_cache_clear_page(cpu, addr);
-+}
-+
- /**
-  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
-  * @desc: The CPUTLBDesc portion of the TLB
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
-     cpu_loop_exit_noexc(cpu);
- }
--static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
--{
--    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
--
--    for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
--        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
--    }
--}
--
--void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
--{
--    /* Discard jump cache entries for any tb which might potentially
--       overlap the flushed page.  */
--    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
--    tb_jmp_cache_clear_page(cpu, addr);
--}
--
- static void print_qht_statistics(struct qht_stats hst)
- {
-     uint32_t hgram_opts;
---
-.25.1

-[PULL 07/10] accel/tcg: Restrict tb_gen_code() from other accelerators
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-tb_gen_code() is only called within TCG accelerator, declare it locally.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210117164813.4101761-4-f4bug@amsat.org>
-[rth: Adjust vs changed tb_flush_jmp_cache patch.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/internal.h      | 18 ++++++++++++++++++
- include/exec/exec-all.h   |  5 -----
- accel/tcg/cpu-exec.c      |  1 +
- accel/tcg/translate-all.c |  1 +
-files changed, 20 insertions(+), 5 deletions(-)
- create mode 100644 accel/tcg/internal.h
-diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Internal execution defines for qemu
-+ *
-+ *  Copyright (c) 2003 Fabrice Bellard
-+ *
-+ * SPDX-License-Identifier: LGPL-2.1-or-later
-+ */
-+
-+#ifndef ACCEL_TCG_INTERNAL_H
-+#define ACCEL_TCG_INTERNAL_H
-+
-+#include "exec/exec-all.h"
-+
-+TranslationBlock *tb_gen_code(CPUState *cpu, target_ulong pc,
-+                              target_ulong cs_base, uint32_t flags,
-+                              int cflags);
-+
-+#endif /* ACCEL_TCG_INTERNAL_H */
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
- void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
- void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
--TranslationBlock *tb_gen_code(CPUState *cpu,
--                              target_ulong pc, target_ulong cs_base,
--                              uint32_t flags,
--                              int cflags);
--
- void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
- void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
- void QEMU_NORETURN cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc);
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/cpu-all.h"
- #include "sysemu/cpu-timers.h"
- #include "sysemu/replay.h"
-+#include "internal.h"
- /* -icount align implementation. */
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/cpu-timers.h"
- #include "sysemu/tcg.h"
- #include "qapi/error.h"
-+#include "internal.h"
- /* #define DEBUG_TB_INVALIDATE */
- /* #define DEBUG_TB_FLUSH */
---
-.25.1

-[PULL 08/10] accel/tcg: Declare missing cpu_loop_exit*() stubs
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-cpu_loop_exit*() functions are declared in accel/tcg/cpu-exec-common.c,
-and are not available when TCG accelerator is not built. Add stubs so
-linking without TCG succeed.
-Problematic files:
-- hw/semihosting/console.c in qemu_semihosting_console_inc()
-- hw/ppc/spapr_hcall.c in h_confer()
-- hw/s390x/ipl.c in s390_ipl_reset_request()
-- hw/misc/mips_itu.c
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210117164813.4101761-5-f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/stubs/tcg-stub.c | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/stubs/tcg-stub.c
-+++ b/accel/stubs/tcg-stub.c
-@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
-      /* Handled by hardware accelerator. */
-      g_assert_not_reached();
- }
-+
-+void QEMU_NORETURN cpu_loop_exit(CPUState *cpu)
-+{
-+    g_assert_not_reached();
-+}
-+
-+void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
-+{
-+    g_assert_not_reached();
-+}
---
-.25.1

-[PULL 09/10] accel/tcg: Restrict cpu_io_recompile() from other accelerators
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-As cpu_io_recompile() is only called within TCG accelerator
-in cputlb.c, declare it locally.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210117164813.4101761-6-f4bug@amsat.org>
-[rth: Adjust vs changed tb_flush_jmp_cache patch.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- accel/tcg/internal.h    | 2 ++
- include/exec/exec-all.h | 1 -
- accel/tcg/cputlb.c      | 1 +
-files changed, 3 insertions(+), 1 deletion(-)
-diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/internal.h
-+++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu, target_ulong pc,
-                               target_ulong cs_base, uint32_t flags,
-                               int cflags);
-+void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
-+
- #endif /* ACCEL_TCG_INTERNAL_H */
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
-+++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
- bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
- void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
--void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
- void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
- void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
- void QEMU_NORETURN cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/translate-all.h"
- #include "trace/trace-root.h"
- #include "trace/mem.h"
-+#include "internal.h"
- #ifdef CONFIG_PLUGIN
- #include "qemu/plugin-memory.h"
- #endif
---
-.25.1

