Series comparison

-[PULL 00/46] tcg patch queue
+[PULL 00/20] tcg patch queue
-The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:
+The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)
+  Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901
-for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:
+for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:
-  accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)
+  target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)
 ----------------------------------------------------------------
-TCGCPUOps cleanups (claudio)
+Respect PROT_EXEC in user-only mode.
-tcg/s390 compare fix (phil)
+Fix s390x, i386 and riscv for translations crossing a page.
 tcg/aarch64 rotli_vec fix
 tcg/tci cleanups and fixes
 ----------------------------------------------------------------
-Claudio Fontana (13):
+Ilya Leoshkevich (4):
-      target/riscv: remove CONFIG_TCG, as it is always TCG
+      linux-user: Clear translations on mprotect()
-      accel/tcg: split TCG-only code from cpu_exec_realizefn
+      accel/tcg: Introduce is_same_page()
-      target/arm: do not use cc->do_interrupt for KVM directly
+      target/s390x: Make translator stop before the end of a page
-      cpu: move cc->do_interrupt to tcg_ops
+      target/i386: Make translator stop before the end of a page
       cpu: move cc->transaction_failed to tcg_ops
       cpu: move do_unaligned_access to tcg_ops
       physmem: make watchpoint checking code TCG-only
       cpu: move adjust_watchpoint_address to tcg_ops
       cpu: move debug_check_watchpoint to tcg_ops
       cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
       accel: extend AccelState and AccelClass to user-mode
       accel: replace struct CpusAccel with AccelOpsClass
       accel: introduce AccelCPUClass extending CPUClass
-Eduardo Habkost (5):
+Richard Henderson (16):
-      cpu: Introduce TCGCpuOperations struct
+      linux-user/arm: Mark the commpage executable
-      cpu: Move synchronize_from_tb() to tcg_ops
+      linux-user/hppa: Allocate page zero as a commpage
-      cpu: Move cpu_exec_* to tcg_ops
+      linux-user/x86_64: Allocate vsyscall page as a commpage
-      cpu: Move tlb_fill to tcg_ops
+      linux-user: Honor PT_GNU_STACK
-      cpu: Move debug_excp_handler to tcg_ops
+      tests/tcg/i386: Move smc_code2 to an executable section
       accel/tcg: Properly implement get_page_addr_code for user-only
       accel/tcg: Unlock mmap_lock after longjmp
       accel/tcg: Make tb_htable_lookup static
       accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
       accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
       accel/tcg: Document the faulting lookup in tb_lookup_cmp
       accel/tcg: Remove translator_ldsw
       accel/tcg: Add pc and host_pc params to gen_intermediate_code
       accel/tcg: Add fast path for translator_ld*
       target/riscv: Add MAX_INSN_LEN and insn_len
       target/riscv: Make translator stop before the end of a page
-Philippe Mathieu-Daudé (2):
+ include/elf.h                     |   1 +
-      tcg/s390: Fix compare instruction from extended-immediate facility
+ include/exec/cpu-common.h         |   1 +
-      exec/cpu-defs: Remove TCG backends dependency
+ include/exec/exec-all.h           |  89 ++++++++----------------
+ include/exec/translator.h         |  96 ++++++++++++++++---------
-Richard Henderson (24):
+ linux-user/arm/target_cpu.h       |   4 +-
-      tcg/aarch64: Do not convert TCGArg to temps that are not temps
+ linux-user/qemu.h                 |   1 +
-      configure: Fix --enable-tcg-interpreter
+ accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
-      tcg/tci: Make tci_tb_ptr thread-local
+ accel/tcg/cputlb.c                |  93 +++++++------------------
-      tcg/tci: Inline tci_write_reg32s into the only caller
+ accel/tcg/translate-all.c         |  29 ++++----
-      tcg/tci: Inline tci_write_reg8 into its callers
+ accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
-      tcg/tci: Inline tci_write_reg16 into the only caller
+ accel/tcg/user-exec.c             |  17 ++++-
-      tcg/tci: Inline tci_write_reg32 into all callers
+ linux-user/elfload.c              |  82 ++++++++++++++++++++--
-      tcg/tci: Inline tci_write_reg64 into 64-bit callers
+ linux-user/mmap.c                 |   6 +-
-      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+ softmmu/physmem.c                 |  12 ++++
-      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+ target/alpha/translate.c          |   5 +-
-      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+ target/arm/translate.c            |   5 +-
-      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+ target/avr/translate.c            |   5 +-
-      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+ target/cris/translate.c           |   5 +-
-      tcg/tci: Merge INDEX_op_st8_{i32,i64}
+ target/hexagon/translate.c        |   6 +-
-      tcg/tci: Merge INDEX_op_st16_{i32,i64}
+ target/hppa/translate.c           |   5 +-
-      tcg/tci: Move stack bounds check to compile-time
+ target/i386/tcg/translate.c       |  71 +++++++++++--------
-      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+ target/loongarch/translate.c      |   6 +-
-      tcg/tci: Use g_assert_not_reached
+ target/m68k/translate.c           |   5 +-
-      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+ target/microblaze/translate.c     |   5 +-
-      tcg/tci: Implement 64-bit division
+ target/mips/tcg/translate.c       |   5 +-
-      tcg/tci: Remove TODO as unused
+ target/nios2/translate.c          |   5 +-
-      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+ target/openrisc/translate.c       |   6 +-
-      tcg/tci: Fix TCG_REG_R4 misusage
+ target/ppc/translate.c            |   5 +-
-      tcg/tci: Remove TCG_CONST
+ target/riscv/translate.c          |  32 +++++++--
+ target/rx/translate.c             |   5 +-
-Stefan Weil (2):
+ target/s390x/tcg/translate.c      |  20 ++++--
-      tcg/tci: Implement INDEX_op_ld16s_i32
+ target/sh4/translate.c            |   5 +-
-      tcg/tci: Implement INDEX_op_ld8s_i64
+ target/sparc/translate.c          |   5 +-
+ target/tricore/translate.c        |   6 +-
- configure                                          |   5 +-
+ target/xtensa/translate.c         |   6 +-
- accel/accel-softmmu.h                              |  15 +
+ tests/tcg/i386/test-i386.c        |   2 +-
- accel/kvm/kvm-cpus.h                               |   2 -
+ tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
- .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
+ tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
- accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
+ tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
- accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
+ tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
- accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
+ tests/tcg/riscv64/Makefile.target |   1 +
- include/exec/cpu-all.h                             |  11 +-
+ tests/tcg/s390x/Makefile.target   |   1 +
- include/exec/cpu-defs.h                            |   3 -
+ tests/tcg/x86_64/Makefile.target  |   3 +-
- include/exec/exec-all.h                            |   2 +-
+files changed, 966 insertions(+), 367 deletions(-)
- include/hw/boards.h                                |   2 +-
+ create mode 100644 tests/tcg/riscv64/noexec.c
- include/hw/core/accel-cpu.h                        |  38 ++
+ create mode 100644 tests/tcg/s390x/noexec.c
- include/hw/core/cpu.h                              |  86 +---
+ create mode 100644 tests/tcg/x86_64/noexec.c
- include/hw/core/tcg-cpu-ops.h                      |  97 +++++
+ create mode 100644 tests/tcg/multiarch/noexec.c.inc
  include/{sysemu => qemu}/accel.h                   |  16 +-
  include/sysemu/accel-ops.h                         |  45 ++
  include/sysemu/cpus.h                              |  26 +-
  include/sysemu/hvf.h                               |   2 +-
  include/sysemu/kvm.h                               |   2 +-
  include/sysemu/kvm_int.h                           |   2 +-
  target/arm/internals.h                             |   6 +
  target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
  target/i386/hax/hax-windows.h                      |   2 +-
  target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
  target/i386/hvf/hvf-i386.h                         |   2 +-
  target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
  tcg/tci/tcg-target-con-set.h                       |   6 +-
  tcg/tci/tcg-target.h                               |  37 +-
  accel/accel-common.c                               | 105 +++++
  accel/{accel.c => accel-softmmu.c}                 |  61 ++-
  accel/accel-user.c                                 |  24 ++
  accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
  accel/kvm/kvm-all.c                                |   2 -
  accel/qtest/qtest.c                                |  25 +-
  accel/tcg/cpu-exec.c                               |  53 ++-
  accel/tcg/cputlb.c                                 |  34 +-
  .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
  .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
  accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
  accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
  accel/tcg/tcg-all.c                                |  19 +-
  accel/tcg/user-exec.c                              |   8 +-
  accel/xen/xen-all.c                                |  26 +-
  bsd-user/main.c                                    |  11 +-
  cpu.c                                              |  66 +--
  hw/core/cpu.c                                      |  21 +-
  hw/mips/jazz.c                                     |  12 +-
  linux-user/main.c                                  |   7 +-
  softmmu/cpus.c                                     |  12 +-
  softmmu/memory.c                                   |   2 +-
  softmmu/physmem.c                                  | 149 ++++---
  softmmu/qtest.c                                    |   2 +-
  softmmu/vl.c                                       |   9 +-
  target/alpha/cpu.c                                 |  21 +-
  target/arm/cpu.c                                   |  45 +-
  target/arm/cpu64.c                                 |   4 +-
  target/arm/cpu_tcg.c                               |  32 +-
  target/arm/helper.c                                |   4 +
  target/arm/kvm64.c                                 |   6 +-
  target/avr/cpu.c                                   |  19 +-
  target/avr/helper.c                                |   5 +-
  target/cris/cpu.c                                  |  43 +-
  target/cris/helper.c                               |   5 +-
  target/hppa/cpu.c                                  |  24 +-
  target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
  target/i386/hax/hax-all.c                          |   7 +-
  target/i386/hax/hax-mem.c                          |   2 +-
  target/i386/hax/hax-posix.c                        |   2 +-
  target/i386/hax/hax-windows.c                      |   2 +-
  target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
  target/i386/hvf/hvf.c                              |   5 +-
  target/i386/hvf/x86_task.c                         |   2 +-
  target/i386/hvf/x86hvf.c                           |   2 +-
  target/i386/tcg/tcg-cpu.c                          |  26 +-
  target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
  target/i386/whpx/whpx-all.c                        |   9 +-
  target/lm32/cpu.c                                  |  19 +-
  target/m68k/cpu.c                                  |  19 +-
  target/microblaze/cpu.c                            |  25 +-
  target/mips/cpu.c                                  |  35 +-
  target/moxie/cpu.c                                 |  15 +-
  target/nios2/cpu.c                                 |  18 +-
  target/openrisc/cpu.c                              |  17 +-
  target/riscv/cpu.c                                 |  26 +-
  target/riscv/cpu_helper.c                          |   2 +-
  target/rx/cpu.c                                    |  20 +-
  target/s390x/cpu.c                                 |  33 +-
  target/s390x/excp_helper.c                         |   2 +-
  target/sh4/cpu.c                                   |  21 +-
  target/sparc/cpu.c                                 |  25 +-
  target/tilegx/cpu.c                                |  17 +-
  target/tricore/cpu.c                               |  12 +-
  target/unicore32/cpu.c                             |  17 +-
  target/xtensa/cpu.c                                |  23 +-
  target/xtensa/helper.c                             |   4 +-
  tcg/tcg-common.c                                   |   4 -
  tcg/tci.c                                          | 479 ++++++++-------------
  target/ppc/translate_init.c.inc                    |  39 +-
  tcg/aarch64/tcg-target.c.inc                       |   7 +-
  tcg/s390/tcg-target.c.inc                          |   2 +-
  tcg/tci/tcg-target.c.inc                           | 149 ++-----
  MAINTAINERS                                        |   7 +-
  accel/kvm/meson.build                              |   2 +-
  accel/meson.build                                  |   4 +-
  accel/tcg/meson.build                              |  10 +-
  target/i386/hax/meson.build                        |   2 +-
  target/i386/hvf/meson.build                        |   2 +-
  target/i386/whpx/meson.build                       |   2 +-
 files changed, 1565 insertions(+), 1065 deletions(-)
  create mode 100644 accel/accel-softmmu.h
  rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
  create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
  rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
  rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
  create mode 100644 include/hw/core/accel-cpu.h
  create mode 100644 include/hw/core/tcg-cpu-ops.h
  rename include/{sysemu => qemu}/accel.h (94%)
  create mode 100644 include/sysemu/accel-ops.h
  rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
  rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
  rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
  create mode 100644 accel/accel-common.c
  rename accel/{accel.c => accel-softmmu.c} (64%)
  create mode 100644 accel/accel-user.c
  rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
  rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
  rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
  rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
  rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
  rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
  rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
  rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

-[PULL 01/46] tcg/s390: Fix compare instruction from extended-immediate facility
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The code is currently comparing c2 to the type promotion of
-uint32_t and int32_t. That is, the conversion rules are as:
-  (common_type) c2 == (common_type) (uint32_t)
-                        (is_unsigned
-                        ? (uint32_t)c2
-                        : (uint32_t)(int32_t)c2)
-In the signed case we lose the desired sign extensions because
-of the argument promotion rules of the ternary operator.
-Solve the problem by doing the round-trip parsing through the
-intermediate type and back to the desired common type (all at
-one expression).
-Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
-Tested-by: Richard W.M. Jones <rjones@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reported-by: Richard W.M. Jones <rjones@redhat.com>
-Suggested-by: David Hildenbrand <david@redhat.com>
-Suggested-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/s390/tcg-target.c.inc | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.c.inc
-+++ b/tcg/s390/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
-                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
-                 tcg_out_insn_RIL(s, op, r1, c2);
-                 goto exit;
--            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
-+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
-                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
-                 tcg_out_insn_RIL(s, op, r1, c2);
-                 goto exit;
---
-.25.1

-[PULL 02/46] exec/cpu-defs: Remove TCG backends dependency
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-"exec/cpu-defs.h" contains generic CPU definitions for the
-TCG frontends (mostly related to TLB). TCG backends definitions
-aren't relevant here.
-See tcg/README description:
-) Backend
-  tcg-target.h contains the target specific definitions. tcg-target.c.inc
-  contains the target specific code; it is #included by tcg/tcg.c, rather
-  than being a standalone C file.
-So far only "tcg/tcg.h" requires these headers.
-Remove the "target-tcg.h" header dependency on TCG frontends, so we
-don't have to rebuild all frontends when hacking a single backend.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/exec/cpu-defs.h | 3 ---
-file changed, 3 deletions(-)
-diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-defs.h
-+++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/host-utils.h"
- #include "qemu/thread.h"
--#ifdef CONFIG_TCG
--#include "tcg-target.h"
--#endif
- #ifndef CONFIG_USER_ONLY
- #include "exec/hwaddr.h"
- #endif
---
-.25.1

-[PULL 33/46] cpu: Move cpu_exec_* to tcg_ops
+[PULL 01/20] linux-user/arm: Mark the commpage executable
-From: Eduardo Habkost <ehabkost@redhat.com>
+We're about to start validating PAGE_EXEC, which means
 that we've got to mark the commpage executable.  We had
 been placing the commpage outside of reserved_va, which
 was incorrect and lead to an abort.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-[claudio: wrapped target code in CONFIG_TCG]
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-6-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 12 ++++++------
+ linux-user/arm/target_cpu.h | 4 ++--
- accel/tcg/cpu-exec.c            | 12 ++++++------
+ linux-user/elfload.c        | 6 +++++-
- target/alpha/cpu.c              |  2 +-
+files changed, 7 insertions(+), 3 deletions(-)
  target/arm/cpu.c                |  2 +-
  target/arm/cpu64.c              |  5 ++++-
  target/arm/cpu_tcg.c            |  7 ++++++-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  6 +++---
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc | 16 ++++++++++------
 files changed, 54 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/linux-user/arm/target_cpu.h
-+++ b/include/hw/core/cpu.h
++++ b/linux-user/arm/target_cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
-      */
+     } else {
-     void (*synchronize_from_tb)(CPUState *cpu,
+         /*
-                                 const struct TranslationBlock *tb);
+          * We need to be able to map the commpage.
-+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+-         * See validate_guest_space in linux-user/elfload.c.
-+    void (*cpu_exec_enter)(CPUState *cpu);
++         * See init_guest_commpage in linux-user/elfload.c.
-+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+          */
-+    void (*cpu_exec_exit)(CPUState *cpu);
+-        return 0xffff0000ul;
-+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
++        return 0xfffffffful;
 +    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
  } TcgCpuOperations;
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
   *   gdb stub. Returns a pointer to the XML contents for the specified XML file
   *   or NULL if the CPU doesn't have a dynamically generated content for it.
 - * @cpu_exec_enter: Callback for cpu_exec preparation.
 - * @cpu_exec_exit: Callback for cpu_exec cleanup.
 - * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
   * @disas_set_info: Setup architecture specific components of disassembly info
   * @adjust_watchpoint_address: Perform a target-specific adjustment to an
   * address before attempting to match it against watchpoints.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      const char *gdb_core_xml_file;
      gchar * (*gdb_arch_name)(CPUState *cpu);
      const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
 -    void (*cpu_exec_enter)(CPUState *cpu);
 -    void (*cpu_exec_exit)(CPUState *cpu);
 -    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
      vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->cpu_exec_enter) {
 -        cc->cpu_exec_enter(cpu);
 +    if (cc->tcg_ops.cpu_exec_enter) {
 +        cc->tcg_ops.cpu_exec_enter(cpu);
      }
  }
+ #define MAX_RESERVED_VA  arm_max_reserved_va
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
  static bool init_guest_commpage(void)
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+-    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
++    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
--    if (cc->cpu_exec_exit) {
++    void *want = g2h_untagged(commpage);
--        cc->cpu_exec_exit(cpu);
+     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
-+    if (cc->tcg_ops.cpu_exec_exit) {
+                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
-+        cc->tcg_ops.cpu_exec_exit(cpu);
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
          perror("Protecting guest commpage");
          exit(EXIT_FAILURE);
      }
++
++    page_set_flags(commpage, commpage + qemu_host_page_size,
++                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
+     return true;
  }
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
-            True when it is, and we should restart on a new TB,
-            and via longjmp via cpu_loop_exit.  */
-         else {
--            if (cc->cpu_exec_interrupt &&
--                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
-+            if (cc->tcg_ops.cpu_exec_interrupt &&
-+                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
-                 if (need_replay_interrupt(interrupt_request)) {
-                     replay_interrupt();
-                 }
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = alpha_cpu_class_by_name;
-     cc->has_work = alpha_cpu_has_work;
-     cc->do_interrupt = alpha_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
-     cc->dump_state = alpha_cpu_dump_state;
-     cc->set_pc = alpha_cpu_set_pc;
-     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = arm_cpu_class_by_name;
-     cc->has_work = arm_cpu_has_work;
--    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
-     cc->dump_state = arm_cpu_dump_state;
-     cc->set_pc = arm_cpu_set_pc;
-     cc->gdb_read_register = arm_cpu_gdb_read_register;
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->disas_set_info = arm_disas_set_info;
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = arm_translate_init;
-+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-     cc->tlb_fill = arm_cpu_tlb_fill;
-     cc->debug_excp_handler = arm_debug_excp_handler;
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
- {
-     CPUClass *cc = CPU_CLASS(oc);
--    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
-+#ifdef CONFIG_TCG
-+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-+#endif /* CONFIG_TCG */
-+
-     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
-     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 34;
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@
- /* CPU models. These are not needed for the AArch64 linux-user build. */
- #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
-+#ifdef CONFIG_TCG
- static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- {
-     CPUClass *cc = CPU_GET_CLASS(cs);
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     }
-     return ret;
- }
-+#endif /* CONFIG_TCG */
- static void arm926_initfn(Object *obj)
- {
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
-     cc->do_interrupt = arm_v7m_cpu_do_interrupt;
- #endif
--    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-+#ifdef CONFIG_TCG
-+    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-+#endif /* CONFIG_TCG */
-+
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
- }
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->has_work = avr_cpu_has_work;
-     cc->do_interrupt = avr_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
-     cc->dump_state = avr_cpu_dump_state;
-     cc->set_pc = avr_cpu_set_pc;
-     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
-diff --git a/target/cris/cpu.c b/target/cris/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/cpu.c
-+++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = cris_cpu_class_by_name;
-     cc->has_work = cris_cpu_has_work;
-     cc->do_interrupt = cris_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
-     cc->dump_state = cris_cpu_dump_state;
-     cc->set_pc = cris_cpu_set_pc;
-     cc->gdb_read_register = cris_cpu_gdb_read_register;
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/cpu.c
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = hppa_cpu_class_by_name;
-     cc->has_work = hppa_cpu_has_work;
-     cc->do_interrupt = hppa_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
-     cc->dump_state = hppa_cpu_dump_state;
-     cc->set_pc = hppa_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
- void tcg_cpu_common_class_init(CPUClass *cc)
- {
-     cc->do_interrupt = x86_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
--    cc->cpu_exec_enter = x86_cpu_exec_enter;
--    cc->cpu_exec_exit = x86_cpu_exec_exit;
-+    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-+    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
-     cc->tcg_ops.initialize = tcg_x86_init;
-     cc->tlb_fill = x86_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = lm32_cpu_class_by_name;
-     cc->has_work = lm32_cpu_has_work;
-     cc->do_interrupt = lm32_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
-     cc->dump_state = lm32_cpu_dump_state;
-     cc->set_pc = lm32_cpu_set_pc;
-     cc->gdb_read_register = lm32_cpu_gdb_read_register;
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = m68k_cpu_class_by_name;
-     cc->has_work = m68k_cpu_has_work;
-     cc->do_interrupt = m68k_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
-     cc->dump_state = m68k_cpu_dump_state;
-     cc->set_pc = m68k_cpu_set_pc;
-     cc->gdb_read_register = m68k_cpu_gdb_read_register;
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->has_work = mb_cpu_has_work;
-     cc->do_interrupt = mb_cpu_do_interrupt;
-     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
--    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
-     cc->dump_state = mb_cpu_dump_state;
-     cc->set_pc = mb_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = mips_cpu_class_by_name;
-     cc->has_work = mips_cpu_has_work;
-     cc->do_interrupt = mips_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->dump_state = mips_cpu_dump_state;
-     cc->set_pc = mips_cpu_set_pc;
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->disas_set_info = mips_cpu_disas_set_info;
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = mips_tcg_init;
-+    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-     cc->tlb_fill = mips_cpu_tlb_fill;
- #endif
-diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/cpu.c
-+++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = nios2_cpu_class_by_name;
-     cc->has_work = nios2_cpu_has_work;
-     cc->do_interrupt = nios2_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
-     cc->dump_state = nios2_cpu_dump_state;
-     cc->set_pc = nios2_cpu_set_pc;
-     cc->disas_set_info = nios2_cpu_disas_set_info;
-diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/cpu.c
-+++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = openrisc_cpu_class_by_name;
-     cc->has_work = openrisc_cpu_has_work;
-     cc->do_interrupt = openrisc_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
-     cc->dump_state = openrisc_cpu_dump_state;
-     cc->set_pc = openrisc_cpu_set_pc;
-     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = riscv_cpu_class_by_name;
-     cc->has_work = riscv_cpu_has_work;
-     cc->do_interrupt = riscv_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
-     cc->dump_state = riscv_cpu_dump_state;
-     cc->set_pc = riscv_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
-diff --git a/target/rx/cpu.c b/target/rx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/rx/cpu.c
-+++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-     cc->class_by_name = rx_cpu_class_by_name;
-     cc->has_work = rx_cpu_has_work;
-     cc->do_interrupt = rx_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
-     cc->dump_state = rx_cpu_dump_state;
-     cc->set_pc = rx_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/cpu.c
-+++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-     cc->get_crash_info = s390_cpu_get_crash_info;
-     cc->write_elf64_note = s390_cpu_write_elf64_note;
- #ifdef CONFIG_TCG
--    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-     cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
-     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
- #endif
-diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/cpu.c
-+++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = superh_cpu_class_by_name;
-     cc->has_work = superh_cpu_has_work;
-     cc->do_interrupt = superh_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
-     cc->dump_state = superh_cpu_dump_state;
-     cc->set_pc = superh_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->parse_features = sparc_cpu_parse_features;
-     cc->has_work = sparc_cpu_has_work;
-     cc->do_interrupt = sparc_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
-     cc->dump_state = sparc_cpu_dump_state;
- #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
-     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
-diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/cpu.c
-+++ b/target/tilegx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = tilegx_cpu_class_by_name;
-     cc->has_work = tilegx_cpu_has_work;
-     cc->do_interrupt = tilegx_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
-     cc->dump_state = tilegx_cpu_dump_state;
-     cc->set_pc = tilegx_cpu_set_pc;
-     cc->tlb_fill = tilegx_cpu_tlb_fill;
-diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/unicore32/cpu.c
-+++ b/target/unicore32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = uc32_cpu_class_by_name;
-     cc->has_work = uc32_cpu_has_work;
-     cc->do_interrupt = uc32_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
-     cc->dump_state = uc32_cpu_dump_state;
-     cc->set_pc = uc32_cpu_set_pc;
-     cc->tlb_fill = uc32_cpu_tlb_fill;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = xtensa_cpu_class_by_name;
-     cc->has_work = xtensa_cpu_has_work;
-     cc->do_interrupt = xtensa_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
-+    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
-     cc->dump_state = xtensa_cpu_dump_state;
-     cc->set_pc = xtensa_cpu_set_pc;
-     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
-diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate_init.c.inc
-+++ b/target/ppc/translate_init.c.inc
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
- }
- #ifndef CONFIG_USER_ONLY
-+
- static bool ppc_cpu_is_big_endian(CPUState *cs)
- {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
-     return !msr_le;
- }
-+#ifdef CONFIG_TCG
- static void ppc_cpu_exec_enter(CPUState *cs)
- {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
-         vhc->cpu_exec_exit(cpu->vhyp, cpu);
-     }
- }
--#endif
-+#endif /* CONFIG_TCG */
-+
-+#endif /* !CONFIG_USER_ONLY */
- static void ppc_cpu_instance_init(Object *obj)
- {
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = ppc_cpu_class_by_name;
-     cc->has_work = ppc_cpu_has_work;
-     cc->do_interrupt = ppc_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-     cc->dump_state = ppc_cpu_dump_state;
-     cc->dump_statistics = ppc_cpu_dump_statistics;
-     cc->set_pc = ppc_cpu_set_pc;
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
- #endif
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = ppc_translate_init;
-+    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-     cc->tlb_fill = ppc_cpu_tlb_fill;
--#endif
- #ifndef CONFIG_USER_ONLY
--    cc->cpu_exec_enter = ppc_cpu_exec_enter;
--    cc->cpu_exec_exit = ppc_cpu_exec_exit;
--#endif
-+    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-+    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-+#endif /* !CONFIG_USER_ONLY */
-+#endif /* CONFIG_TCG */
-     cc->disas_set_info = ppc_disas_set_info;
 --
-.25.1
+.34.1

-[PULL 30/46] target/riscv: remove CONFIG_TCG, as it is always TCG
+[PULL 1/4] target/avr: Support probe argument to tlb_fill
-From: Claudio Fontana <cfontana@suse.de>
+While there are no target-specific nonfaulting probes,
 generic code may grow some uses at some point.
-for now only TCG is allowed as an accelerator for riscv,
+Note that the attrs argument was incorrect -- it should have
-so remove the CONFIG_TCG use.
+been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-3-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/riscv/cpu.c | 3 +--
+ target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 29 insertions(+), 17 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/avr/helper.c
-+++ b/target/riscv/cpu.c
++++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
- #endif
+                       MMUAccessType access_type, int mmu_idx,
-     cc->gdb_arch_name = riscv_gdb_arch_name;
+                       bool probe, uintptr_t retaddr)
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
+ {
--#ifdef CONFIG_TCG
+-    int prot = 0;
-     cc->tcg_ops.initialize = riscv_translate_init;
+-    MemTxAttrs attrs = {};
-     cc->tlb_fill = riscv_cpu_tlb_fill;
++    int prot, page_size = TARGET_PAGE_SIZE;
--#endif
+     uint32_t paddr;
-+
-     device_class_set_props(dc, riscv_cpu_properties);
+     address &= TARGET_PAGE_MASK;
      if (mmu_idx == MMU_CODE_IDX) {
 -        /* access to code in flash */
 +        /* Access to code in flash. */
          paddr = OFFSET_CODE + address;
          prot = PAGE_READ | PAGE_EXEC;
 -        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
 +        if (paddr >= OFFSET_DATA) {
 +            /*
 +             * This should not be possible via any architectural operations.
 +             * There is certainly not an exception that we can deliver.
 +             * Accept probing that might come from generic code.
 +             */
 +            if (probe) {
 +                return false;
 +            }
              error_report("execution left flash memory");
              abort();
          }
 -    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 -        /*
 -         * access to CPU registers, exit and rebuilt this TB to use full access
 -         * incase it touches specially handled registers like SREG or SP
 -         */
 -        AVRCPU *cpu = AVR_CPU(cs);
 -        CPUAVRState *env = &cpu->env;
 -        env->fullacc = 1;
 -        cpu_loop_exit_restore(cs, retaddr);
      } else {
 -        /* access to memory. nothing special */
 +        /* Access to memory. */
          paddr = OFFSET_DATA + address;
          prot = PAGE_READ | PAGE_WRITE;
 +        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
 +            /*
 +             * Access to CPU registers, exit and rebuilt this TB to use
 +             * full access in case it touches specially handled registers
 +             * like SREG or SP.  For probing, set page_size = 1, in order
 +             * to force tlb_fill to be called for the next access.
 +             */
 +            if (probe) {
 +                page_size = 1;
 +            } else {
 +                AVRCPU *cpu = AVR_CPU(cs);
 +                CPUAVRState *env = &cpu->env;
 +                env->fullacc = 1;
 +                cpu_loop_exit_restore(cs, retaddr);
 +            }
 +        }
      }
 -    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
 -                            mmu_idx, TARGET_PAGE_SIZE);
 -
 +    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
      return true;
  }
 --
-.25.1
+.34.1