The following changes since commit 0e32462630687a18039464511bd0447ada5709c3:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-6.0-pull-request' into staging (2021-01-22 10:35:55 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210123

for you to fetch changes up to 2e34067e9959f149a904cf1255985d3b68b52566:

tcg: Toggle page execution for Apple Silicon (2021-01-22 12:48:01 -1000)

----------------------------------------------------------------
Fix tcg constant segv.
Optimize inline dup_const for MO_64.
Update the cpu running flag in cpu_exec_step_atomic
Some tidy up of tcg vs other accelerators

----------------------------------------------------------------
Douglas Crosher (1):
      tcg: update the cpu running flag in cpu_exec_step_atomic

Philippe Mathieu-Daudé (4):
      accel/tcg: Make cpu_gen_init() static
      accel/tcg: Restrict tb_gen_code() from other accelerators
      accel/tcg: Declare missing cpu_loop_exit*() stubs
      accel/tcg: Restrict cpu_io_recompile() from other accelerators

Richard Henderson (4):
      qemu/compiler: Split out qemu_build_not_reached_always
      tcg: Optimize inline dup_const for MO_64
      tcg: Increase the static number of temporaries
      accel/tcg: Move tb_flush_jmp_cache() to cputlb.c

Roman Bolshakov (1):
      tcg: Toggle page execution for Apple Silicon

accel/tcg/internal.h      | 20 ++++++++++++++++++++
 include/exec/exec-all.h   | 11 -----------
 include/qemu/compiler.h   |  5 +++--
 include/qemu/osdep.h      | 28 ++++++++++++++++++++++++++++
 include/tcg/tcg.h         |  5 +++--
 accel/stubs/tcg-stub.c    | 10 ++++++++++
 accel/tcg/cpu-exec.c      |  7 +++++++
 accel/tcg/cputlb.c        | 19 +++++++++++++++++++
 accel/tcg/translate-all.c | 23 +++++------------------
 tcg/tcg.c                 |  7 ++++---
 10 files changed, 99 insertions(+), 36 deletions(-)
 create mode 100644 accel/tcg/internal.h

From: Douglas Crosher <dtc-ubuntu@scieneer.com>

The cpu_exec_step_atomic() function is called with the cpu->running
clear and proceeds to run target code without setting this flag. If
this target code generates an exception then handle_cpu_signal() will
unnecessarily abort.  For example if atomic code generates a memory
protection fault.

This patch at least sets and clears this running flag, and adds some
assertions to help detect other cases.

Signed-off-by: Douglas Crosher <dtc-ubuntu@scieneer.com>
Message-Id: <a272c656-f7c5-019d-1cc0-499b8f80f2fc@scieneer.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
 
     if (sigsetjmp(cpu->jmp_env, 0) == 0) {
         start_exclusive();
+        g_assert(cpu == current_cpu);
+        g_assert(!cpu->running);
+        cpu->running = true;
 
         tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
         if (tb == NULL) {
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
      */
     g_assert(cpu_in_exclusive_context(cpu));
     parallel_cpus = true;
+    cpu->running = false;
     end_exclusive();
 }
 
-- 
2.25.1

Provide a symbol that can always be used to signal an error,
regardless of optimization.  Usage of this should be protected
by e.g. __builtin_constant_p, which guards for optimization.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/compiler.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
  * supports QEMU_ERROR, this will be reported at compile time; otherwise
  * this will be reported at link time due to the missing symbol.
  */
-#if defined(__OPTIMIZE__) && !defined(__NO_INLINE__)
 extern void QEMU_NORETURN QEMU_ERROR("code path is reachable")
-    qemu_build_not_reached(void);
+    qemu_build_not_reached_always(void);
+#if defined(__OPTIMIZE__) && !defined(__NO_INLINE__)
+#define qemu_build_not_reached()  qemu_build_not_reached_always()
 #else
 #define qemu_build_not_reached()  g_assert_not_reached()
 #endif
-- 
2.25.1

This isn't a total or permanent solution to the problem of running
out of temporaries, but it puts off the issue for a bit.

Make the assert in tcg_temp_alloc unconditional.  If we do run out
of temps, this can fail much later as a weird SIGSEGV, due to the
buffer overrun of the temp array.

Remove the inlines from tcg_temp_alloc and tcg_global_alloc.