-[PULL 43/46] cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
+[PULL 2/4] target/avr: Call avr_cpu_do_interrupt directly
-From: Claudio Fontana <cfontana@suse.de>
+There is no need to go through cc->tcg_ops when
 we know what value that must have.
-we cannot in principle make the TCG Operations field definitions
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-conditional on CONFIG_TCG in code that is included by both common_ss
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 and specific_ss modules.
 Therefore, what we can do safely to restrict the TCG fields to TCG-only
 builds, is to move all tcg cpu operations into a separate header file,
 which is only included by TCG, target-specific code.
 This leaves just a NULL pointer in the cpu.h for the non-TCG builds.
 This also tidies up the code in all targets a bit, having all TCG cpu
 operations neatly contained by a dedicated data struct.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-16-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 103 ++------------------------------
+ target/avr/helper.c | 5 ++---
- include/hw/core/tcg-cpu-ops.h   |  97 ++++++++++++++++++++++++++++++
+file changed, 2 insertions(+), 3 deletions(-)
  target/arm/internals.h          |   6 ++
  accel/tcg/cpu-exec.c            |  27 +++++----
  accel/tcg/cputlb.c              |  35 +++++++++--
  accel/tcg/user-exec.c           |   9 +--
  hw/mips/jazz.c                  |   7 ++-
  softmmu/physmem.c               |  13 ++--
  target/alpha/cpu.c              |  21 +++++--
  target/arm/cpu.c                |  41 ++++++++-----
  target/arm/cpu64.c              |   7 +--
  target/arm/cpu_tcg.c            |  28 +++++++--
  target/avr/cpu.c                |  19 ++++--
  target/avr/helper.c             |   5 +-
  target/cris/cpu.c               |  43 ++++++++-----
  target/cris/helper.c            |   5 +-
  target/hppa/cpu.c               |  22 ++++---
  target/i386/tcg/tcg-cpu.c       |  26 ++++----
  target/lm32/cpu.c               |  19 ++++--
  target/m68k/cpu.c               |  19 ++++--
  target/microblaze/cpu.c         |  25 +++++---
  target/mips/cpu.c               |  36 +++++++----
  target/moxie/cpu.c              |  15 ++++-
  target/nios2/cpu.c              |  18 ++++--
  target/openrisc/cpu.c           |  17 ++++--
  target/riscv/cpu.c              |  23 ++++---
  target/rx/cpu.c                 |  20 +++++--
  target/s390x/cpu.c              |  33 ++++++----
  target/sh4/cpu.c                |  21 +++++--
  target/sparc/cpu.c              |  25 +++++---
  target/tilegx/cpu.c             |  17 ++++--
  target/tricore/cpu.c            |  12 +++-
  target/unicore32/cpu.c          |  17 ++++--
  target/xtensa/cpu.c             |  23 ++++---
  target/ppc/translate_init.c.inc |  33 ++++++----
  MAINTAINERS                     |   1 +
 files changed, 582 insertions(+), 306 deletions(-)
  create mode 100644 include/hw/core/tcg-cpu-ops.h
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
- struct TranslationBlock;
--/**
-- * struct TcgCpuOperations: TCG operations specific to a CPU class
-- */
--typedef struct TcgCpuOperations {
--    /**
--     * @initialize: Initalize TCG state
--     *
--     * Called when the first CPU is realized.
--     */
--    void (*initialize)(void);
--    /**
--     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
--     *
--     * This is called when we abandon execution of a TB before starting it,
--     * and must set all parts of the CPU state which the previous TB in the
--     * chain may not have updated.
--     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
--     *
--     * If more state needs to be restored, the target must implement a
--     * function to restore all the state, and register it here.
--     */
--    void (*synchronize_from_tb)(CPUState *cpu,
--                                const struct TranslationBlock *tb);
--    /** @cpu_exec_enter: Callback for cpu_exec preparation */
--    void (*cpu_exec_enter)(CPUState *cpu);
--    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
--    void (*cpu_exec_exit)(CPUState *cpu);
--    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
--    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
--    /** @do_interrupt: Callback for interrupt handling. */
--    void (*do_interrupt)(CPUState *cpu);
--    /**
--     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
--     *
--     * For system mode, if the access is valid, call tlb_set_page
--     * and return true; if the access is invalid, and probe is
--     * true, return false; otherwise raise an exception and do
--     * not return.  For user-only mode, always raise an exception
--     * and do not return.
--     */
--    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
--                     MMUAccessType access_type, int mmu_idx,
--                     bool probe, uintptr_t retaddr);
--    /** @debug_excp_handler: Callback for handling debug exceptions */
--    void (*debug_excp_handler)(CPUState *cpu);
--
--    /**
--     * @do_transaction_failed: Callback for handling failed memory transactions
--     * (ie bus faults or external aborts; not MMU faults)
--     */
--    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
--                                  unsigned size, MMUAccessType access_type,
--                                  int mmu_idx, MemTxAttrs attrs,
--                                  MemTxResult response, uintptr_t retaddr);
--    /**
--     * @do_unaligned_access: Callback for unaligned access handling
--     */
--    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
--                                MMUAccessType access_type,
--                                int mmu_idx, uintptr_t retaddr);
--    /**
--     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
--     */
--    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
--
--    /**
--     * @debug_check_watchpoint: return true if the architectural
--     * watchpoint whose address has matched should really fire, used by ARM
--     */
--    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
--
--} TcgCpuOperations;
-+/* see tcg-cpu-ops.h */
-+struct TCGCPUOps;
- /**
-  * CPUClass:
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     int gdb_num_core_regs;
-     bool gdb_stop_before_watchpoint;
--    TcgCpuOperations tcg_ops;
-+    /* when TCG is not available, this pointer is NULL */
-+    struct TCGCPUOps *tcg_ops;
- };
- /*
-@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
- void cpu_interrupt(CPUState *cpu, int mask);
--static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
--                                        MMUAccessType access_type,
--                                        int mmu_idx, uintptr_t retaddr)
--{
--    CPUClass *cc = CPU_GET_CLASS(cpu);
--
--    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
--}
--
--static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
--                                          vaddr addr, unsigned size,
--                                          MMUAccessType access_type,
--                                          int mmu_idx, MemTxAttrs attrs,
--                                          MemTxResult response,
--                                          uintptr_t retaddr)
--{
--    CPUClass *cc = CPU_GET_CLASS(cpu);
--
--    if (!cpu->ignore_memory_transaction_failures &&
--        cc->tcg_ops.do_transaction_failed) {
--        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
--                                          access_type, mmu_idx, attrs,
--                                          response, retaddr);
--    }
--}
--
- /**
-  * cpu_set_pc:
-  * @cpu: The CPU to set the program counter for.
-diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/core/tcg-cpu-ops.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * TCG CPU-specific operations
-+ *
-+ * Copyright 2021 SUSE LLC
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef TCG_CPU_OPS_H
-+#define TCG_CPU_OPS_H
-+
-+#include "hw/core/cpu.h"
-+
-+struct TCGCPUOps {
-+    /**
-+     * @initialize: Initalize TCG state
-+     *
-+     * Called when the first CPU is realized.
-+     */
-+    void (*initialize)(void);
-+    /**
-+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-+     *
-+     * This is called when we abandon execution of a TB before starting it,
-+     * and must set all parts of the CPU state which the previous TB in the
-+     * chain may not have updated.
-+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
-+     *
-+     * If more state needs to be restored, the target must implement a
-+     * function to restore all the state, and register it here.
-+     */
-+    void (*synchronize_from_tb)(CPUState *cpu,
-+                                const struct TranslationBlock *tb);
-+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
-+    void (*cpu_exec_enter)(CPUState *cpu);
-+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
-+    void (*cpu_exec_exit)(CPUState *cpu);
-+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-+    /**
-+     * @do_interrupt: Callback for interrupt handling.
-+     *
-+     * note that this is in general SOFTMMU only, but it actually isn't
-+     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
-+     * in the SOFTMMU section in general.
-+     */
-+    void (*do_interrupt)(CPUState *cpu);
-+    /**
-+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-+     *
-+     * For system mode, if the access is valid, call tlb_set_page
-+     * and return true; if the access is invalid, and probe is
-+     * true, return false; otherwise raise an exception and do
-+     * not return.  For user-only mode, always raise an exception
-+     * and do not return.
-+     */
-+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-+                     MMUAccessType access_type, int mmu_idx,
-+                     bool probe, uintptr_t retaddr);
-+    /** @debug_excp_handler: Callback for handling debug exceptions */
-+    void (*debug_excp_handler)(CPUState *cpu);
-+
-+#ifdef NEED_CPU_H
-+#ifdef CONFIG_SOFTMMU
-+    /**
-+     * @do_transaction_failed: Callback for handling failed memory transactions
-+     * (ie bus faults or external aborts; not MMU faults)
-+     */
-+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-+                                  unsigned size, MMUAccessType access_type,
-+                                  int mmu_idx, MemTxAttrs attrs,
-+                                  MemTxResult response, uintptr_t retaddr);
-+    /**
-+     * @do_unaligned_access: Callback for unaligned access handling
-+     */
-+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-+                                MMUAccessType access_type,
-+                                int mmu_idx, uintptr_t retaddr);
-+
-+    /**
-+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
-+     */
-+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
-+
-+    /**
-+     * @debug_check_watchpoint: return true if the architectural
-+     * watchpoint whose address has matched should really fire, used by ARM
-+     */
-+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-+
-+#endif /* CONFIG_SOFTMMU */
-+#endif /* NEED_CPU_H */
-+
-+};
-+
-+#endif /* TCG_CPU_OPS_H */
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
- void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
- void arm_translate_init(void);
-+#ifdef CONFIG_TCG
-+void arm_cpu_synchronize_from_tb(CPUState *cs,
-+                                 const struct TranslationBlock *tb);
-+#endif /* CONFIG_TCG */
-+
-+
- enum arm_fprounding {
-     FPROUNDING_TIEEVEN,
-     FPROUNDING_POSINF,
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
- #include "qemu/qemu-print.h"
- #include "cpu.h"
-+#include "hw/core/tcg-cpu-ops.h"
- #include "trace.h"
- #include "disas/disas.h"
- #include "exec/exec-all.h"
-@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-                                TARGET_FMT_lx "] %s\n",
-                                last_tb->tc.ptr, last_tb->pc,
-                                lookup_symbol(last_tb->pc));
--        if (cc->tcg_ops.synchronize_from_tb) {
--            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
-+        if (cc->tcg_ops->synchronize_from_tb) {
-+            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
-         } else {
-             assert(cc->set_pc);
-             cc->set_pc(cpu, last_tb->pc);
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
- {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
--    if (cc->tcg_ops.cpu_exec_enter) {
--        cc->tcg_ops.cpu_exec_enter(cpu);
-+    if (cc->tcg_ops->cpu_exec_enter) {
-+        cc->tcg_ops->cpu_exec_enter(cpu);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
- {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
--    if (cc->tcg_ops.cpu_exec_exit) {
--        cc->tcg_ops.cpu_exec_exit(cpu);
-+    if (cc->tcg_ops->cpu_exec_exit) {
-+        cc->tcg_ops->cpu_exec_exit(cpu);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
-         }
-     }
--    if (cc->tcg_ops.debug_excp_handler) {
--        cc->tcg_ops.debug_excp_handler(cpu);
-+    if (cc->tcg_ops->debug_excp_handler) {
-+        cc->tcg_ops->debug_excp_handler(cpu);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
-            loop */
- #if defined(TARGET_I386)
-         CPUClass *cc = CPU_GET_CLASS(cpu);
--        cc->tcg_ops.do_interrupt(cpu);
-+        cc->tcg_ops->do_interrupt(cpu);
- #endif
-         *ret = cpu->exception_index;
-         cpu->exception_index = -1;
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
-         if (replay_exception()) {
-             CPUClass *cc = CPU_GET_CLASS(cpu);
-             qemu_mutex_lock_iothread();
--            cc->tcg_ops.do_interrupt(cpu);
-+            cc->tcg_ops->do_interrupt(cpu);
-             qemu_mutex_unlock_iothread();
-             cpu->exception_index = -1;
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
-            True when it is, and we should restart on a new TB,
-            and via longjmp via cpu_loop_exit.  */
-         else {
--            if (cc->tcg_ops.cpu_exec_interrupt &&
--                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
-+            if (cc->tcg_ops->cpu_exec_interrupt &&
-+                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
-                 if (need_replay_interrupt(interrupt_request)) {
-                     replay_interrupt();
-                 }
-@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
-     CPUClass *cc = CPU_GET_CLASS(cpu);
-     if (!tcg_target_initialized) {
--        cc->tcg_ops.initialize();
-+        cc->tcg_ops->initialize();
-         tcg_target_initialized = true;
-     }
-     tlb_init(cpu);
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu/main-loop.h"
- #include "cpu.h"
-+#include "hw/core/tcg-cpu-ops.h"
- #include "exec/exec-all.h"
- #include "exec/memory.h"
- #include "exec/address-spaces.h"
-@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
-      * This is not a probe, so only valid return is success; failure
-      * should result in exception + longjmp to the cpu loop.
-      */
--    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
--                              access_type, mmu_idx, false, retaddr);
-+    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
-+                               access_type, mmu_idx, false, retaddr);
-     assert(ok);
- }
-+static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-+                                        MMUAccessType access_type,
-+                                        int mmu_idx, uintptr_t retaddr)
-+{
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
-+
-+    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
-+}
-+
-+static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
-+                                          vaddr addr, unsigned size,
-+                                          MMUAccessType access_type,
-+                                          int mmu_idx, MemTxAttrs attrs,
-+                                          MemTxResult response,
-+                                          uintptr_t retaddr)
-+{
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
-+
-+    if (!cpu->ignore_memory_transaction_failures &&
-+        cc->tcg_ops->do_transaction_failed) {
-+        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
-+                                           access_type, mmu_idx, attrs,
-+                                           response, retaddr);
-+    }
-+}
-+
- static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
-                          MMUAccessType access_type, MemOp op)
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-             CPUState *cs = env_cpu(env);
-             CPUClass *cc = CPU_GET_CLASS(cs);
--            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
--                                      mmu_idx, nonfault, retaddr)) {
-+            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-+                                       mmu_idx, nonfault, retaddr)) {
-                 /* Non-faulting page table read failed.  */
-                 *phost = NULL;
-                 return TLB_INVALID_MASK;
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
- #include "cpu.h"
-+#include "hw/core/tcg-cpu-ops.h"
- #include "disas/disas.h"
- #include "exec/exec-all.h"
- #include "tcg/tcg.h"
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
-     clear_helper_retaddr();
-     cc = CPU_GET_CLASS(cpu);
--    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
--                         MMU_USER_IDX, false, pc);
-+    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
-+                          MMU_USER_IDX, false, pc);
-     g_assert_not_reached();
- }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-         } else {
-             CPUState *cpu = env_cpu(env);
-             CPUClass *cc = CPU_GET_CLASS(cpu);
--            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
--                                 MMU_USER_IDX, false, ra);
-+            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
-+                                  MMU_USER_IDX, false, ra);
-             g_assert_not_reached();
-         }
-     }
-diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/jazz.c
-+++ b/hw/mips/jazz.c
-@@ -XXX,XX +XXX,XX @@
- #include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "qemu/help_option.h"
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
- enum jazz_model_e {
-     JAZZ_MAGNUM,
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
-      */
-     cc = CPU_GET_CLASS(cpu);
- #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
--    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
--    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
-+    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
-+    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-     /* allocate RAM */
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
-+++ b/softmmu/physmem.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/cutils.h"
- #include "qemu/cacheflush.h"
- #include "cpu.h"
-+
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
-+
- #include "exec/exec-all.h"
- #include "exec/target_page.h"
- #include "hw/qdev-core.h"
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-         return;
-     }
--    if (cc->tcg_ops.adjust_watchpoint_address) {
-+    if (cc->tcg_ops->adjust_watchpoint_address) {
-         /* this is currently used only by ARM BE32 */
--        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
-+        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
-     }
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-         if (watchpoint_address_matches(wp, addr, len)
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-             wp->hitaddr = MAX(addr, wp->vaddr);
-             wp->hitattrs = attrs;
-             if (!cpu->watchpoint_hit) {
--                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
--                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
-+                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
-+                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
-                     wp->flags &= ~BP_WATCHPOINT_HIT;
-                     continue;
-                 }
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
- #endif
- }
-+#include "hw/core/tcg-cpu-ops.h"
-+
-+static struct TCGCPUOps alpha_tcg_ops = {
-+    .initialize = alpha_translate_init,
-+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
-+    .tlb_fill = alpha_cpu_tlb_fill,
-+
-+#ifndef CONFIG_USER_ONLY
-+    .do_interrupt = alpha_cpu_do_interrupt,
-+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
-+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
-+#endif /* !CONFIG_USER_ONLY */
-+};
-+
- static void alpha_cpu_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = alpha_cpu_class_by_name;
-     cc->has_work = alpha_cpu_has_work;
--    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
-     cc->dump_state = alpha_cpu_dump_state;
-     cc->set_pc = alpha_cpu_set_pc;
-     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-     cc->gdb_write_register = alpha_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
--    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_alpha_cpu;
- #endif
-     cc->disas_set_info = alpha_cpu_disas_set_info;
--    cc->tcg_ops.initialize = alpha_translate_init;
-+    cc->tcg_ops = &alpha_tcg_ops;
-     cc->gdb_num_core_regs = 67;
- }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #include "qapi/error.h"
- #include "qapi/visitor.h"
- #include "cpu.h"
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
- #include "internals.h"
- #include "exec/exec-all.h"
- #include "hw/qdev-properties.h"
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
- }
- #ifdef CONFIG_TCG
--static void arm_cpu_synchronize_from_tb(CPUState *cs,
--                                        const TranslationBlock *tb)
-+void arm_cpu_synchronize_from_tb(CPUState *cs,
-+                                 const TranslationBlock *tb)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
-@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-  found:
-     cs->exception_index = excp_idx;
-     env->exception.target_el = target_el;
--    cc->tcg_ops.do_interrupt(cs);
-+    cc->tcg_ops->do_interrupt(cs);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
-     return g_strdup("arm");
- }
-+#ifdef CONFIG_TCG
-+static struct TCGCPUOps arm_tcg_ops = {
-+    .initialize = arm_translate_init,
-+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-+    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
-+    .tlb_fill = arm_cpu_tlb_fill,
-+    .debug_excp_handler = arm_debug_excp_handler,
-+
-+#if !defined(CONFIG_USER_ONLY)
-+    .do_interrupt = arm_cpu_do_interrupt,
-+    .do_transaction_failed = arm_cpu_do_transaction_failed,
-+    .do_unaligned_access = arm_cpu_do_unaligned_access,
-+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-+    .debug_check_watchpoint = arm_debug_check_watchpoint,
-+#endif /* !CONFIG_USER_ONLY */
-+};
-+#endif /* CONFIG_TCG */
-+
- static void arm_cpu_class_init(ObjectClass *oc, void *data)
- {
-     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = arm_disas_set_info;
-+
- #ifdef CONFIG_TCG
--    cc->tcg_ops.initialize = arm_translate_init;
--    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
--    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
--    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
--    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
--#if !defined(CONFIG_USER_ONLY)
--    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
--    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
--    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
--    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
--    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
--#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-+    cc->tcg_ops = &arm_tcg_ops;
- #endif /* CONFIG_TCG */
- }
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qapi/error.h"
- #include "cpu.h"
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
- #include "qemu/module.h"
- #if !defined(CONFIG_USER_ONLY)
- #include "hw/loader.h"
-@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
- {
-     CPUClass *cc = CPU_CLASS(oc);
--#ifdef CONFIG_TCG
--    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
--#endif /* CONFIG_TCG */
--
-     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
-     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 34;
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "cpu.h"
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
- #include "internals.h"
- /* CPU models. These are not needed for the AArch64 linux-user build. */
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     if (interrupt_request & CPU_INTERRUPT_HARD
-         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-         cs->exception_index = EXCP_IRQ;
--        cc->tcg_ops.do_interrupt(cs);
-+        cc->tcg_ops->do_interrupt(cs);
-         ret = true;
-     }
-     return ret;
-@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
-     cpu->reset_sctlr = 0x00000078;
- }
-+#ifdef CONFIG_TCG
-+static struct TCGCPUOps arm_v7m_tcg_ops = {
-+    .initialize = arm_translate_init,
-+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-+    .tlb_fill = arm_cpu_tlb_fill,
-+    .debug_excp_handler = arm_debug_excp_handler,
-+
-+#if !defined(CONFIG_USER_ONLY)
-+    .do_interrupt = arm_v7m_cpu_do_interrupt,
-+    .do_transaction_failed = arm_cpu_do_transaction_failed,
-+    .do_unaligned_access = arm_cpu_do_unaligned_access,
-+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-+    .debug_check_watchpoint = arm_debug_check_watchpoint,
-+#endif /* !CONFIG_USER_ONLY */
-+};
-+#endif /* CONFIG_TCG */
-+
- static void arm_v7m_class_init(ObjectClass *oc, void *data)
- {
-     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
-     acc->info = data;
- #ifdef CONFIG_TCG
--    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
--#ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
--#endif
-+    cc->tcg_ops = &arm_v7m_tcg_ops;
- #endif /* CONFIG_TCG */
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-     qemu_fprintf(f, "\n");
- }
-+#include "hw/core/tcg-cpu-ops.h"
-+
-+static struct TCGCPUOps avr_tcg_ops = {
-+    .initialize = avr_cpu_tcg_init,
-+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
-+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
-+    .tlb_fill = avr_cpu_tlb_fill,
-+
-+#ifndef CONFIG_USER_ONLY
-+    .do_interrupt = avr_cpu_do_interrupt,
-+#endif /* !CONFIG_USER_ONLY */
-+};
-+
- static void avr_cpu_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = avr_cpu_class_by_name;
-     cc->has_work = avr_cpu_has_work;
--    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
-     cc->dump_state = avr_cpu_dump_state;
-     cc->set_pc = avr_cpu_set_pc;
-     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
-     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
--    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
-     cc->vmsd = &vms_avr_cpu;
-     cc->disas_set_info = avr_cpu_disas_set_info;
--    cc->tcg_ops.initialize = avr_cpu_tcg_init;
--    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
-     cc->gdb_read_register = avr_cpu_gdb_read_register;
-     cc->gdb_write_register = avr_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 35;
-     cc->gdb_core_xml_file = "avr-cpu.xml";
-+    cc->tcg_ops = &avr_tcg_ops;
- }
- /*
 diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/helper.c
 +++ b/target/avr/helper.c
 @@ -XXX,XX +XXX,XX @@
+ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- #include "qemu/osdep.h"
+ {
- #include "cpu.h"
+     bool ret = false;
-+#include "hw/core/tcg-cpu-ops.h"
+-    CPUClass *cc = CPU_GET_CLASS(cs);
- #include "exec/exec-all.h"
+     AVRCPU *cpu = AVR_CPU(cs);
- #include "exec/address-spaces.h"
+     CPUAVRState *env = &cpu->env;
- #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_RESET) {
          if (cpu_interrupts_enabled(env)) {
              cs->exception_index = EXCP_RESET;
--            cc->tcg_ops.do_interrupt(cs);
+-            cc->tcg_ops->do_interrupt(cs);
-+            cc->tcg_ops->do_interrupt(cs);
++            avr_cpu_do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 @@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
--            cc->tcg_ops.do_interrupt(cs);
+-            cc->tcg_ops->do_interrupt(cs);
-+            cc->tcg_ops->do_interrupt(cs);
++            avr_cpu_do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
-             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+             if (!env->intsrc) {
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
  #endif
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps crisv10_tcg_ops = {
 +    .initialize = cris_initialize_crisv10_tcg,
 +    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
 +    .tlb_fill = cris_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = crisv10_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
 +static struct TCGCPUOps crisv32_tcg_ops = {
 +    .initialize = cris_initialize_tcg,
 +    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
 +    .tlb_fill = cris_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = cris_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 8;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 9;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 10;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 11;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 17;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
  {
 +    CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 32;
 +    cc->tcg_ops = &crisv32_tcg_ops;
  }
  static void cris_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_cris_cpu;
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = cris_disas_set_info;
 -    cc->tcg_ops.initialize = cris_initialize_tcg;
  }
  #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/cris/helper.c b/target/cris/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/helper.c
 +++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "mmu.h"
  #include "qemu/host-utils.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          && (env->pregs[PR_CCS] & I_FLAG)
          && !env->locked_irq) {
          cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops.do_interrupt(cs);
 +        cc->tcg_ops->do_interrupt(cs);
          ret = true;
      }
      if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          }
          if ((env->pregs[PR_CCS] & m_flag_archval)) {
              cs->exception_index = EXCP_NMI;
 -            cc->tcg_ops.do_interrupt(cs);
 +            cc->tcg_ops->do_interrupt(cs);
              ret = true;
          }
      }
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
      return object_class_by_name(TYPE_HPPA_CPU);
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps hppa_tcg_ops = {
 +    .initialize = hppa_translate_init,
 +    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
 +    .tlb_fill = hppa_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = hppa_cpu_do_interrupt,
 +    .do_unaligned_access = hppa_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void hppa_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
 -    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
      dc->vmsd = &vmstate_hppa_cpu;
  #endif
      cc->disas_set_info = hppa_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = hppa_translate_init;
 -
      cc->gdb_num_core_regs = 128;
 +    cc->tcg_ops = &hppa_tcg_ops;
  }
  static const TypeInfo hppa_cpu_type_info = {
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
      cpu->env.eip = tb->pc - tb->cs_base;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps x86_tcg_ops = {
 +    .initialize = tcg_x86_init,
 +    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
 +    .cpu_exec_enter = x86_cpu_exec_enter,
 +    .cpu_exec_exit = x86_cpu_exec_exit,
 +    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
 +    .do_interrupt = x86_cpu_do_interrupt,
 +    .tlb_fill = x86_cpu_tlb_fill,
 +#ifndef CONFIG_USER_ONLY
 +    .debug_excp_handler = breakpoint_handler,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  void tcg_cpu_common_class_init(CPUClass *cc)
  {
 -    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
 -    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
 -    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
 -    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
 -    cc->tcg_ops.initialize = tcg_x86_init;
 -    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
 -#endif
 +    cc->tcg_ops = &x86_tcg_ops;
  }
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
      return oc;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps lm32_tcg_ops = {
 +    .initialize = lm32_translate_init,
 +    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
 +    .tlb_fill = lm32_cpu_tlb_fill,
 +    .debug_excp_handler = lm32_debug_excp_handler,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = lm32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void lm32_cpu_class_init(ObjectClass *oc, void *data)
  {
      LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = lm32_cpu_class_by_name;
      cc->has_work = lm32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
      cc->dump_state = lm32_cpu_dump_state;
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
      cc->gdb_write_register = lm32_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_lm32_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 7;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = lm32_translate_init;
 +    cc->tcg_ops = &lm32_tcg_ops;
  }
  #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
  };
  #endif
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps m68k_tcg_ops = {
 +    .initialize = m68k_tcg_init,
 +    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
 +    .tlb_fill = m68k_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = m68k_cpu_do_interrupt,
 +    .do_transaction_failed = m68k_cpu_transaction_failed,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void m68k_cpu_class_init(ObjectClass *c, void *data)
  {
      M68kCPUClass *mcc = M68K_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = m68k_cpu_class_by_name;
      cc->has_work = m68k_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
 -    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
      cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_m68k_cpu;
  #endif
      cc->disas_set_info = m68k_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = m68k_tcg_init;
      cc->gdb_num_core_regs = 18;
 +    cc->tcg_ops = &m68k_tcg_ops;
  }
  static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
      return object_class_by_name(TYPE_MICROBLAZE_CPU);
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps mb_tcg_ops = {
 +    .initialize = mb_tcg_init,
 +    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
 +    .tlb_fill = mb_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = mb_cpu_do_interrupt,
 +    .do_transaction_failed = mb_cpu_transaction_failed,
 +    .do_unaligned_access = mb_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void mb_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = mb_cpu_class_by_name;
      cc->has_work = mb_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
 +
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 +
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
      dc->vmsd = &vmstate_mb_cpu;
  #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_num_core_regs = 32 + 27;
      cc->disas_set_info = mb_disas_set_info;
 -    cc->tcg_ops.initialize = mb_tcg_init;
 +    cc->tcg_ops = &mb_tcg_ops;
  }
  static const TypeInfo mb_cpu_type_info = {
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
      DEFINE_PROP_END_OF_LIST()
  };
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +/*
 + * NB: cannot be const, as some elements are changed for specific
 + * mips hardware (see hw/mips/jazz.c).
 + */
 +static struct TCGCPUOps mips_tcg_ops = {
 +    .initialize = mips_tcg_init,
 +    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
 +    .tlb_fill = mips_cpu_tlb_fill,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .do_interrupt = mips_cpu_do_interrupt,
 +    .do_transaction_failed = mips_cpu_do_transaction_failed,
 +    .do_unaligned_access = mips_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void mips_cpu_class_init(ObjectClass *c, void *data)
  {
      MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->vmsd = &vmstate_mips_cpu;
  #endif
      cc->disas_set_info = mips_cpu_disas_set_info;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = mips_tcg_init;
 -    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
 -    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
 -    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
 -
 -#endif /* CONFIG_USER_ONLY */
 -#endif /* CONFIG_TCG */
 -
      cc->gdb_num_core_regs = 73;
      cc->gdb_stop_before_watchpoint = true;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &mips_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo mips_cpu_type_info = {
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
      return oc;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps moxie_tcg_ops = {
 +    .initialize = moxie_translate_init,
 +    .tlb_fill = moxie_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = moxie_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void moxie_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = moxie_cpu_class_by_name;
      cc->has_work = moxie_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_moxie_cpu;
  #endif
      cc->disas_set_info = moxie_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = moxie_translate_init;
 +    cc->tcg_ops = &moxie_tcg_ops;
  }
  static void moxielite_initfn(Object *obj)
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps nios2_tcg_ops = {
 +    .initialize = nios2_tcg_init,
 +    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
 +    .tlb_fill = nios2_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = nios2_cpu_do_interrupt,
 +    .do_unaligned_access = nios2_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
  static void nios2_cpu_class_init(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 -    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
  #endif
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
      cc->gdb_write_register = nios2_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 49;
 -    cc->tcg_ops.initialize = nios2_tcg_init;
 +    cc->tcg_ops = &nios2_tcg_ops;
  }
  static const TypeInfo nios2_cpu_type_info = {
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
                        | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps openrisc_tcg_ops = {
 +    .initialize = openrisc_translate_init,
 +    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
 +    .tlb_fill = openrisc_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = openrisc_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
  {
      OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
      cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_openrisc_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 3;
 -    cc->tcg_ops.initialize = openrisc_translate_init;
      cc->disas_set_info = openrisc_disas_set_info;
 +    cc->tcg_ops = &openrisc_tcg_ops;
  }
  /* Sort alphabetically by type name, except for "any". */
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
      return NULL;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps riscv_tcg_ops = {
 +    .initialize = riscv_translate_init,
 +    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
 +    .tlb_fill = riscv_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = riscv_cpu_do_interrupt,
 +    .do_transaction_failed = riscv_cpu_do_transaction_failed,
 +    .do_unaligned_access = riscv_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
      cc->vmsd = &vmstate_riscv_cpu;
  #endif
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
 -    cc->tcg_ops.initialize = riscv_translate_init;
 -    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
 +    cc->tcg_ops = &riscv_tcg_ops;
      device_class_set_props(dc, riscv_cpu_properties);
  }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
      qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps rx_tcg_ops = {
 +    .initialize = rx_translate_init,
 +    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
 +    .tlb_fill = rx_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = rx_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void rx_cpu_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
 +
      cc->gdb_read_register = rx_cpu_gdb_read_register;
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = rx_translate_init;
 -    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
      cc->gdb_core_xml_file = "rx-core.xml";
 +    cc->tcg_ops = &rx_tcg_ops;
  }
  static const TypeInfo rx_cpu_info = {
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
      return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
  }
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps s390_tcg_ops = {
 +    .initialize = s390x_translate_init,
 +    .tlb_fill = s390_cpu_tlb_fill,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
 +    .do_interrupt = s390_cpu_do_interrupt,
 +    .debug_excp_handler = s390x_cpu_debug_excp_handler,
 +    .do_unaligned_access = s390x_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void s390_cpu_class_init(ObjectClass *oc, void *data)
  {
      S390CPUClass *scc = S390_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      scc->reset = s390_cpu_reset;
      cc->class_by_name = s390_cpu_class_by_name,
      cc->has_work = s390_cpu_has_work;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
 -#endif
      cc->dump_state = s390_cpu_dump_state;
      cc->set_pc = s390_cpu_set_pc;
      cc->gdb_read_register = s390_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_s390_cpu;
      cc->get_crash_info = s390_cpu_get_crash_info;
      cc->write_elf64_note = s390_cpu_write_elf64_note;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
 -    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 -#endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = s390x_translate_init;
 -    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 -#endif
 -
      cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
      cc->gdb_core_xml_file = "s390x-core64.xml";
      cc->gdb_arch_name = s390_gdb_arch_name;
      s390_cpu_model_class_register_props(oc);
 +
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &s390_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo s390_cpu_type_info = {
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
      .unmigratable = 1,
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps superh_tcg_ops = {
 +    .initialize = sh4_translate_init,
 +    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
 +    .tlb_fill = superh_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = superh_cpu_do_interrupt,
 +    .do_unaligned_access = superh_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void superh_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = sh4_translate_init;
      cc->gdb_num_core_regs = 59;
      dc->vmsd = &vmstate_sh_cpu;
 +    cc->tcg_ops = &superh_tcg_ops;
  }
  #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
      DEFINE_PROP_END_OF_LIST()
  };
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps sparc_tcg_ops = {
 +    .initialize = sparc_tcg_init,
 +    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
 +    .tlb_fill = sparc_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = sparc_cpu_do_interrupt,
 +    .do_transaction_failed = sparc_cpu_do_transaction_failed,
 +    .do_unaligned_access = sparc_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void sparc_cpu_class_init(ObjectClass *oc, void *data)
  {
      SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = sparc_cpu_class_by_name;
      cc->parse_features = sparc_cpu_parse_features;
      cc->has_work = sparc_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
      cc->dump_state = sparc_cpu_dump_state;
  #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
      cc->disas_set_info = cpu_sparc_disas_set_info;
 -    cc->tcg_ops.initialize = sparc_tcg_init;
  #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
      cc->gdb_num_core_regs = 86;
  #else
      cc->gdb_num_core_regs = 72;
  #endif
 +    cc->tcg_ops = &sparc_tcg_ops;
  }
  static const TypeInfo sparc_cpu_type_info = {
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      return false;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps tilegx_tcg_ops = {
 +    .initialize = tilegx_tcg_init,
 +    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
 +    .tlb_fill = tilegx_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = tilegx_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
 -    cc->tcg_ops.initialize = tilegx_tcg_init;
 +    cc->tcg_ops = &tilegx_tcg_ops;
  }
  static const TypeInfo tilegx_cpu_type_info = {
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
      set_feature(&cpu->env, TRICORE_FEATURE_161);
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps tricore_tcg_ops = {
 +    .initialize = tricore_tcg_init,
 +    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
 +    .tlb_fill = tricore_cpu_tlb_fill,
 +};
 +
  static void tricore_cpu_class_init(ObjectClass *c, void *data)
  {
      TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->dump_state = tricore_cpu_dump_state;
      cc->set_pc = tricore_cpu_set_pc;
 -    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
 -    cc->tcg_ops.initialize = tricore_tcg_init;
 -    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
 +    cc->tcg_ops = &tricore_tcg_ops;
  }
  #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
      .unmigratable = 1,
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps uc32_tcg_ops = {
 +    .initialize = uc32_translate_init,
 +    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
 +    .tlb_fill = uc32_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = uc32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void uc32_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
 -    cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
 +    cc->tcg_ops = &uc32_tcg_ops;
  }
  #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
      .unmigratable = 1,
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps xtensa_tcg_ops = {
 +    .initialize = xtensa_translate_init,
 +    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
 +    .tlb_fill = xtensa_cpu_tlb_fill,
 +    .debug_excp_handler = xtensa_breakpoint_handler,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = xtensa_cpu_do_interrupt,
 +    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
 +    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 -    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 -    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
 +    cc->tcg_ops = &xtensa_tcg_ops;
  }
  static const TypeInfo xtensa_cpu_type_info = {
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
      DEFINE_PROP_END_OF_LIST(),
  };
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps ppc_tcg_ops = {
 +  .initialize = ppc_translate_init,
 +  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
 +  .tlb_fill = ppc_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +  .do_interrupt = ppc_cpu_do_interrupt,
 +  .cpu_exec_enter = ppc_cpu_exec_enter,
 +  .cpu_exec_exit = ppc_cpu_exec_exit,
 +  .do_unaligned_access = ppc_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  {
      PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
  #endif
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = ppc_translate_init;
 -    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 -    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
 -    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 -    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 -    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
 -#endif /* !CONFIG_USER_ONLY */
 -#endif /* CONFIG_TCG */
 -
      cc->disas_set_info = ppc_disas_set_info;
      dc->fw_name = "PowerPC,UNKNOWN";
 +
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &ppc_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo ppc_cpu_type_info = {
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
  F: include/exec/tb-hash.h
  F: include/sysemu/cpus.h
  F: include/sysemu/tcg.h
 +F: include/hw/core/tcg-cpu-ops.h
  FPU emulation
  M: Aurelien Jarno <aurelien@aurel32.net>
 --
-.25.1
+.34.1

-[PULL 41/46] cpu: move adjust_watchpoint_address to tcg_ops
+[PULL 02/20] linux-user/hppa: Allocate page zero as a commpage
-From: Claudio Fontana <cfontana@suse.de>
+We're about to start validating PAGE_EXEC, which means that we've
 got to mark page zero executable.  We had been special casing this
 entirely within translate.
-commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 introduced this ARM-specific, TCG-specific hack to adjust the address,
 before checking it with cpu_check_watchpoint.
 Make adjust_watchpoint_address optional and move it to tcg_ops.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-14-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 6 +++++-
+ linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
- hw/core/cpu.c         | 6 ------
+file changed, 31 insertions(+), 3 deletions(-)
  softmmu/physmem.c     | 5 ++++-
  target/arm/cpu.c      | 2 +-
 files changed, 10 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/linux-user/elfload.c
-+++ b/include/hw/core/cpu.h
++++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
-     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+     regs->gr[31] = infop->entry;
-                                 MMUAccessType access_type,
+ }
-                                 int mmu_idx, uintptr_t retaddr);
-+    /**
++#define LO_COMMPAGE  0
-+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
++
 +static bool init_guest_commpage(void)
 +{
 +    void *want = g2h_untagged(LO_COMMPAGE);
 +    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
 +                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 +
 +    if (addr == MAP_FAILED) {
 +        perror("Allocating guest commpage");
 +        exit(EXIT_FAILURE);
 +    }
 +    if (addr != want) {
 +        return false;
 +    }
 +
 +    /*
 +     * On Linux, page zero is normally marked execute only + gateway.
 +     * Normal read or write is supposed to fail (thus PROT_NONE above),
 +     * but specific offsets have kernel code mapped to raise permissions
 +     * and implement syscalls.  Here, simply mark the page executable.
 +     * Special case the entry points during translation (see do_page_zero).
 +     */
-+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
++    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
 +                   PAGE_EXEC | PAGE_VALID);
 +    return true;
 +}
 +
- } TcgCpuOperations;
+ #endif /* TARGET_HPPA */
- /**
+ #ifdef TARGET_XTENSA
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
      const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
 -    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
      return cpu->cpu_index;
  }
--static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
+ #if defined(HI_COMMPAGE)
--{
+-#define LO_COMMPAGE 0
--    return addr;
++#define LO_COMMPAGE -1
--}
+ #elif defined(LO_COMMPAGE)
--
+ #define HI_COMMPAGE 0
- static Property cpu_common_props[] = {
+ #else
- #ifndef CONFIG_USER_ONLY
+ #define HI_COMMPAGE 0
-     /* Create a memory property for softmmu CPU object,
+-#define LO_COMMPAGE 0
-@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
++#define LO_COMMPAGE -1
-     k->gdb_write_register = cpu_common_gdb_write_register;
+ #define init_guest_commpage() true
-     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
+ #endif
-     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
--    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
+@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
-     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
+         } else {
-     dc->realize = cpu_common_realizefn;
+             offset = -(HI_COMMPAGE & -align);
-     dc->unrealize = cpu_common_unrealizefn;
+         }
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+-    } else if (LO_COMMPAGE != 0) {
-index XXXXXXX..XXXXXXX 100644
++    } else if (LO_COMMPAGE != -1) {
---- a/softmmu/physmem.c
+         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
          return;
      }
--    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-+    if (cc->tcg_ops.adjust_watchpoint_address) {
-+        /* this is currently used only by ARM BE32 */
-+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
-+    }
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-         if (watchpoint_address_matches(wp, addr, len)
-             && (wp->flags & flags)) {
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
- #if !defined(CONFIG_USER_ONLY)
-     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
--    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
-+    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
- #endif /* CONFIG_TCG */
 --
-.25.1
+.34.1

-[PULL 03/46] tcg/aarch64: Do not convert TCGArg to temps that are not temps
+[PULL 03/20] linux-user/x86_64: Allocate vsyscall page as a commpage
-Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
+We're about to start validating PAGE_EXEC, which means that we've
-argument is an integer, not a temporary, which now tickles
+got to mark the vsyscall page executable.  We had been special
-an assert added in e89b28a6350.
+casing this entirely within translate.
-Previously, the value computed into v2 would be garbage for
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-rotli_vec, but as the value was unused it caused no harm.
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/aarch64/tcg-target.c.inc | 7 ++++---
+ linux-user/elfload.c | 23 +++++++++++++++++++++++
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 23 insertions(+)
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
+--- a/linux-user/elfload.c
-+++ b/tcg/aarch64/tcg-target.c.inc
++++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
+@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
-     v0 = temp_tcgv_vec(arg_temp(a0));
+     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
      v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
      a2 = va_arg(va, TCGArg);
 -    v2 = temp_tcgv_vec(arg_temp(a2));
 +    va_end(va);
      switch (opc) {
      case INDEX_op_rotli_vec:
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
      case INDEX_op_shrv_vec:
      case INDEX_op_sarv_vec:
          /* Right shifts are negative left shifts for AArch64.  */
 +        v2 = temp_tcgv_vec(arg_temp(a2));
          t1 = tcg_temp_new_vec(type);
          tcg_gen_neg_vec(vece, t1, v2);
          opc = (opc == INDEX_op_shrv_vec
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
          break;
      case INDEX_op_rotlv_vec:
 +        v2 = temp_tcgv_vec(arg_temp(a2));
          t1 = tcg_temp_new_vec(type);
          c1 = tcg_constant_vec(type, vece, 8 << vece);
          tcg_gen_sub_vec(vece, t1, v2, c1);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
          break;
      case INDEX_op_rotrv_vec:
 +        v2 = temp_tcgv_vec(arg_temp(a2));
          t1 = tcg_temp_new_vec(type);
          t2 = tcg_temp_new_vec(type);
          c1 = tcg_constant_vec(type, vece, 8 << vece);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
      default:
          g_assert_not_reached();
      }
 -
 -    va_end(va);
  }
- static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
++#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
 +#define INIT_GUEST_COMMPAGE
 +static bool init_guest_commpage(void)
 +{
 +    /*
 +     * The vsyscall page is at a high negative address aka kernel space,
 +     * which means that we cannot actually allocate it with target_mmap.
 +     * We still should be able to use page_set_flags, unless the user
 +     * has specified -R reserved_va, which would trigger an assert().
 +     */
 +    if (reserved_va != 0 &&
 +        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
 +        error_report("Cannot allocate vsyscall page");
 +        exit(EXIT_FAILURE);
 +    }
 +    page_set_flags(TARGET_VSYSCALL_PAGE,
 +                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
 +                   PAGE_EXEC | PAGE_VALID);
 +    return true;
 +}
 +#endif
  #else
  #define ELF_START_MMAP 0x80000000
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
  #else
  #define HI_COMMPAGE 0
  #define LO_COMMPAGE -1
 +#ifndef INIT_GUEST_COMMPAGE
  #define init_guest_commpage() true
  #endif
 +#endif
  static void pgb_fail_in_use(const char *image_name)
  {
 --
-.25.1
+.34.1

-[PULL 04/46] configure: Fix --enable-tcg-interpreter
+Deleted patch
-The configure option was backward, and we failed to
-pass the value on to meson.
-Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
-Tested-by: Stefan Weil <sw@weilnetz.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- configure | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ for opt do
-   ;;
-   --enable-whpx) whpx="enabled"
-   ;;
--  --disable-tcg-interpreter) tcg_interpreter="true"
-+  --disable-tcg-interpreter) tcg_interpreter="false"
-   ;;
--  --enable-tcg-interpreter) tcg_interpreter="false"
-+  --enable-tcg-interpreter) tcg_interpreter="true"
-   ;;
-   --disable-cap-ng)  cap_ng="disabled"
-   ;;
-@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
-         -Dvhost_user_blk_server=$vhost_user_blk_server \
-         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
-         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
-+    -Dtcg_interpreter=$tcg_interpreter \
-         $cross_arg \
-         "$PWD" "$source_path"
---
-.25.1

-[PULL 35/46] cpu: Move debug_excp_handler to tcg_ops
+[PULL 3/4] target/avr: Only execute one interrupt at a time
-From: Eduardo Habkost <ehabkost@redhat.com>
+We cannot deliver two interrupts simultaneously;
 the first interrupt handler must execute first.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-8-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 4 ++--
+ target/avr/helper.c | 9 +++------
- accel/tcg/cpu-exec.c      | 4 ++--
+file changed, 3 insertions(+), 6 deletions(-)
  target/arm/cpu.c          | 2 +-
  target/i386/tcg/tcg-cpu.c | 2 +-
  target/lm32/cpu.c         | 2 +-
  target/s390x/cpu.c        | 2 +-
  target/xtensa/cpu.c       | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/avr/helper.c
-+++ b/include/hw/core/cpu.h
++++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@
-     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                      MMUAccessType access_type, int mmu_idx,
+ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-                      bool probe, uintptr_t retaddr);
+ {
-+    /** @debug_excp_handler: Callback for handling debug exceptions */
+-    bool ret = false;
-+    void (*debug_excp_handler)(CPUState *cpu);
+     AVRCPU *cpu = AVR_CPU(cs);
+     CPUAVRState *env = &cpu->env;
- } TcgCpuOperations;
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+             avr_cpu_do_interrupt(cs);
-  * @gdb_write_register: Callback for letting GDB write a register.
-  * @debug_check_watchpoint: Callback: return true if the architectural
+             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
-  *       watchpoint whose address has matched should really fire.
+-
-- * @debug_excp_handler: Callback for handling debug exceptions.
+-            ret = true;
-  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
++            return true;
   * 64-bit VM coredump.
   * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
      int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
      bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 -    void (*debug_excp_handler)(CPUState *cpu);
      int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                              int cpuid, void *opaque);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
          }
      }
+     if (interrupt_request & CPU_INTERRUPT_HARD) {
--    if (cc->debug_excp_handler) {
+@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
--        cc->debug_excp_handler(cpu);
+             if (!env->intsrc) {
-+    if (cc->tcg_ops.debug_excp_handler) {
+                 cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
-+        cc->tcg_ops.debug_excp_handler(cpu);
+             }
 -
 -            ret = true;
 +            return true;
          }
      }
+-    return ret;
++    return false;
  }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+ void avr_cpu_do_interrupt(CPUState *cs)
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
 -    cc->debug_excp_handler = arm_debug_excp_handler;
 +    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
      cc->do_unaligned_access = arm_cpu_do_unaligned_access;
  #if !defined(CONFIG_USER_ONLY)
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
      cc->tcg_ops.initialize = tcg_x86_init;
      cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->debug_excp_handler = breakpoint_handler;
 +    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
  #endif
  }
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->gdb_num_core_regs = 32 + 7;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->debug_excp_handler = lm32_debug_excp_handler;
 +    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
      cc->tcg_ops.initialize = lm32_translate_init;
  }
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->write_elf64_note = s390_cpu_write_elf64_note;
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
 -    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
 +    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
      cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 -    cc->debug_excp_handler = xtensa_breakpoint_handler;
 +    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
      cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
 --
-.25.1
+.34.1