Buglink: https://bugs.launchpad.net/bugs/1912065
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 2 +-
 tcg/tcg.c         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ typedef struct TCGPool {
 
 #define TCG_POOL_CHUNK_SIZE 32768
 
-#define TCG_MAX_TEMPS 512
+#define TCG_MAX_TEMPS 1024
 #define TCG_MAX_INSNS 512
 
 /* when the size of the arguments of a called function is smaller than
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_func_start(TCGContext *s)
     QSIMPLEQ_INIT(&s->labels);
 }
 
-static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
+static TCGTemp *tcg_temp_alloc(TCGContext *s)
 {
     int n = s->nb_temps++;
-    tcg_debug_assert(n < TCG_MAX_TEMPS);
+    g_assert(n < TCG_MAX_TEMPS);
     return memset(&s->temps[n], 0, sizeof(TCGTemp));
 }
 
-static inline TCGTemp *tcg_global_alloc(TCGContext *s)
+static TCGTemp *tcg_global_alloc(TCGContext *s)
 {
     TCGTemp *ts;
 
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_gen_init() is TCG specific, only used in tcg/translate-all.c.
No need to export it to other accelerators, declare it statically.

Reviewed-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210117164813.4101761-2-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h   | 2 --
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
 void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
-void cpu_gen_init(void);
-
 /**
  * cpu_restore_state:
  * @cpu: the vCPU state is to be restore to
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void page_table_config_init(void)
     assert(v_l2_levels >= 0);
 }
 
-void cpu_gen_init(void)
+static void cpu_gen_init(void)
 {
     tcg_context_init(&tcg_init_ctx);
 }
-- 
2.25.1

Move and make the function static, as the only users
are here in cputlb.c.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h   |  3 ---
 accel/tcg/cputlb.c        | 18 ++++++++++++++++++
 accel/tcg/translate-all.c | 17 -----------------
 3 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 
-/* exec.c */
-void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr);
-
 MemoryRegionSection *
 address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
                                   hwaddr *xlat, hwaddr *plen,
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "exec/cpu_ldst.h"
 #include "exec/cputlb.h"
+#include "exec/tb-hash.h"
 #include "exec/memory-internal.h"
 #include "exec/ram_addr.h"
 #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
     desc->window_max_entries = max_entries;
 }
 
+static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
+{
+    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
+
+    for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
+        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
+    }
+}
+
+static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
+{
+    /* Discard jump cache entries for any tb which might potentially
+       overlap the flushed page.  */
+    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
+    tb_jmp_cache_clear_page(cpu, addr);
+}
+
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
  * @desc: The CPUTLBDesc portion of the TLB
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     cpu_loop_exit_noexc(cpu);
 }
 
-static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
-{
-    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
-
-    for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
-        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
-    }
-}
-
-void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
-{
-    /* Discard jump cache entries for any tb which might potentially
-       overlap the flushed page.  */
-    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
-    tb_jmp_cache_clear_page(cpu, addr);
-}
-
 static void print_qht_statistics(struct qht_stats hst)
 {
     uint32_t hgram_opts;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

tb_gen_code() is only called within TCG accelerator, declare it locally.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210117164813.4101761-4-f4bug@amsat.org>
[rth: Adjust vs changed tb_flush_jmp_cache patch.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      | 18 ++++++++++++++++++
 include/exec/exec-all.h   |  5 -----
 accel/tcg/cpu-exec.c      |  1 +
 accel/tcg/translate-all.c |  1 +
 4 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 accel/tcg/internal.h

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Internal execution defines for qemu
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_INTERNAL_H
+#define ACCEL_TCG_INTERNAL_H
+
+#include "exec/exec-all.h"
+
+TranslationBlock *tb_gen_code(CPUState *cpu, target_ulong pc,
+                              target_ulong cs_base, uint32_t flags,
+                              int cflags);
+
+#endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
 
 void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
 void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
-TranslationBlock *tb_gen_code(CPUState *cpu,
-                              target_ulong pc, target_ulong cs_base,
-                              uint32_t flags,
-                              int cflags);
-
 void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
 void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
 void QEMU_NORETURN cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu-all.h"
 #include "sysemu/cpu-timers.h"
 #include "sysemu/replay.h"
+#include "internal.h"
 
 /* -icount align implementation. */
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/cpu-timers.h"
 #include "sysemu/tcg.h"
 #include "qapi/error.h"
+#include "internal.h"
 
 /* #define DEBUG_TB_INVALIDATE */
 /* #define DEBUG_TB_FLUSH */
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

cpu_loop_exit*() functions are declared in accel/tcg/cpu-exec-common.c,
and are not available when TCG accelerator is not built. Add stubs so
linking without TCG succeed.