-[PULL 37/46] cpu: move cc->do_interrupt to tcg_ops
+[PULL 4/4] target/avr: Disable interrupts when env->skip set
-From: Claudio Fontana <cfontana@suse.de>
+This bit is not saved across interrupts, so we must
 delay delivering the interrupt until the skip has
 been processed.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210204163931.7358-10-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           |  4 ++--
+ target/avr/helper.c    |  9 +++++++++
- accel/tcg/cpu-exec.c            |  4 ++--
+ target/avr/translate.c | 26 ++++++++++++++++++++++----
- target/alpha/cpu.c              |  2 +-
+files changed, 31 insertions(+), 4 deletions(-)
  target/arm/cpu.c                |  4 ++--
  target/arm/cpu_tcg.c            |  9 ++++-----
  target/avr/cpu.c                |  2 +-
  target/avr/helper.c             |  4 ++--
  target/cris/cpu.c               | 12 ++++++------
  target/cris/helper.c            |  4 ++--
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  4 ++--
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 41 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-     void (*cpu_exec_exit)(CPUState *cpu);
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-+    /** @do_interrupt: Callback for interrupt handling. */
-+    void (*do_interrupt)(CPUState *cpu);
-     /**
-      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-      *
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  * @parse_features: Callback to parse command line arguments.
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
-  * @has_work: Callback for checking if there is work to do.
-- * @do_interrupt: Callback for interrupt handling.
-  * @do_unaligned_access: Callback for unaligned access handling, if
-  * the target defines #TARGET_ALIGNED_ONLY.
-  * @do_transaction_failed: Callback for handling failed memory transactions
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     int reset_dump_flags;
-     bool (*has_work)(CPUState *cpu);
--    void (*do_interrupt)(CPUState *cpu);
-     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                 MMUAccessType access_type,
-                                 int mmu_idx, uintptr_t retaddr);
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
-            loop */
- #if defined(TARGET_I386)
-         CPUClass *cc = CPU_GET_CLASS(cpu);
--        cc->do_interrupt(cpu);
-+        cc->tcg_ops.do_interrupt(cpu);
- #endif
-         *ret = cpu->exception_index;
-         cpu->exception_index = -1;
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
-         if (replay_exception()) {
-             CPUClass *cc = CPU_GET_CLASS(cpu);
-             qemu_mutex_lock_iothread();
--            cc->do_interrupt(cpu);
-+            cc->tcg_ops.do_interrupt(cpu);
-             qemu_mutex_unlock_iothread();
-             cpu->exception_index = -1;
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = alpha_cpu_class_by_name;
-     cc->has_work = alpha_cpu_has_work;
--    cc->do_interrupt = alpha_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
-     cc->dump_state = alpha_cpu_dump_state;
-     cc->set_pc = alpha_cpu_set_pc;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-  found:
-     cs->exception_index = excp_idx;
-     env->exception.target_el = target_el;
--    cc->do_interrupt(cs);
-+    cc->tcg_ops.do_interrupt(cs);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_read_register = arm_cpu_gdb_read_register;
-     cc->gdb_write_register = arm_cpu_gdb_write_register;
- #ifndef CONFIG_USER_ONLY
--    cc->do_interrupt = arm_cpu_do_interrupt;
-     cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
-     cc->asidx_from_attrs = arm_asidx_from_attrs;
-     cc->vmsd = &vmstate_arm_cpu;
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
- #if !defined(CONFIG_USER_ONLY)
-     cc->do_transaction_failed = arm_cpu_do_transaction_failed;
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
-+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
- #endif
- }
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     if (interrupt_request & CPU_INTERRUPT_HARD
-         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-         cs->exception_index = EXCP_IRQ;
--        cc->do_interrupt(cs);
-+        cc->tcg_ops.do_interrupt(cs);
-         ret = true;
-     }
-     return ret;
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
-     CPUClass *cc = CPU_CLASS(oc);
-     acc->info = data;
--#ifndef CONFIG_USER_ONLY
--    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
--#endif
--
- #ifdef CONFIG_TCG
-     cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-+#ifndef CONFIG_USER_ONLY
-+    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
-+#endif
- #endif /* CONFIG_TCG */
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = avr_cpu_class_by_name;
-     cc->has_work = avr_cpu_has_work;
--    cc->do_interrupt = avr_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
-     cc->dump_state = avr_cpu_dump_state;
-     cc->set_pc = avr_cpu_set_pc;
 diff --git a/target/avr/helper.c b/target/avr/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/helper.c
 +++ b/target/avr/helper.c
 @@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+     AVRCPU *cpu = AVR_CPU(cs);
+     CPUAVRState *env = &cpu->env;
++    /*
++     * We cannot separate a skip from the next instruction,
++     * as the skip would not be preserved across the interrupt.
++     * Separating the two insn normally only happens at page boundaries.
++     */
++    if (env->skip) {
++        return false;
++    }
++
      if (interrupt_request & CPU_INTERRUPT_RESET) {
          if (cpu_interrupts_enabled(env)) {
              cs->exception_index = EXCP_RESET;
--            cc->do_interrupt(cs);
+diff --git a/target/avr/translate.c b/target/avr/translate.c
 +            cc->tcg_ops.do_interrupt(cs);
              cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
              int index = ctz32(env->intsrc);
              cs->exception_index = EXCP_INT(index);
 -            cc->do_interrupt(cs);
 +            cc->tcg_ops.do_interrupt(cs);
              env->intsrc &= env->intsrc - 1; /* clear the interrupt */
              cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/cris/cpu.c
+--- a/target/avr/translate.c
-+++ b/target/cris/cpu.c
++++ b/target/avr/translate.c
-@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+     if (skip_label) {
+         canonicalize_skip(ctx);
-     ccc->vr = 8;
+         gen_set_label(skip_label);
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
+-        if (ctx->base.is_jmp == DISAS_NORETURN) {
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
++
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
++        switch (ctx->base.is_jmp) {
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
++        case DISAS_NORETURN:
- }
+             ctx->base.is_jmp = DISAS_CHAIN;
-@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
++            break;
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
++        case DISAS_NEXT:
++            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
-     ccc->vr = 9;
++                ctx->base.is_jmp = DISAS_TOO_MANY;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
++            }
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
++            break;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
++        default:
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
++            break;
  }
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 10;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 11;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 17;
 -    cc->do_interrupt = crisv10_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
      cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
 -    cc->do_interrupt = cris_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
 diff --git a/target/cris/helper.c b/target/cris/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/helper.c
 +++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          && (env->pregs[PR_CCS] & I_FLAG)
          && !env->locked_irq) {
          cs->exception_index = EXCP_IRQ;
 -        cc->do_interrupt(cs);
 +        cc->tcg_ops.do_interrupt(cs);
          ret = true;
      }
      if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          }
          if ((env->pregs[PR_CCS] & m_flag_archval)) {
              cs->exception_index = EXCP_NMI;
 -            cc->do_interrupt(cs);
 +            cc->tcg_ops.do_interrupt(cs);
              ret = true;
          }
      }
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
 -    cc->do_interrupt = hppa_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  void tcg_cpu_common_class_init(CPUClass *cc)
  {
--    cc->do_interrupt = x86_cpu_do_interrupt;
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
+     bool nonconst_skip = canonicalize_skip(ctx);
-     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
++    /*
-     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
++     * Because we disable interrupts while env->skip is set,
-     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
++     * we must return to the main loop to re-evaluate afterward.
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
++     */
-index XXXXXXX..XXXXXXX 100644
++    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
+     switch (ctx->base.is_jmp) {
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
+     case DISAS_NORETURN:
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
-     cc->class_by_name = lm32_cpu_class_by_name;
+     case DISAS_NEXT:
-     cc->has_work = lm32_cpu_has_work;
+     case DISAS_TOO_MANY:
--    cc->do_interrupt = lm32_cpu_do_interrupt;
+     case DISAS_CHAIN:
-+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
+-        if (!nonconst_skip) {
-     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
++        if (!nonconst_skip && !force_exit) {
-     cc->dump_state = lm32_cpu_dump_state;
+             /* Note gen_goto_tb checks singlestep.  */
-     cc->set_pc = lm32_cpu_set_pc;
+             gen_goto_tb(ctx, 1, ctx->npc);
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+             break;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
---- a/target/m68k/cpu.c
+         tcg_gen_movi_tl(cpu_pc, ctx->npc);
-+++ b/target/m68k/cpu.c
+         /* fall through */
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
+     case DISAS_LOOKUP:
+-        tcg_gen_lookup_and_goto_ptr();
-     cc->class_by_name = m68k_cpu_class_by_name;
+-        break;
-     cc->has_work = m68k_cpu_has_work;
++        if (!force_exit) {
--    cc->do_interrupt = m68k_cpu_do_interrupt;
++            tcg_gen_lookup_and_goto_ptr();
-+    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
++            break;
-     cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
++        }
-     cc->dump_state = m68k_cpu_dump_state;
++        /* fall through */
-     cc->set_pc = m68k_cpu_set_pc;
+     case DISAS_EXIT:
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+         tcg_gen_exit_tb(NULL, 0);
-index XXXXXXX..XXXXXXX 100644
+         break;
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = mb_cpu_class_by_name;
      cc->has_work = mb_cpu_has_work;
 -    cc->do_interrupt = mb_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
      cc->do_unaligned_access = mb_cpu_do_unaligned_access;
      cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = mips_cpu_class_by_name;
      cc->has_work = mips_cpu_has_work;
 -    cc->do_interrupt = mips_cpu_do_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 -#endif
 +#endif /* CONFIG_TCG */
      cc->gdb_num_core_regs = 73;
      cc->gdb_stop_before_watchpoint = true;
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = moxie_cpu_class_by_name;
      cc->has_work = moxie_cpu_has_work;
 -    cc->do_interrupt = moxie_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
      cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
 -    cc->do_interrupt = nios2_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
 -    cc->do_interrupt = openrisc_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
 -    cc->do_interrupt = riscv_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
 -    cc->do_interrupt = rx_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = s390_cpu_class_by_name,
      cc->has_work = s390_cpu_has_work;
  #ifdef CONFIG_TCG
 -    cc->do_interrupt = s390_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
  #endif
      cc->dump_state = s390_cpu_dump_state;
      cc->set_pc = s390_cpu_set_pc;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
 -    cc->do_interrupt = superh_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = sparc_cpu_class_by_name;
      cc->parse_features = sparc_cpu_parse_features;
      cc->has_work = sparc_cpu_has_work;
 -    cc->do_interrupt = sparc_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
      cc->dump_state = sparc_cpu_dump_state;
  #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
 -    cc->do_interrupt = tilegx_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
 -    cc->do_interrupt = uc32_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
 -    cc->do_interrupt = xtensa_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = ppc_cpu_class_by_name;
      cc->has_work = ppc_cpu_has_work;
 -    cc->do_interrupt = ppc_cpu_do_interrupt;
      cc->dump_state = ppc_cpu_dump_state;
      cc->dump_statistics = ppc_cpu_dump_statistics;
      cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 +    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
      cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 --
-.25.1
+.34.1

-[PULL 13/46] tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+[PULL 04/20] linux-user: Honor PT_GNU_STACK
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Map the stack executable if required by default or on demand.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 20 +++++++++++++-------
+ include/elf.h        |  1 +
-file changed, 13 insertions(+), 7 deletions(-)
+ linux-user/qemu.h    |  1 +
  linux-user/elfload.c | 19 ++++++++++++++++++-
 files changed, 20 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/elf.h b/include/elf.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/elf.h
-+++ b/tcg/tci.c
++++ b/include/elf.h
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
+@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
- # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
+ #define PT_LOPROC  0x70000000
  #define PT_HIPROC  0x7fffffff
 +#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
  #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
  #define PT_MIPS_REGINFO   0x70000000
 diff --git a/linux-user/qemu.h b/linux-user/qemu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/qemu.h
 +++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
          uint32_t        elf_flags;
          int             personality;
          abi_ulong       alignment;
 +        bool            exec_stack;
          /* Generic semihosting knows about these pointers. */
          abi_ulong       arg_strings;   /* strings for argv */
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
  #define ELF_ARCH        EM_386
  #define ELF_PLATFORM get_elf_platform()
 +#define EXSTACK_DEFAULT true
  static const char *get_elf_platform(void)
  {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
  #define ELF_ARCH        EM_ARM
  #define ELF_CLASS       ELFCLASS32
 +#define EXSTACK_DEFAULT true
  static inline void init_thread(struct target_pt_regs *regs,
                                 struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
  #else
  #define ELF_CLASS       ELFCLASS32
 +#define EXSTACK_DEFAULT true
  #endif
-+#if TCG_TARGET_REG_BITS == 64
+@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
-+# define CASE_32_64(x) \
-+        case glue(glue(INDEX_op_, x), _i64): \
+ #define ELF_CLASS   ELFCLASS64
-+        case glue(glue(INDEX_op_, x), _i32):
+ #define ELF_ARCH    EM_LOONGARCH
-+# define CASE_64(x) \
++#define EXSTACK_DEFAULT true
-+        case glue(glue(INDEX_op_, x), _i64):
-+#else
+ #define elf_check_arch(x) ((x) == EM_LOONGARCH)
-+# define CASE_32_64(x) \
-+        case glue(glue(INDEX_op_, x), _i32):
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
-+# define CASE_64(x)
+ #define ELF_CLASS   ELFCLASS32
  #endif
  #define ELF_ARCH    EM_MIPS
 +#define EXSTACK_DEFAULT true
  #ifdef TARGET_ABI_MIPSN32
  #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
  #define bswaptls(ptr) bswap32s(ptr)
  #endif
 +#ifndef EXSTACK_DEFAULT
 +#define EXSTACK_DEFAULT false
 +#endif
 +
- /* Interpret pseudo code in tb. */
+ #include "elf.h"
- /*
-  * Disable CFI checks.
+ /* We must delay the following stanzas until after "elf.h". */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
+                                  struct image_info *info)
-             /* Load/store operations (32 bit). */
+ {
+     abi_ulong size, error, guard;
--        case INDEX_op_ld8u_i32:
++    int prot;
-+        CASE_32_64(ld8u)
-             t0 = *tb_ptr++;
+     size = guest_stack_size;
-             t1 = tci_read_r(regs, &tb_ptr);
+     if (size < STACK_LOWER_LIMIT) {
-             t2 = tci_read_s32(&tb_ptr);
+@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+         guard = qemu_real_host_page_size();
+     }
-             /* Load/store operations (64 bit). */
+-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
--        case INDEX_op_ld8u_i64:
++    prot = PROT_READ | PROT_WRITE;
--            t0 = *tb_ptr++;
++    if (info->exec_stack) {
--            t1 = tci_read_r(regs, &tb_ptr);
++        prot |= PROT_EXEC;
--            t2 = tci_read_s32(&tb_ptr);
++    }
--            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
++    error = target_mmap(0, size + guard, prot,
--            break;
+                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-         case INDEX_op_ld8s_i64:
+     if (error == -1) {
-             t0 = *tb_ptr++;
+         perror("mmap stack");
-             t1 = tci_read_r(regs, &tb_ptr);
+@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
       */
      loaddr = -1, hiaddr = 0;
      info->alignment = 0;
 +    info->exec_stack = EXSTACK_DEFAULT;
      for (i = 0; i < ehdr->e_phnum; ++i) {
          struct elf_phdr *eppnt = phdr + i;
          if (eppnt->p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
              if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
                  goto exit_errmsg;
              }
 +        } else if (eppnt->p_type == PT_GNU_STACK) {
 +            info->exec_stack = eppnt->p_flags & PF_X;
          }
      }
 --
-.25.1
+.34.1

-[PULL 38/46] cpu: move cc->transaction_failed to tcg_ops
+[PULL 05/20] linux-user: Clear translations on mprotect()
-From: Claudio Fontana <cfontana@suse.de>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Currently it's possible to execute pages that do not have PAGE_EXEC
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+if there is an existing translation block. Fix by invalidating TBs
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+that touch the affected pages.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>
 avoiding its use in headers used by common_ss code (should be poisoned).
 Note: need to be careful with the use of CONFIG_USER_ONLY,
 Message-Id: <20210204163931.7358-11-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 28 +++++++++++++---------------
+ linux-user/mmap.c | 6 ++++--
- hw/mips/jazz.c            |  9 +++++++--
+file changed, 4 insertions(+), 2 deletions(-)
  target/alpha/cpu.c        |  2 +-
  target/arm/cpu.c          |  4 ++--
  target/m68k/cpu.c         |  2 +-
  target/microblaze/cpu.c   |  2 +-
  target/mips/cpu.c         |  4 +++-
  target/riscv/cpu.c        |  2 +-
  target/riscv/cpu_helper.c |  2 +-
  target/sparc/cpu.c        |  2 +-
  target/xtensa/cpu.c       |  2 +-
  target/xtensa/helper.c    |  4 ++--
 files changed, 34 insertions(+), 29 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/linux-user/mmap.c b/linux-user/mmap.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/linux-user/mmap.c
-+++ b/include/hw/core/cpu.h
++++ b/linux-user/mmap.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
-     /** @debug_excp_handler: Callback for handling debug exceptions */
+             goto error;
-     void (*debug_excp_handler)(CPUState *cpu);
+         }
 +    /**
 +     * @do_transaction_failed: Callback for handling failed memory transactions
 +     * (ie bus faults or external aborts; not MMU faults)
 +     */
 +    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 +                                  unsigned size, MMUAccessType access_type,
 +                                  int mmu_idx, MemTxAttrs attrs,
 +                                  MemTxResult response, uintptr_t retaddr);
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   * @has_work: Callback for checking if there is work to do.
   * @do_unaligned_access: Callback for unaligned access handling, if
   * the target defines #TARGET_ALIGNED_ONLY.
 - * @do_transaction_failed: Callback for handling failed memory transactions
 - * (ie bus faults or external aborts; not MMU faults)
   * @virtio_is_big_endian: Callback to return %true if a CPU which supports
   * runtime configurable endianness is currently big-endian. Non-configurable
   * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 -    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 -                                  unsigned size, MMUAccessType access_type,
 -                                  int mmu_idx, MemTxAttrs attrs,
 -                                  MemTxResult response, uintptr_t retaddr);
      bool (*virtio_is_big_endian)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
  void cpu_interrupt(CPUState *cpu, int mask);
 -#ifdef NEED_CPU_H
 -
 -#ifdef CONFIG_SOFTMMU
  static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                          MMUAccessType access_type,
                                          int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
 -        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
 -                                  mmu_idx, attrs, response, retaddr);
 +    if (!cpu->ignore_memory_transaction_failures &&
 +        cc->tcg_ops.do_transaction_failed) {
 +        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
 +                                          access_type, mmu_idx, attrs,
 +                                          response, retaddr);
      }
- }
--#endif
--
--#endif /* NEED_CPU_H */
- /**
-  * cpu_set_pc:
-diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/jazz.c
-+++ b/hw/mips/jazz.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
- #define MAGNUM_BIOS_SIZE_MAX 0x7e000
- #define MAGNUM_BIOS_SIZE                                                       \
-         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
 +
-+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+     page_set_flags(start, start + len, page_flags);
- static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
+-    mmap_unlock();
-                                           vaddr addr, unsigned size,
+-    return 0;
-                                           MMUAccessType access_type,
++    tb_invalidate_phys_range(start, start + len);
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
++    ret = 0;
-     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
++
-                                   mmu_idx, attrs, response, retaddr);
+ error:
- }
+     mmap_unlock();
-+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+     return ret;
  static void mips_jazz_init(MachineState *machine,
                             enum jazz_model_e jazz_model)
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
       * memory region that catches all memory accesses, as we do on Malta.
       */
      cc = CPU_GET_CLASS(cpu);
 -    real_do_transaction_failed = cc->do_transaction_failed;
 -    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
 +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 +    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
 +#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
      /* allocate RAM */
      memory_region_add_subregion(address_space, 0, machine->ram);
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_write_register = alpha_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
      cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
      cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_alpha_cpu;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
      cc->do_unaligned_access = arm_cpu_do_unaligned_access;
  #if !defined(CONFIG_USER_ONLY)
 -    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
      cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 -#endif
 +#endif /* CONFIG_TCG */
  }
  #ifdef CONFIG_KVM
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
 -    cc->do_transaction_failed = m68k_cpu_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
      cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_m68k_cpu;
  #endif
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_write_register = mb_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_transaction_failed = mb_cpu_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
      dc->vmsd = &vmstate_mb_cpu;
  #endif
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
      cc->do_unaligned_access = mips_cpu_do_unaligned_access;
      cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_mips_cpu;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 +#ifndef CONFIG_USER_ONLY
 +    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 +#endif /* CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
      cc->gdb_num_core_regs = 73;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
      cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
      env->badaddr = addr;
      riscv_raise_exception(env, cs->exception_index, retaddr);
  }
 -#endif
 +#endif /* !CONFIG_USER_ONLY */
  bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                          MMUAccessType access_type, int mmu_idx,
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
      cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 -    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
      cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
 diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/helper.c
 +++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      cpu_loop_exit_restore(cs, retaddr);
  }
 -#else
 +#else /* !CONFIG_USER_ONLY */
  void xtensa_cpu_do_unaligned_access(CPUState *cs,
                                      vaddr addr, MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
          qemu_cpu_kick(cpu);
      }
  }
 -#endif
 +#endif /* !CONFIG_USER_ONLY */
 --
-.25.1
+.34.1

-[PULL 29/46] cpu: Introduce TCGCpuOperations struct
+[PULL 06/20] tests/tcg/i386: Move smc_code2 to an executable section
-From: Eduardo Habkost <ehabkost@redhat.com>
+We're about to start validating PAGE_EXEC, which means
 that we've got to put this code into a section that is
 both writable and executable.
-The TCG-specific CPU methods will be moved to a separate struct,
+Note that this test did not run on hardware beforehand either.
 to make it easier to move accel-specific code outside generic CPU
 code in the future.  Start by moving tcg_initialize().
-The new CPUClass.tcg_opts field may eventually become a pointer,
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-but keep it an embedded struct for now, to make code conversion
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 easier.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 [claudio: move TCGCpuOperations inside include/hw/core/cpu.h]
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-2-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 16 +++++++++++++++-
+ tests/tcg/i386/test-i386.c | 2 +-
- cpu.c                           |  6 +++++-
+file changed, 1 insertion(+), 1 deletion(-)
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               | 12 ++++++------
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 48 insertions(+), 30 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/tests/tcg/i386/test-i386.c b/tests/tcg/i386/test-i386.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tests/tcg/i386/test-i386.c
-+++ b/include/hw/core/cpu.h
++++ b/tests/tcg/i386/test-i386.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
+@@ -XXX,XX +XXX,XX @@ uint8_t code[] = {
+xc3, /* ret */
  struct TranslationBlock;
 +/**
 + * struct TcgCpuOperations: TCG operations specific to a CPU class
 + */
 +typedef struct TcgCpuOperations {
 +    /**
 +     * @initialize: Initalize TCG state
 +     *
 +     * Called when the first CPU is realized.
 +     */
 +    void (*initialize)(void);
 +
 +} TcgCpuOperations;
 +
  /**
   * CPUClass:
   * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
      vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 -    void (*tcg_initialize)(void);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
      int gdb_num_core_regs;
      bool gdb_stop_before_watchpoint;
 +
 +    TcgCpuOperations tcg_ops;
  };
- /*
+-asm(".section \".data\"\n"
-diff --git a/cpu.c b/cpu.c
++asm(".section \".data_x\",\"awx\"\n"
-index XXXXXXX..XXXXXXX 100644
+     "smc_code2:\n"
---- a/cpu.c
+     "movl 4(%esp), %eax\n"
-+++ b/cpu.c
+     "movl %eax, smc_patch_addr2 + 1\n"
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
  void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 +#ifdef CONFIG_TCG
      static bool tcg_target_initialized;
 +#endif /* CONFIG_TCG */
      cpu_list_add(cpu);
 +#ifdef CONFIG_TCG
      if (tcg_enabled() && !tcg_target_initialized) {
          tcg_target_initialized = true;
 -        cc->tcg_initialize();
 +        cc->tcg_ops.initialize();
      }
 +#endif /* CONFIG_TCG */
      tlb_init(cpu);
      qemu_plugin_vcpu_init_hook(cpu);
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
      cc->disas_set_info = alpha_cpu_disas_set_info;
 -    cc->tcg_initialize = alpha_translate_init;
 +    cc->tcg_ops.initialize = alpha_translate_init;
      cc->gdb_num_core_regs = 67;
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = arm_translate_init;
 +    cc->tcg_ops.initialize = arm_translate_init;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->tlb_fill = avr_cpu_tlb_fill;
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
 -    cc->tcg_initialize = avr_cpu_tcg_init;
 +    cc->tcg_ops.initialize = avr_cpu_tcg_init;
      cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
      cc->gdb_read_register = avr_cpu_gdb_read_register;
      cc->gdb_write_register = avr_cpu_gdb_write_register;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 8;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 9;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 10;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 11;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      ccc->vr = 17;
      cc->do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
  }
  static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = cris_disas_set_info;
 -    cc->tcg_initialize = cris_initialize_tcg;
 +    cc->tcg_ops.initialize = cris_initialize_tcg;
  }
  #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
      cc->disas_set_info = hppa_cpu_disas_set_info;
 -    cc->tcg_initialize = hppa_translate_init;
 +    cc->tcg_ops.initialize = hppa_translate_init;
      cc->gdb_num_core_regs = 128;
  }
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
      cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
      cc->cpu_exec_enter = x86_cpu_exec_enter;
      cc->cpu_exec_exit = x86_cpu_exec_exit;
 -    cc->tcg_initialize = tcg_x86_init;
 +    cc->tcg_ops.initialize = tcg_x86_init;
      cc->tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->debug_excp_handler = breakpoint_handler;
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
 -    cc->tcg_initialize = lm32_translate_init;
 +    cc->tcg_ops.initialize = lm32_translate_init;
  }
  #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      dc->vmsd = &vmstate_m68k_cpu;
  #endif
      cc->disas_set_info = m68k_cpu_disas_set_info;
 -    cc->tcg_initialize = m68k_tcg_init;
 +    cc->tcg_ops.initialize = m68k_tcg_init;
      cc->gdb_num_core_regs = 18;
  }
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_num_core_regs = 32 + 27;
      cc->disas_set_info = mb_disas_set_info;
 -    cc->tcg_initialize = mb_tcg_init;
 +    cc->tcg_ops.initialize = mb_tcg_init;
  }
  static const TypeInfo mb_cpu_type_info = {
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
  #endif
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = mips_tcg_init;
 +    cc->tcg_ops.initialize = mips_tcg_init;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_moxie_cpu;
  #endif
      cc->disas_set_info = moxie_cpu_disas_set_info;
 -    cc->tcg_initialize = moxie_translate_init;
 +    cc->tcg_ops.initialize = moxie_translate_init;
  }
  static void moxielite_initfn(Object *obj)
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
      cc->gdb_write_register = nios2_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 49;
 -    cc->tcg_initialize = nios2_tcg_init;
 +    cc->tcg_ops.initialize = nios2_tcg_init;
  }
  static const TypeInfo nios2_cpu_type_info = {
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      dc->vmsd = &vmstate_openrisc_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 3;
 -    cc->tcg_initialize = openrisc_translate_init;
 +    cc->tcg_ops.initialize = openrisc_translate_init;
      cc->disas_set_info = openrisc_disas_set_info;
  }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = riscv_translate_init;
 +    cc->tcg_ops.initialize = riscv_translate_init;
      cc->tlb_fill = riscv_cpu_tlb_fill;
  #endif
      device_class_set_props(dc, riscv_cpu_properties);
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
 -    cc->tcg_initialize = rx_translate_init;
 +    cc->tcg_ops.initialize = rx_translate_init;
      cc->tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = s390x_translate_init;
 +    cc->tcg_ops.initialize = s390x_translate_init;
      cc->tlb_fill = s390_cpu_tlb_fill;
  #endif
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 -    cc->tcg_initialize = sh4_translate_init;
 +    cc->tcg_ops.initialize = sh4_translate_init;
      cc->gdb_num_core_regs = 59;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
      cc->disas_set_info = cpu_sparc_disas_set_info;
 -    cc->tcg_initialize = sparc_tcg_init;
 +    cc->tcg_ops.initialize = sparc_tcg_init;
  #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
      cc->gdb_num_core_regs = 86;
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = tilegx_cpu_set_pc;
      cc->tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
 -    cc->tcg_initialize = tilegx_tcg_init;
 +    cc->tcg_ops.initialize = tilegx_tcg_init;
  }
  static const TypeInfo tilegx_cpu_type_info = {
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->set_pc = tricore_cpu_set_pc;
      cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
 -    cc->tcg_initialize = tricore_tcg_init;
 +    cc->tcg_ops.initialize = tricore_tcg_init;
      cc->tlb_fill = tricore_cpu_tlb_fill;
  }
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = uc32_cpu_set_pc;
      cc->tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
 -    cc->tcg_initialize = uc32_translate_init;
 +    cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
  }
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
  #endif
      cc->debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
 -    cc->tcg_initialize = xtensa_translate_init;
 +    cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
  }
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
  #endif
  #ifdef CONFIG_TCG
 -    cc->tcg_initialize = ppc_translate_init;
 +    cc->tcg_ops.initialize = ppc_translate_init;
      cc->tlb_fill = ppc_cpu_tlb_fill;
  #endif
  #ifndef CONFIG_USER_ONLY
 --
-.25.1
+.34.1

-[PULL 36/46] target/arm: do not use cc->do_interrupt for KVM directly
+[PULL 07/20] accel/tcg: Introduce is_same_page()
-From: Claudio Fontana <cfontana@suse.de>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
+Introduce a function that checks whether a given address is on the same
-to prepare the emulated architecture to take an interrupt as defined
+page as where disassembly started. Having it improves readability of
-in the hardware specifications,
+the following patches.
-but in reality the _do_interrupt style of functions in targets are
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-also occasionally reused by KVM to prepare the architecture state in a
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-similar way where userspace code has identified that it needs to
+Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
 deliver an exception to the guest.
 In the case of ARM, that includes:
 ) the vcpu thread got a SIGBUS indicating a memory error,
    and we need to deliver a Synchronous External Abort to the guest to
    let it know about the error.
 ) the kernel told us about a debug exception (breakpoint, watchpoint)
    but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
    so it must be a breakpoint the guest itself has set up, therefore
    we need to deliver it to the guest.
 So in order to reuse code, the same arm_do_interrupt function is used.
 This is all fine, but we need to avoid calling it using the callback
 registered in CPUClass, since that one is now TCG-only.
 Fortunately this is easily solved by replacing calls to
 CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Cc: Peter Maydell <peter.maydell@linaro.org>
+[rth: Make the DisasContextBase parameter const.]
 Message-Id: <20210204163931.7358-9-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/helper.c | 4 ++++
+ include/exec/translator.h | 10 ++++++++++
- target/arm/kvm64.c  | 6 ++----
+file changed, 10 insertions(+)
 files changed, 6 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/exec/translator.h
-+++ b/target/arm/helper.c
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-  * Do any appropriate logging, handle PSCI calls, and then hand off
-  * to the AArch64-entry or AArch32-entry function depending on the
+ #undef GEN_TRANSLATOR_LD
-  * target exception level's register width.
-+ *
++/*
-+ * Note: this is used for both TCG (as the do_interrupt tcg op),
++ * Return whether addr is on the same page as where disassembly started.
-+ *       and KVM to re-inject guest debug exceptions, and to
++ * Translators can use this to enforce the rule that only single-insn
-+ *       inject a Synchronous-External-Abort.
++ * translation blocks are allowed to cross page boundaries.
-  */
++ */
- void arm_cpu_do_interrupt(CPUState *cs)
++static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
- {
++{
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
++    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
-index XXXXXXX..XXXXXXX 100644
++}
---- a/target/arm/kvm64.c
++
-+++ b/target/arm/kvm64.c
+ #endif /* EXEC__TRANSLATOR_H */
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
  {
      ARMCPU *cpu = ARM_CPU(c);
      CPUARMState *env = &cpu->env;
 -    CPUClass *cc = CPU_GET_CLASS(c);
      uint32_t esr;
      bool same_el;
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
      env->exception.syndrome = esr;
 -    cc->do_interrupt(c);
 +    arm_cpu_do_interrupt(c);
  }
  #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
  {
      int hsr_ec = syn_get_ec(debug_exit->hsr);
      ARMCPU *cpu = ARM_CPU(cs);
 -    CPUClass *cc = CPU_GET_CLASS(cs);
      CPUARMState *env = &cpu->env;
      /* Ensure PC is synchronised */
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
      env->exception.vaddress = debug_exit->far;
      env->exception.target_el = 1;
      qemu_mutex_lock_iothread();
 -    cc->do_interrupt(cs);
 +    arm_cpu_do_interrupt(cs);
      qemu_mutex_unlock_iothread();
      return false;
 --
-.25.1
+.34.1

-[PULL 34/46] cpu: Move tlb_fill to tcg_ops
+[PULL 08/20] accel/tcg: Properly implement get_page_addr_code for user-only
-From: Eduardo Habkost <ehabkost@redhat.com>
+The current implementation is a no-op, simply returning addr.
 This is incorrect, because we ought to be checking the page
 permissions for execution.
-[claudio: wrapped target code in CONFIG_TCG]
+Make get_page_addr_code inline for both implementations.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20210204163931.7358-7-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 21 ++++++++++++---------
+ include/exec/exec-all.h | 85 ++++++++++++++---------------------------
- accel/tcg/cputlb.c              |  7 ++++---
+ accel/tcg/cputlb.c      |  5 ---
- accel/tcg/user-exec.c           |  6 +++---
+ accel/tcg/user-exec.c   | 14 +++++++
- target/alpha/cpu.c              |  2 +-
+files changed, 42 insertions(+), 62 deletions(-)
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 42 insertions(+), 38 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/include/exec/exec-all.h
-+++ b/include/hw/core/cpu.h
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
-     void (*cpu_exec_exit)(CPUState *cpu);
+                                              hwaddr index, MemTxAttrs attrs);
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+ #endif
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-+    /**
+-#if defined(CONFIG_USER_ONLY)
-+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+-void mmap_lock(void);
-+     *
+-void mmap_unlock(void);
-+     * For system mode, if the access is valid, call tlb_set_page
+-bool have_mmap_lock(void);
-+     * and return true; if the access is invalid, and probe is
+-
-+     * true, return false; otherwise raise an exception and do
+ /**
-+     * not return.  For user-only mode, always raise an exception
+- * get_page_addr_code() - user-mode version
-+     * and do not return.
++ * get_page_addr_code_hostp()
-+     */
+  * @env: CPUArchState
-+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+  * @addr: guest virtual address of guest code
-+                     MMUAccessType access_type, int mmu_idx,
+  *
-+                     bool probe, uintptr_t retaddr);
+- * Returns @addr.
++ * See get_page_addr_code() (full-system version) for documentation on the
- } TcgCpuOperations;
++ * return value.
++ *
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
++ * Sets *@hostp (when @hostp is non-NULL) as follows.
-  *       If the target behaviour here is anything other than "set
++ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
-  *       the PC register to the value passed in" then the target must
++ * to the host address where @addr's content is kept.
-  *       also implement the synchronize_from_tb hook.
++ *
-- * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
++ * Note: this function can trigger an exception.
-- *       address fault.  For system mode, if the access is valid, call
++ */
-- *       tlb_set_page and return true; if the access is invalid, and
++tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-- *       probe is true, return false; otherwise raise an exception and
++                                        void **hostp);
-- *       do not return.  For user-only mode, always raise an exception
++
-- *       and do not return.
++/**
-  * @get_phys_page_debug: Callback for obtaining a physical address.
++ * get_page_addr_code()
-  * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
++ * @env: CPUArchState
-  *       associated memory transaction attributes to use for the access.
++ * @addr: guest virtual address of guest code
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
++ *
-     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
++ * If we cannot translate and execute from the entire RAM page, or if
-                                Error **errp);
++ * the region is not backed by RAM, returns -1. Otherwise, returns the
-     void (*set_pc)(CPUState *cpu, vaddr value);
++ * ram_addr_t corresponding to the guest code at @addr.
--    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
++ *
--                     MMUAccessType access_type, int mmu_idx,
++ * Note: this function can trigger an exception.
--                     bool probe, uintptr_t retaddr);
+  */
-     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
+ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
-     hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
+                                                 target_ulong addr)
-                                         MemTxAttrs *attrs);
+ {
 -    return addr;
 +    return get_page_addr_code_hostp(env, addr, NULL);
  }
 -/**
 - * get_page_addr_code_hostp() - user-mode version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * Returns @addr.
 - *
 - * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
 - * is kept.
 - */
 -static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
 -                                                      target_ulong addr,
 -                                                      void **hostp)
 -{
 -    if (hostp) {
 -        *hostp = g2h_untagged(addr);
 -    }
 -    return addr;
 -}
 +#if defined(CONFIG_USER_ONLY)
 +void mmap_lock(void);
 +void mmap_unlock(void);
 +bool have_mmap_lock(void);
  /**
   * adjust_signal_pc:
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
  static inline void mmap_lock(void) {}
  static inline void mmap_unlock(void) {}
 -/**
 - * get_page_addr_code() - full-system version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * If we cannot translate and execute from the entire RAM page, or if
 - * the region is not backed by RAM, returns -1. Otherwise, returns the
 - * ram_addr_t corresponding to the guest code at @addr.
 - *
 - * Note: this function can trigger an exception.
 - */
 -tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
 -
 -/**
 - * get_page_addr_code_hostp() - full-system version
 - * @env: CPUArchState
 - * @addr: guest virtual address of guest code
 - *
 - * See get_page_addr_code() (full-system version) for documentation on the
 - * return value.
 - *
 - * Sets *@hostp (when @hostp is non-NULL) as follows.
 - * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
 - * to the host address where @addr's content is kept.
 - *
 - * Note: this function can trigger an exception.
 - */
 -tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
 -                                        void **hostp);
 -
  void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
  void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
+@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-      * This is not a probe, so only valid return is success; failure
+     return qemu_ram_addr_from_host_nofail(p);
       * should result in exception + longjmp to the cpu loop.
       */
 -    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
 +    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
 +                              access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
+-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-             CPUState *cs = env_cpu(env);
+-{
-             CPUClass *cc = CPU_GET_CLASS(cs);
+-    return get_page_addr_code_hostp(env, addr, NULL);
+-}
--            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
+-
--                              mmu_idx, nonfault, retaddr)) {
+ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
-+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
+                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
-+                                      mmu_idx, nonfault, retaddr)) {
+ {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
                  return TLB_INVALID_MASK;
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
+@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
-     clear_helper_retaddr();
+     return size ? g2h(env_cpu(env), addr) : NULL;
      cc = CPU_GET_CLASS(cpu);
 -    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
 +    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
++tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-         } else {
++                                        void **hostp)
-             CPUState *cpu = env_cpu(env);
++{
-             CPUClass *cc = CPU_GET_CLASS(cpu);
++    int flags;
--            cc->tlb_fill(cpu, addr, fault_size, access_type,
++
--                         MMU_USER_IDX, false, ra);
++    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
-+            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
++    g_assert(flags == 0);
-+                                 MMU_USER_IDX, false, ra);
++
-             g_assert_not_reached();
++    if (hostp) {
-         }
++        *hostp = g2h_untagged(addr);
-     }
++    }
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
++    return addr;
-index XXXXXXX..XXXXXXX 100644
++}
---- a/target/alpha/cpu.c
++
-+++ b/target/alpha/cpu.c
+ /* The softmmu versions of these helpers are in cputlb.c.  */
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = alpha_cpu_set_pc;
+ /*
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
      cc->gdb_write_register = alpha_cpu_gdb_write_register;
 -    cc->tlb_fill = alpha_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
      cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.initialize = arm_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
 -    cc->tlb_fill = arm_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
      cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = avr_cpu_set_pc;
      cc->memory_rw_debug = avr_cpu_memory_rw_debug;
      cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
 -    cc->tlb_fill = avr_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
      cc->tcg_ops.initialize = avr_cpu_tcg_init;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
 -    cc->tlb_fill = cris_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_cris_cpu;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
 -    cc->tlb_fill = hppa_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_hppa_cpu;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
      cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
 -    cc->tlb_fill = x86_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->debug_excp_handler = breakpoint_handler;
  #endif
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
      cc->gdb_write_register = lm32_cpu_gdb_write_register;
 -    cc->tlb_fill = lm32_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_lm32_cpu;
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
 -    cc->tlb_fill = m68k_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
      cc->do_transaction_failed = m68k_cpu_transaction_failed;
      cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
 -    cc->tlb_fill = mb_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = mb_cpu_transaction_failed;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.initialize = mips_tcg_init;
      cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
 -    cc->tlb_fill = mips_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
  #endif
      cc->gdb_num_core_regs = 73;
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
 -    cc->tlb_fill = moxie_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_moxie_cpu;
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 -    cc->tlb_fill = nios2_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
      cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 -    cc->tlb_fill = openrisc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_openrisc_cpu;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_arch_name = riscv_gdb_arch_name;
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
      cc->tcg_ops.initialize = riscv_translate_init;
 -    cc->tlb_fill = riscv_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
      device_class_set_props(dc, riscv_cpu_properties);
  }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
      cc->tcg_ops.initialize = rx_translate_init;
 -    cc->tlb_fill = rx_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
      cc->gdb_core_xml_file = "rx-core.xml";
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = s390_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = s390x_translate_init;
 -    cc->tlb_fill = s390_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
  #endif
      cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
 -    cc->tlb_fill = superh_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
 -    cc->tlb_fill = sparc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
      cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 -    cc->tlb_fill = tilegx_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
      cc->tcg_ops.initialize = tilegx_tcg_init;
  }
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = tricore_tcg_init;
 -    cc->tlb_fill = tricore_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
  }
  #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 -    cc->tlb_fill = uc32_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tlb_fill = xtensa_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
      cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
 -    cc->tlb_fill = ppc_cpu_tlb_fill;
 +    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 --
-.25.1
+.34.1