Problematic files:

- hw/semihosting/console.c in qemu_semihosting_console_inc()
- hw/ppc/spapr_hcall.c in h_confer()
- hw/s390x/ipl.c in s390_ipl_reset_request()
- hw/misc/mips_itu.c

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210117164813.4101761-5-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/stubs/tcg-stub.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      /* Handled by hardware accelerator. */
      g_assert_not_reached();
 }
+
+void QEMU_NORETURN cpu_loop_exit(CPUState *cpu)
+{
+    g_assert_not_reached();
+}
+
+void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
+{
+    g_assert_not_reached();
+}
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As cpu_io_recompile() is only called within TCG accelerator
in cputlb.c, declare it locally.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210117164813.4101761-6-f4bug@amsat.org>
[rth: Adjust vs changed tb_flush_jmp_cache patch.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h    | 2 ++
 include/exec/exec-all.h | 1 -
 accel/tcg/cputlb.c      | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu, target_ulong pc,
                               target_ulong cs_base, uint32_t flags,
                               int cflags);
 
+void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
+
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
 bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc, bool will_exit);
 
 void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
-void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
 void QEMU_NORETURN cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
 void QEMU_NORETURN cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/translate-all.h"
 #include "trace/trace-root.h"
 #include "trace/mem.h"
+#include "internal.h"
 #ifdef CONFIG_PLUGIN
 #include "qemu/plugin-memory.h"
 #endif
-- 
2.25.1

From: Roman Bolshakov <r.bolshakov@yadro.com>

Pages can't be both write and executable at the same time on Apple
Silicon. macOS provides public API to switch write protection [1] for
JIT applications, like TCG.

1. https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon

Tested-by: Alexander Graf <agraf@csgraf.de>
Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Message-Id: <20210113032806.18220-1-r.bolshakov@yadro.com>
[rth: Inline the qemu_thread_jit_* functions;
 drop the MAP_JIT change for a follow-on patch.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/osdep.h      | 28 ++++++++++++++++++++++++++++
 accel/tcg/cpu-exec.c      |  2 ++
 accel/tcg/translate-all.c |  3 +++
 tcg/tcg.c                 |  1 +
 4 files changed, 34 insertions(+)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
 #include "sysemu/os-posix.h"
 #endif
 
+#ifdef __APPLE__
+#include <AvailabilityMacros.h>
+#endif
+
 #include "glib-compat.h"
 #include "qemu/typedefs.h"
 
@@ -XXX,XX +XXX,XX @@ char *qemu_get_host_name(Error **errp);
  */
 size_t qemu_get_host_physmem(void);
 
+/*
+ * Toggle write/execute on the pages marked MAP_JIT
+ * for the current thread.
+ */
+#if defined(MAC_OS_VERSION_11_0) && \
+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_11_0
+static inline void qemu_thread_jit_execute(void)
+{
+    if (__builtin_available(macOS 11.0, *)) {
+        pthread_jit_write_protect_np(true);
+    }
+}
+
+static inline void qemu_thread_jit_write(void)
+{
+    if (__builtin_available(macOS 11.0, *)) {
+        pthread_jit_write_protect_np(false);
+    }
+}
+#else
+static inline void qemu_thread_jit_write(void) {}
+static inline void qemu_thread_jit_execute(void) {}
+#endif
+
 #endif
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
     }
 #endif /* DEBUG_DISAS */
 
+    qemu_thread_jit_execute();
     ret = tcg_qemu_tb_exec(env, tb_ptr);
     cpu->can_do_io = 1;
     /*
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 {
     uintptr_t old;
 
+    qemu_thread_jit_write();
     assert(n < ARRAY_SIZE(tb->jmp_list_next));
     qemu_spin_lock(&tb_next->jmp_lock);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 
 static void tb_phys_invalidate__locked(TranslationBlock *tb)
 {
+    qemu_thread_jit_write();
     do_tb_phys_invalidate(tb, true);
+    qemu_thread_jit_execute();
 }
 
 /* invalidate one TB
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 #endif
 
     assert_memory_lock();
+    qemu_thread_jit_write();
 
     phys_pc = get_page_addr_code(env, pc);
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ void tcg_prologue_init(TCGContext *s)
     s->pool_labels = NULL;
 #endif
 