-[PULL 42/46] cpu: move debug_check_watchpoint to tcg_ops
+[PULL 09/20] accel/tcg: Unlock mmap_lock after longjmp
-From: Claudio Fontana <cfontana@suse.de>
+The mmap_lock is held around tb_gen_code.  While the comment
 is correct that the lock is dropped when tb_gen_code runs out
 of memory, the lock is *not* dropped when an exception is
 raised reading code for translation.
-commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-commit 3826121d9298 ("target-arm: Implement checking of fired")
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-introduced an ARM-specific hack for cpu_check_watchpoint.
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Make debug_check_watchpoint optional, and move it to tcg_ops.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-15-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 9 ++++++---
+ accel/tcg/cpu-exec.c  | 12 ++++++------
- accel/tcg/user-exec.c | 3 ++-
+ accel/tcg/user-exec.c |  3 ---
- hw/core/cpu.c         | 9 ---------
+files changed, 6 insertions(+), 9 deletions(-)
  softmmu/physmem.c     | 4 ++--
  target/arm/cpu.c      | 4 ++--
 files changed, 12 insertions(+), 17 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/accel/tcg/cpu-exec.c
-+++ b/include/hw/core/cpu.h
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-      */
+         cpu_tb_exec(cpu, tb, &tb_exit);
-     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+         cpu_exec_exit(cpu);
+     } else {
-+    /**
+-        /*
-+     * @debug_check_watchpoint: return true if the architectural
+-         * The mmap_lock is dropped by tb_gen_code if it runs out of
-+     * watchpoint whose address has matched should really fire, used by ARM
+-         * memory.
-+     */
+-         */
-+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+ #ifndef CONFIG_SOFTMMU
-+
+         clear_helper_retaddr();
- } TcgCpuOperations;
+-        tcg_debug_assert(!have_mmap_lock());
++        if (have_mmap_lock()) {
- /**
++            mmap_unlock();
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
++        }
-  *       a memory access with the specified memory transaction attributes.
+ #endif
-  * @gdb_read_register: Callback for letting GDB read a register.
+         if (qemu_mutex_iothread_locked()) {
-  * @gdb_write_register: Callback for letting GDB write a register.
+             qemu_mutex_unlock_iothread();
-- * @debug_check_watchpoint: Callback: return true if the architectural
+@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
-- *       watchpoint whose address has matched should really fire.
-  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
+ #ifndef CONFIG_SOFTMMU
-  * 64-bit VM coredump.
+         clear_helper_retaddr();
-  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
+-        tcg_debug_assert(!have_mmap_lock());
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
++        if (have_mmap_lock()) {
-     int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
++            mmap_unlock();
-     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
++        }
-     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
+ #endif
--    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+         if (qemu_mutex_iothread_locked()) {
+             qemu_mutex_unlock_iothread();
      int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                              int cpuid, void *opaque);
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
+@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
-     clear_helper_retaddr();
+          * (and if the translator doesn't handle page boundaries correctly
+          * there's little we can do about that here).  Therefore, do not
-     cc = CPU_GET_CLASS(cpu);
+          * trigger the unwinder.
--    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+-         *
-+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
+-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
-+                         MMU_USER_IDX, false, pc);
+          */
-     g_assert_not_reached();
+-        mmap_unlock();
- }
+         *pc = 0;
+         return MMU_INST_FETCH;
-diff --git a/hw/core/cpu.c b/hw/core/cpu.c
+     }
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
      return 0;
  }
 -static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
 -{
 -    /* If no extra check is required, QEMU watchpoint match can be considered
 -     * as an architectural match.
 -     */
 -    return true;
 -}
 -
  static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
  {
      return target_words_bigendian();
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
      k->gdb_read_register = cpu_common_gdb_read_register;
      k->gdb_write_register = cpu_common_gdb_write_register;
      k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
 -    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
      set_bit(DEVICE_CATEGORY_CPU, dc->categories);
      dc->realize = cpu_common_realizefn;
      dc->unrealize = cpu_common_unrealizefn;
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
              wp->hitaddr = MAX(addr, wp->vaddr);
              wp->hitattrs = attrs;
              if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU &&
 -                    !cc->debug_check_watchpoint(cpu, wp)) {
 +                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
 +                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                      wp->flags &= ~BP_WATCHPOINT_HIT;
                      continue;
                  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
 -    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
  #if !defined(CONFIG_USER_ONLY)
 +    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
      cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
 -    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 +    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
  }
 --
-.25.1
+.34.1

-[PULL 31/46] accel/tcg: split TCG-only code from cpu_exec_realizefn
+[PULL 10/20] accel/tcg: Make tb_htable_lookup static
-From: Claudio Fontana <cfontana@suse.de>
+The function is not used outside of cpu-exec.c.  Move it and
 its subroutines up in the file, before the first use.
-move away TCG-only code, make it compile only on TCG.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-4-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h | 11 +++++--
+ include/exec/exec-all.h |   3 -
- include/hw/core/cpu.h  |  2 ++
+ accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
- accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
+files changed, 61 insertions(+), 64 deletions(-)
  cpu.c                  | 70 ++++++++++++++++++++----------------------
  hw/core/cpu.c          |  6 +++-
 files changed, 77 insertions(+), 40 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/include/exec/exec-all.h
-+++ b/include/exec/cpu-all.h
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
- }
+ #endif
+ void tb_flush(CPUState *cpu);
- #ifdef CONFIG_TCG
+ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-+/* accel/tcg/cpu-exec.c */
+-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
- void dump_drift_info(void);
+-                                   target_ulong cs_base, uint32_t flags,
-+/* accel/tcg/translate-all.c */
+-                                   uint32_t cflags);
- void dump_exec_info(void);
+ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
- void dump_opcount_info(void);
- #endif /* CONFIG_TCG */
+ /* GETPC is the true target of the return instruction that we'll execute.  */
  #endif /* !CONFIG_USER_ONLY */
 +#ifdef CONFIG_TCG
 +/* accel/tcg/cpu-exec.c */
 +int cpu_exec(CPUState *cpu);
 +void tcg_exec_realizefn(CPUState *cpu, Error **errp);
 +void tcg_exec_unrealizefn(CPUState *cpu);
 +#endif /* CONFIG_TCG */
 +
  /* Returns: 0 on success, -1 on error */
  int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                          void *ptr, target_ulong len, bool is_write);
 -int cpu_exec(CPUState *cpu);
 -
  /**
   * cpu_set_cpustate_pointers(cpu)
   * @cpu: The cpu object
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
  void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
      GCC_FMT_ATTR(2, 3);
 +
 +/* $(top_srcdir)/cpu.c */
  void cpu_exec_initfn(CPUState *cpu);
  void cpu_exec_realizefn(CPUState *cpu, Error **errp);
  void cpu_exec_unrealizefn(CPUState *cpu);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
-     return ret;
+     return cflags;
  }
-+void tcg_exec_realizefn(CPUState *cpu, Error **errp)
++struct tb_desc {
 +    target_ulong pc;
 +    target_ulong cs_base;
 +    CPUArchState *env;
 +    tb_page_addr_t phys_page1;
 +    uint32_t flags;
 +    uint32_t cflags;
 +    uint32_t trace_vcpu_dstate;
 +};
 +
 +static bool tb_lookup_cmp(const void *p, const void *d)
 +{
-+    static bool tcg_target_initialized;
++    const TranslationBlock *tb = p;
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
++    const struct tb_desc *desc = d;
 +
-+    if (!tcg_target_initialized) {
++    if (tb->pc == desc->pc &&
-+        cc->tcg_ops.initialize();
++        tb->page_addr[0] == desc->phys_page1 &&
-+        tcg_target_initialized = true;
++        tb->cs_base == desc->cs_base &&
 +        tb->flags == desc->flags &&
 +        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 +        tb_cflags(tb) == desc->cflags) {
 +        /* check next page if needed */
 +        if (tb->page_addr[1] == -1) {
 +            return true;
 +        } else {
 +            tb_page_addr_t phys_page2;
 +            target_ulong virt_page2;
 +
 +            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
 +            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 +            if (tb->page_addr[1] == phys_page2) {
 +                return true;
 +            }
 +        }
 +    }
-+    tlb_init(cpu);
++    return false;
 +    qemu_plugin_vcpu_init_hook(cpu);
 +
 +#ifndef CONFIG_USER_ONLY
 +    tcg_iommu_init_notifier_list(cpu);
 +#endif /* !CONFIG_USER_ONLY */
 +}
 +
-+/* undo the initializations in reverse order */
++static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-+void tcg_exec_unrealizefn(CPUState *cpu)
++                                          target_ulong cs_base, uint32_t flags,
 +                                          uint32_t cflags)
 +{
-+#ifndef CONFIG_USER_ONLY
++    tb_page_addr_t phys_pc;
-+    tcg_iommu_free_notifier_list(cpu);
++    struct tb_desc desc;
-+#endif /* !CONFIG_USER_ONLY */
++    uint32_t h;
 +
-+    qemu_plugin_vcpu_exit_hook(cpu);
++    desc.env = cpu->env_ptr;
-+    tlb_destroy(cpu);
++    desc.cs_base = cs_base;
 +    desc.flags = flags;
 +    desc.cflags = cflags;
 +    desc.trace_vcpu_dstate = *cpu->trace_dstate;
 +    desc.pc = pc;
 +    phys_pc = get_page_addr_code(desc.env, pc);
 +    if (phys_pc == -1) {
 +        return NULL;
 +    }
 +    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 +    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 +    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 +}
 +
- #ifndef CONFIG_USER_ONLY
+ /* Might cause an exception, so have a longjmp destination ready */
+ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
- void dump_drift_info(void)
+                                           target_ulong cs_base,
-diff --git a/cpu.c b/cpu.c
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
-index XXXXXXX..XXXXXXX 100644
+     end_exclusive();
 --- a/cpu.c
 +++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
  };
  #endif
 -void cpu_exec_unrealizefn(CPUState *cpu)
 +void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    tlb_destroy(cpu);
 -    cpu_list_remove(cpu);
 +    cpu_list_add(cpu);
 +
 +#ifdef CONFIG_TCG
 +    /* NB: errp parameter is unused currently */
 +    if (tcg_enabled()) {
 +        tcg_exec_realizefn(cpu, errp);
 +    }
 +#endif /* CONFIG_TCG */
 +
 +#ifdef CONFIG_USER_ONLY
 +    assert(cc->vmsd == NULL);
 +#else
 +    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 +    }
 +    if (cc->vmsd != NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 +    }
 +#endif /* CONFIG_USER_ONLY */
 +}
 +
 +void cpu_exec_unrealizefn(CPUState *cpu)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
  #ifdef CONFIG_USER_ONLY
      assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
      if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
          vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
      }
 -    tcg_iommu_free_notifier_list(cpu);
  #endif
 +#ifdef CONFIG_TCG
 +    /* NB: errp parameter is unused currently */
 +    if (tcg_enabled()) {
 +        tcg_exec_unrealizefn(cpu);
 +    }
 +#endif /* CONFIG_TCG */
 +
 +    cpu_list_remove(cpu);
  }
- void cpu_exec_initfn(CPUState *cpu)
+-struct tb_desc {
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
+-    target_ulong pc;
- #endif
+-    target_ulong cs_base;
- }
+-    CPUArchState *env;
+-    tb_page_addr_t phys_page1;
--void cpu_exec_realizefn(CPUState *cpu, Error **errp)
+-    uint32_t flags;
 -    uint32_t cflags;
 -    uint32_t trace_vcpu_dstate;
 -};
 -
 -static bool tb_lookup_cmp(const void *p, const void *d)
 -{
--    CPUClass *cc = CPU_GET_CLASS(cpu);
+-    const TranslationBlock *tb = p;
--#ifdef CONFIG_TCG
+-    const struct tb_desc *desc = d;
 -    static bool tcg_target_initialized;
 -#endif /* CONFIG_TCG */
 -
--    cpu_list_add(cpu);
+-    if (tb->pc == desc->pc &&
 -        tb->page_addr[0] == desc->phys_page1 &&
 -        tb->cs_base == desc->cs_base &&
 -        tb->flags == desc->flags &&
 -        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
 -        tb_cflags(tb) == desc->cflags) {
 -        /* check next page if needed */
 -        if (tb->page_addr[1] == -1) {
 -            return true;
 -        } else {
 -            tb_page_addr_t phys_page2;
 -            target_ulong virt_page2;
 -
--#ifdef CONFIG_TCG
+-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
--    if (tcg_enabled() && !tcg_target_initialized) {
+-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
--        tcg_target_initialized = true;
+-            if (tb->page_addr[1] == phys_page2) {
--        cc->tcg_ops.initialize();
+-                return true;
 -            }
 -        }
 -    }
--#endif /* CONFIG_TCG */
+-    return false;
 -    tlb_init(cpu);
 -
 -    qemu_plugin_vcpu_init_hook(cpu);
 -
 -#ifdef CONFIG_USER_ONLY
 -    assert(cc->vmsd == NULL);
 -#else /* !CONFIG_USER_ONLY */
 -    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 -    }
 -    if (cc->vmsd != NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 -    }
 -
 -    tcg_iommu_init_notifier_list(cpu);
 -#endif
 -}
 -
- const char *parse_cpu_option(const char *cpu_option)
+-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 -                                   target_ulong cs_base, uint32_t flags,
 -                                   uint32_t cflags)
 -{
 -    tb_page_addr_t phys_pc;
 -    struct tb_desc desc;
 -    uint32_t h;
 -
 -    desc.env = cpu->env_ptr;
 -    desc.cs_base = cs_base;
 -    desc.flags = flags;
 -    desc.cflags = cflags;
 -    desc.trace_vcpu_dstate = *cpu->trace_dstate;
 -    desc.pc = pc;
 -    phys_pc = get_page_addr_code(desc.env, pc);
 -    if (phys_pc == -1) {
 -        return NULL;
 -    }
 -    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
 -    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 -    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 -}
 -
  void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
  {
-     ObjectClass *oc;
+     if (TCG_TARGET_HAS_direct_jump) {
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
      return target_words_bigendian();
  }
 +/*
 + * XXX the following #if is always true because this is a common_ss
 + * module, so target CONFIG_* is never defined.
 + */
  #if !defined(CONFIG_USER_ONLY)
  GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
  static void cpu_common_unrealizefn(DeviceState *dev)
  {
      CPUState *cpu = CPU(dev);
 +
      /* NOTE: latest generic point before the cpu is fully unrealized */
      trace_fini_vcpu(cpu);
 -    qemu_plugin_vcpu_exit_hook(cpu);
      cpu_exec_unrealizefn(cpu);
  }
 --
-.25.1
+.34.1

-[PULL 40/46] physmem: make watchpoint checking code TCG-only
+[PULL 11/20] accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
-From: Claudio Fontana <cfontana@suse.de>
+The base qemu_ram_addr_from_host function is already in
 softmmu/physmem.c; move the nofail version to be adjacent.
-cpu_check_watchpoint, watchpoint_address_matches are TCG-only.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-13-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
+ include/exec/cpu-common.h |  1 +
-file changed, 72 insertions(+), 69 deletions(-)
+ accel/tcg/cputlb.c        | 12 ------------
  softmmu/physmem.c         | 12 ++++++++++++
 files changed, 13 insertions(+), 12 deletions(-)
+diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/cpu-common.h
++++ b/include/exec/cpu-common.h
+@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
+ void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
+ /* This should not be used by devices.  */
+ ram_addr_t qemu_ram_addr_from_host(void *ptr);
++ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
+ RAMBlock *qemu_ram_block_by_name(const char *name);
+ RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
+                                    ram_addr_t *offset);
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/tcg/cputlb.c
++++ b/accel/tcg/cputlb.c
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
+                             prot, mmu_idx, size);
+ }
+-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+-{
+-    ram_addr_t ram_addr;
+-
+-    ram_addr = qemu_ram_addr_from_host(ptr);
+-    if (ram_addr == RAM_ADDR_INVALID) {
+-        error_report("Bad ram pointer %p", ptr);
+-        abort();
+-    }
+-    return ram_addr;
+-}
+-
+ /*
+  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
+  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
-@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
-     }
- }
-+#ifdef CONFIG_TCG
- /* Return true if this watchpoint address matches the specified
-  * access (ie the address range covered by the watchpoint overlaps
-  * partially or completely with the address range covered by the
-@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
-     return ret;
- }
-+/* Generate a debug exception if a watchpoint has been hit.  */
-+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-+                          MemTxAttrs attrs, int flags, uintptr_t ra)
-+{
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
-+    CPUWatchpoint *wp;
-+
-+    assert(tcg_enabled());
-+    if (cpu->watchpoint_hit) {
-+        /*
-+         * We re-entered the check after replacing the TB.
-+         * Now raise the debug interrupt so that it will
-+         * trigger after the current instruction.
-+         */
-+        qemu_mutex_lock_iothread();
-+        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-+        qemu_mutex_unlock_iothread();
-+        return;
-+    }
-+
-+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-+        if (watchpoint_address_matches(wp, addr, len)
-+            && (wp->flags & flags)) {
-+            if (replay_running_debug()) {
-+                /*
-+                 * Don't process the watchpoints when we are
-+                 * in a reverse debugging operation.
-+                 */
-+                replay_breakpoint();
-+                return;
-+            }
-+            if (flags == BP_MEM_READ) {
-+                wp->flags |= BP_WATCHPOINT_HIT_READ;
-+            } else {
-+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-+            }
-+            wp->hitaddr = MAX(addr, wp->vaddr);
-+            wp->hitattrs = attrs;
-+            if (!cpu->watchpoint_hit) {
-+                if (wp->flags & BP_CPU &&
-+                    !cc->debug_check_watchpoint(cpu, wp)) {
-+                    wp->flags &= ~BP_WATCHPOINT_HIT;
-+                    continue;
-+                }
-+                cpu->watchpoint_hit = wp;
-+
-+                mmap_lock();
-+                tb_check_watchpoint(cpu, ra);
-+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-+                    cpu->exception_index = EXCP_DEBUG;
-+                    mmap_unlock();
-+                    cpu_loop_exit_restore(cpu, ra);
-+                } else {
-+                    /* Force execution of one insn next time.  */
-+                    cpu->cflags_next_tb = 1 | curr_cflags();
-+                    mmap_unlock();
-+                    if (ra) {
-+                        cpu_restore_state(cpu, ra, true);
-+                    }
-+                    cpu_loop_exit_noexc(cpu);
-+                }
-+            }
-+        } else {
-+            wp->flags &= ~BP_WATCHPOINT_HIT;
-+        }
-+    }
-+}
-+
-+#endif /* CONFIG_TCG */
-+
- /* Called from RCU critical section */
- static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
- {
 @@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
      return block->offset + offset;
  }
--/* Generate a debug exception if a watchpoint has been hit.  */
++ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
--void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
++{
--                          MemTxAttrs attrs, int flags, uintptr_t ra)
++    ram_addr_t ram_addr;
--{
++
--    CPUClass *cc = CPU_GET_CLASS(cpu);
++    ram_addr = qemu_ram_addr_from_host(ptr);
--    CPUWatchpoint *wp;
++    if (ram_addr == RAM_ADDR_INVALID) {
--
++        error_report("Bad ram pointer %p", ptr);
--    assert(tcg_enabled());
++        abort();
--    if (cpu->watchpoint_hit) {
++    }
--        /*
++    return ram_addr;
--         * We re-entered the check after replacing the TB.
++}
--         * Now raise the debug interrupt so that it will
++
 -         * trigger after the current instruction.
 -         */
 -        qemu_mutex_lock_iothread();
 -        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
 -        qemu_mutex_unlock_iothread();
 -        return;
 -    }
 -
 -    addr = cc->adjust_watchpoint_address(cpu, addr, len);
 -    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
 -        if (watchpoint_address_matches(wp, addr, len)
 -            && (wp->flags & flags)) {
 -            if (replay_running_debug()) {
 -                /*
 -                 * Don't process the watchpoints when we are
 -                 * in a reverse debugging operation.
 -                 */
 -                replay_breakpoint();
 -                return;
 -            }
 -            if (flags == BP_MEM_READ) {
 -                wp->flags |= BP_WATCHPOINT_HIT_READ;
 -            } else {
 -                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
 -            }
 -            wp->hitaddr = MAX(addr, wp->vaddr);
 -            wp->hitattrs = attrs;
 -            if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU &&
 -                    !cc->debug_check_watchpoint(cpu, wp)) {
 -                    wp->flags &= ~BP_WATCHPOINT_HIT;
 -                    continue;
 -                }
 -                cpu->watchpoint_hit = wp;
 -
 -                mmap_lock();
 -                tb_check_watchpoint(cpu, ra);
 -                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
 -                    cpu->exception_index = EXCP_DEBUG;
 -                    mmap_unlock();
 -                    cpu_loop_exit_restore(cpu, ra);
 -                } else {
 -                    /* Force execution of one insn next time.  */
 -                    cpu->cflags_next_tb = 1 | curr_cflags();
 -                    mmap_unlock();
 -                    if (ra) {
 -                        cpu_restore_state(cpu, ra, true);
 -                    }
 -                    cpu_loop_exit_noexc(cpu);
 -                }
 -            }
 -        } else {
 -            wp->flags &= ~BP_WATCHPOINT_HIT;
 -        }
 -    }
 -}
 -
  static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                   MemTxAttrs attrs, void *buf, hwaddr len);
  static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
 --
-.25.1
+.34.1