+    qemu_thread_jit_write();
     /* Generate the prologue.  */
     tcg_target_qemu_prologue(s);
 
-- 
2.25.1

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 10 ----------
 tcg/tcg.c                 | 12 ++++++++++++
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     trace_translate_block(tb, pc, tb->tc.ptr);
 
     /* generate machine code */
-    tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
-    tb->jmp_reset_offset[1] = TB_JMP_RESET_OFFSET_INVALID;
-    tcg_ctx->tb_jmp_reset_offset = tb->jmp_reset_offset;
-    if (TCG_TARGET_HAS_direct_jump) {
-        tcg_ctx->tb_jmp_insn_offset = tb->jmp_target_arg;
-        tcg_ctx->tb_jmp_target_addr = NULL;
-    } else {
-        tcg_ctx->tb_jmp_insn_offset = NULL;
-        tcg_ctx->tb_jmp_target_addr = tb->jmp_target_arg;
-    }
 
 #ifdef CONFIG_PROFILER
     qatomic_set(&prof->tb_count, prof->tb_count + 1);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
     }
 #endif
 
+    /* Initialize goto_tb jump offsets. */
+    tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
+    tb->jmp_reset_offset[1] = TB_JMP_RESET_OFFSET_INVALID;
+    tcg_ctx->tb_jmp_reset_offset = tb->jmp_reset_offset;
+    if (TCG_TARGET_HAS_direct_jump) {
+        tcg_ctx->tb_jmp_insn_offset = tb->jmp_target_arg;
+        tcg_ctx->tb_jmp_target_addr = NULL;
+    } else {
+        tcg_ctx->tb_jmp_insn_offset = NULL;
+        tcg_ctx->tb_jmp_target_addr = tb->jmp_target_arg;
+    }
+
     tcg_reg_alloc_start(s);
 
     /*
-- 
2.34.1

Isolate the code protected by setjmp.  Fixes:

translate-all.c: In function ‘tb_gen_code’:
translate-all.c:748:51: error: argument ‘cflags’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 58 ++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 25 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
 
 #endif /* !CONFIG_USER_ONLY */
 
+/*
+ * Isolate the portion of code gen which can setjmp/longjmp.
+ * Return the size of the generated code, or negative on error.
+ */
+static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
+                           target_ulong pc, void *host_pc,
+                           int *max_insns, int64_t *ti)
+{
+    int ret = sigsetjmp(tcg_ctx->jmp_trans, 0);
+    if (unlikely(ret != 0)) {
+        return ret;
+    }
+
+    tcg_func_start(tcg_ctx);
+
+    tcg_ctx->cpu = env_cpu(env);
+    gen_intermediate_code(env_cpu(env), tb, *max_insns, pc, host_pc);
+    assert(tb->size != 0);
+    tcg_ctx->cpu = NULL;
+    *max_insns = tb->icount;
+
+#ifdef CONFIG_PROFILER
+    qatomic_set(&tcg_ctx->prof.tb_count, tcg_ctx->prof.tb_count + 1);
+    qatomic_set(&tcg_ctx->prof.interm_time,
+                tcg_ctx->prof.interm_time + profile_getclock() - *ti);
+    *ti = profile_getclock();
+#endif
+
+    return tcg_gen_code(tcg_ctx, tb, pc);
+}
+
 /* Called with mmap_lock held for user mode emulation.  */
 TranslationBlock *tb_gen_code(CPUState *cpu,
                               target_ulong pc, target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
     TCGProfile *prof = &tcg_ctx->prof;
-    int64_t ti;
 #endif
+    int64_t ti;
     void *host_pc;
 
     assert_memory_lock();
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     ti = profile_getclock();
 #endif
 
-    gen_code_size = sigsetjmp(tcg_ctx->jmp_trans, 0);
-    if (unlikely(gen_code_size != 0)) {
-        goto error_return;
-    }
-
-    tcg_func_start(tcg_ctx);
-
-    tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
-    assert(tb->size != 0);
-    tcg_ctx->cpu = NULL;
-    max_insns = tb->icount;
-
     trace_translate_block(tb, pc, tb->tc.ptr);
 
-    /* generate machine code */
-
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->tb_count, prof->tb_count + 1);
-    qatomic_set(&prof->interm_time,
-                prof->interm_time + profile_getclock() - ti);
-    ti = profile_getclock();
-#endif
-
-    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
+    gen_code_size = setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
     if (unlikely(gen_code_size < 0)) {
- error_return:
         switch (gen_code_size) {
         case -1:
             /*
-- 
2.34.1