-[PULL 28/46] tcg/tci: Remove TCG_CONST
+[PULL 12/20] accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
-Restrict all operands to registers.  All constants will be forced
+Simplify the implementation of get_page_addr_code_hostp
-into registers by the middle-end.  Removing the difference in how
+by reusing the existing probe_access infrastructure.
 immediate integers were encoded will allow more code to be shared
 between 32-bit and 64-bit operations.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target-con-set.h |   6 +-
+ accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
- tcg/tci/tcg-target.h         |   3 -
+file changed, 26 insertions(+), 50 deletions(-)
  tcg/tci.c                    | 189 +++++++++++++----------------------
  tcg/tci/tcg-target.c.inc     |  85 ++++------------
 files changed, 89 insertions(+), 194 deletions(-)
-diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target-con-set.h
+--- a/accel/tcg/cputlb.c
-+++ b/tcg/tci/tcg-target-con-set.h
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
-  * tcg-target-con-str.h; the constraint combination is inclusive or.
+   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
-  */
+                  (ADDR) & TARGET_PAGE_MASK)
- C_O0_I2(r, r)
--C_O0_I2(r, ri)
+-/*
- C_O0_I3(r, r, r)
+- * Return a ram_addr_t for the virtual address for execution.
--C_O0_I4(r, r, ri, ri)
+- *
- C_O0_I4(r, r, r, r)
+- * Return -1 if we can't translate and execute from an entire page
- C_O1_I1(r, r)
+- * of RAM.  This will force us to execute by loading and translating
- C_O1_I2(r, 0, r)
+- * one insn at a time, without caching.
--C_O1_I2(r, ri, ri)
+- *
- C_O1_I2(r, r, r)
+- * NOTE: This function will trigger an exception if the page is
--C_O1_I2(r, r, ri)
+- * not executable.
--C_O1_I4(r, r, r, ri, ri)
+- */
-+C_O1_I4(r, r, r, r, r)
+-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
- C_O2_I1(r, r, r)
+-                                        void **hostp)
- C_O2_I2(r, r, r, r)
+-{
- C_O2_I4(r, r, r, r, r, r)
+-    uintptr_t mmu_idx = cpu_mmu_index(env, true);
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-index XXXXXXX..XXXXXXX 100644
+-    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
---- a/tcg/tci/tcg-target.h
+-    void *p;
 +++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TCG_AREG0 = TCG_REG_R14,
      TCG_REG_CALL_STACK = TCG_REG_R15,
 -
--    /* Special value UINT8_MAX is used by TCI to encode constant values. */
+-    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
--    TCG_CONST = UINT8_MAX
+-        if (!VICTIM_TLB_HIT(addr_code, addr)) {
- } TCGReg;
+-            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
+-            index = tlb_index(env, mmu_idx, addr);
- /* Used for function call generation. */
+-            entry = tlb_entry(env, mmu_idx, addr);
-diff --git a/tcg/tci.c b/tcg/tci.c
+-
-index XXXXXXX..XXXXXXX 100644
+-            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
---- a/tcg/tci.c
+-                /*
-+++ b/tcg/tci.c
+-                 * The MMU protection covers a smaller range than a target
-@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
+-                 * page, so we must redo the MMU check for every insn.
-     return taddr;
+-                 */
- }
+-                return -1;
+-            }
--/* Read indexed register or constant (native size) from bytecode. */
+-        }
--static tcg_target_ulong
+-        assert(tlb_hit(entry->addr_code, addr));
 -tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
 -{
 -    tcg_target_ulong value;
 -    TCGReg r = **tb_ptr;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i(tb_ptr);
 -    } else {
 -        value = tci_read_reg(regs, r);
 -    }
--    return value;
+-
 -    if (unlikely(entry->addr_code & TLB_MMIO)) {
 -        /* The region is not backed by RAM.  */
 -        if (hostp) {
 -            *hostp = NULL;
 -        }
 -        return -1;
 -    }
 -
 -    p = (void *)((uintptr_t)addr + entry->addend);
 -    if (hostp) {
 -        *hostp = p;
 -    }
 -    return qemu_ram_addr_from_host_nofail(p);
 -}
 -
--/* Read indexed register or constant (32 bit) from bytecode. */
+ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
--static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
+                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 -                              const uint8_t **tb_ptr)
 -{
 -    uint32_t value;
 -    TCGReg r = **tb_ptr;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i32(tb_ptr);
 -    } else {
 -        value = tci_read_reg32(regs, r);
 -    }
 -    return value;
 -}
 -
 -#if TCG_TARGET_REG_BITS == 32
 -/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
 -static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
 -                              const uint8_t **tb_ptr)
 -{
 -    uint32_t low = tci_read_ri32(regs, tb_ptr);
 -    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
 -}
 -#elif TCG_TARGET_REG_BITS == 64
 -/* Read indexed register or constant (64 bit) from bytecode. */
 -static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
 -                              const uint8_t **tb_ptr)
 -{
 -    uint64_t value;
 -    TCGReg r = **tb_ptr;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i64(tb_ptr);
 -    } else {
 -        value = tci_read_reg64(regs, r);
 -    }
 -    return value;
 -}
 -#endif
 -
  static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
  {
-     tcg_target_ulong label = tci_read_i(tb_ptr);
+@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     return flags ? NULL : host;
          switch (opc) {
          case INDEX_op_call:
 -            t0 = tci_read_ri(regs, &tb_ptr);
 +            t0 = tci_read_i(&tb_ptr);
              tci_tb_ptr = (uintptr_t)tb_ptr;
  #if TCG_TARGET_REG_BITS == 32
              tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond_i32:
              t0 = *tb_ptr++;
              t1 = tci_read_r32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond2_i32:
              t0 = *tb_ptr++;
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond_i64:
              t0 = *tb_ptr++;
              t1 = tci_read_r64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
              break;
          case INDEX_op_divu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 / t2);
              break;
          case INDEX_op_rem_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
              break;
          case INDEX_op_remu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 % t2);
              break;
          case INDEX_op_and_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 31));
              break;
          case INDEX_op_shr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 31));
              break;
          case INDEX_op_sar_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
              break;
  #if TCG_TARGET_HAS_rot_i32
          case INDEX_op_rotl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol32(t1, t2 & 31));
              break;
          case INDEX_op_rotr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror32(t1, t2 & 31));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i32:
              t0 = tci_read_r32(regs, &tb_ptr);
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
          case INDEX_op_brcond2_i32:
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
              break;
          case INDEX_op_divu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
              break;
          case INDEX_op_rem_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
              break;
          case INDEX_op_remu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
              break;
          case INDEX_op_and_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 63));
              break;
          case INDEX_op_shr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 63));
              break;
          case INDEX_op_sar_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
              break;
  #if TCG_TARGET_HAS_rot_i64
          case INDEX_op_rotl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol64(t1, t2 & 63));
              break;
          case INDEX_op_rotr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror64(t1, t2 & 63));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i64:
              t0 = tci_read_r64(regs, &tb_ptr);
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(t0, t1, condition)) {
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rem_i64:
      case INDEX_op_remu_i32:
      case INDEX_op_remu_i64:
 -        return C_O1_I2(r, r, r);
 -
      case INDEX_op_add_i32:
      case INDEX_op_add_i64:
      case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rotl_i64:
      case INDEX_op_rotr_i32:
      case INDEX_op_rotr_i64:
 -        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
 -        return C_O1_I2(r, ri, ri);
 +    case INDEX_op_setcond_i32:
 +    case INDEX_op_setcond_i64:
 +        return C_O1_I2(r, r, r);
      case INDEX_op_deposit_i32:
      case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_brcond_i32:
      case INDEX_op_brcond_i64:
 -        return C_O0_I2(r, ri);
 -
 -    case INDEX_op_setcond_i32:
 -    case INDEX_op_setcond_i64:
 -        return C_O1_I2(r, r, ri);
 +        return C_O0_I2(r, r);
  #if TCG_TARGET_REG_BITS == 32
      /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_sub2_i32:
          return C_O2_I4(r, r, r, r, r, r);
      case INDEX_op_brcond2_i32:
 -        return C_O0_I4(r, r, ri, ri);
 +        return C_O0_I4(r, r, r, r);
      case INDEX_op_mulu2_i32:
          return C_O2_I2(r, r, r, r);
      case INDEX_op_setcond2_i32:
 -        return C_O1_I4(r, r, r, ri, ri);
 +        return C_O1_I4(r, r, r, r, r);
  #endif
      case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
      tcg_out8(s, t0);
  }
--/* Write register or constant (native size). */
++/*
--static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
++ * Return a ram_addr_t for the virtual address for execution.
--{
++ *
--    if (const_arg) {
++ * Return -1 if we can't translate and execute from an entire page
--        tcg_debug_assert(const_arg == 1);
++ * of RAM.  This will force us to execute by loading and translating
--        tcg_out8(s, TCG_CONST);
++ * one insn at a time, without caching.
--        tcg_out_i(s, arg);
++ *
--    } else {
++ * NOTE: This function will trigger an exception if the page is
--        tcg_out_r(s, arg);
++ * not executable.
--    }
++ */
--}
++tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
--
++                                        void **hostp)
--/* Write register or constant (32 bit). */
++{
--static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
++    void *p;
--{
++
--    if (const_arg) {
++    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
--        tcg_debug_assert(const_arg == 1);
++                                cpu_mmu_index(env, true), false, &p, 0);
--        tcg_out8(s, TCG_CONST);
++    if (p == NULL) {
--        tcg_out32(s, arg);
++        return -1;
--    } else {
++    }
--        tcg_out_r(s, arg);
++    if (hostp) {
--    }
++        *hostp = p;
--}
++    }
--
++    return qemu_ram_addr_from_host_nofail(p);
--#if TCG_TARGET_REG_BITS == 64
++}
--/* Write register or constant (64 bit). */
++
--static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
+ #ifdef CONFIG_PLUGIN
--{
+ /*
--    if (const_arg) {
+  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out64(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -#endif
 -
  /* Write label. */
  static void tci_out_label(TCGContext *s, TCGLabel *label)
  {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
  {
      uint8_t *old_code_ptr = s->code_ptr;
      tcg_out_op_t(s, INDEX_op_call);
 -    tcg_out_ri(s, 1, (uintptr_t)arg);
 +    tcg_out_i(s, (uintptr_t)arg);
      old_code_ptr[1] = s->code_ptr - old_code_ptr;
  }
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_setcond_i32:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[2]);
          tcg_out8(s, args[3]);   /* condition */
          break;
  #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
          tcg_out_r(s, args[2]);
 -        tcg_out_ri32(s, const_args[3], args[3]);
 -        tcg_out_ri32(s, const_args[4], args[4]);
 +        tcg_out_r(s, args[3]);
 +        tcg_out_r(s, args[4]);
          tcg_out8(s, args[5]);   /* condition */
          break;
  #elif TCG_TARGET_REG_BITS == 64
      case INDEX_op_setcond_i64:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri64(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[2]);
          tcg_out8(s, args[3]);   /* condition */
          break;
  #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
      case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
      case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 -        tcg_out_ri64(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          break;
      case INDEX_op_brcond_i64:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
      case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
  #if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_brcond2_i32:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 -        tcg_out_ri32(s, const_args[3], args[3]);
 +        tcg_out_r(s, args[2]);
 +        tcg_out_r(s, args[3]);
          tcg_out8(s, args[4]);           /* condition */
          tci_out_label(s, arg_label(args[5]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
  #endif
      case INDEX_op_brcond_i32:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
 --
-.25.1
+.34.1

-[PULL 32/46] cpu: Move synchronize_from_tb() to tcg_ops
+[PULL 13/20] accel/tcg: Document the faulting lookup in tb_lookup_cmp
-From: Eduardo Habkost <ehabkost@redhat.com>
+It was non-obvious to me why we can raise an exception in
 the middle of a comparison function, but it works.
 While nearby, use TARGET_PAGE_ALIGN instead of open-coding.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 [claudio: wrapped target code in CONFIG_TCG, reworded comments]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-5-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 22 +++++++++++++---------
+ accel/tcg/cpu-exec.c | 11 ++++++++++-
- accel/tcg/cpu-exec.c      |  4 ++--
+file changed, 10 insertions(+), 1 deletion(-)
  target/arm/cpu.c          |  4 +++-
  target/avr/cpu.c          |  2 +-
  target/hppa/cpu.c         |  2 +-
  target/i386/tcg/tcg-cpu.c |  2 +-
  target/microblaze/cpu.c   |  2 +-
  target/mips/cpu.c         |  4 +++-
  target/riscv/cpu.c        |  2 +-
  target/rx/cpu.c           |  2 +-
  target/sh4/cpu.c          |  2 +-
  target/sparc/cpu.c        |  2 +-
  target/tricore/cpu.c      |  2 +-
 files changed, 30 insertions(+), 22 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-      * Called when the first CPU is realized.
-      */
-     void (*initialize)(void);
-+    /**
-+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-+     *
-+     * This is called when we abandon execution of a TB before starting it,
-+     * and must set all parts of the CPU state which the previous TB in the
-+     * chain may not have updated.
-+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
-+     *
-+     * If more state needs to be restored, the target must implement a
-+     * function to restore all the state, and register it here.
-+     */
-+    void (*synchronize_from_tb)(CPUState *cpu,
-+                                const struct TranslationBlock *tb);
- } TcgCpuOperations;
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  *       If the target behaviour here is anything other than "set
-  *       the PC register to the value passed in" then the target must
-  *       also implement the synchronize_from_tb hook.
-- * @synchronize_from_tb: Callback for synchronizing state from a TCG
-- *       #TranslationBlock. This is called when we abandon execution
-- *       of a TB before starting it, and must set all parts of the CPU
-- *       state which the previous TB in the chain may not have updated.
-- *       This always includes at least the program counter; some targets
-- *       will need to do more. If this hook is not implemented then the
-- *       default is to call @set_pc(tb->pc).
-  * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
-  *       address fault.  For system mode, if the access is valid, call
-  *       tlb_set_page and return true; if the access is invalid, and
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
-                                Error **errp);
-     void (*set_pc)(CPUState *cpu, vaddr value);
--    void (*synchronize_from_tb)(CPUState *cpu,
--                                const struct TranslationBlock *tb);
-     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                      MMUAccessType access_type, int mmu_idx,
-                      bool probe, uintptr_t retaddr);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
+@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
-                                TARGET_FMT_lx "] %s\n",
+             tb_page_addr_t phys_page2;
-                                last_tb->tc.ptr, last_tb->pc,
+             target_ulong virt_page2;
-                                lookup_symbol(last_tb->pc));
--        if (cc->synchronize_from_tb) {
+-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
--            cc->synchronize_from_tb(cpu, last_tb);
++            /*
-+        if (cc->tcg_ops.synchronize_from_tb) {
++             * We know that the first page matched, and an otherwise valid TB
-+            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
++             * encountered an incomplete instruction at the end of that page,
-         } else {
++             * therefore we know that generating a new TB from the current PC
-             assert(cc->set_pc);
++             * must also require reading from the next page -- even if the
-             cc->set_pc(cpu, last_tb->pc);
++             * second pages do not match, and therefore the resulting insn
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++             * is different for the new TB.  Therefore any exception raised
-index XXXXXXX..XXXXXXX 100644
++             * here by the faulting lookup is not premature.
---- a/target/arm/cpu.c
++             */
-+++ b/target/arm/cpu.c
++            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
+             phys_page2 = get_page_addr_code(desc->env, virt_page2);
-     }
+             if (tb->page_addr[1] == phys_page2) {
- }
+                 return true;
 +#ifdef CONFIG_TCG
  static void arm_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
          env->regs[15] = tb->pc;
      }
  }
 +#endif /* CONFIG_TCG */
  static bool arm_cpu_has_work(CPUState *cs)
  {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
 -    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
      cc->gdb_write_register = arm_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = arm_translate_init;
 +    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
      cc->tcg_ops.initialize = avr_cpu_tcg_init;
 -    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
      cc->gdb_read_register = avr_cpu_gdb_read_register;
      cc->gdb_write_register = avr_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 35;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
 -    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
      cc->tlb_fill = hppa_cpu_tlb_fill;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
  {
      cc->do_interrupt = x86_cpu_do_interrupt;
      cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
 -    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
      cc->cpu_exec_enter = x86_cpu_exec_enter;
      cc->cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
 -    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
      cc->tlb_fill = mb_cpu_tlb_fill;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
      }
  }
 +#ifdef CONFIG_TCG
  static void mips_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
      env->hflags &= ~MIPS_HFLAG_BMASK;
      env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
  }
 +#endif /* CONFIG_TCG */
  static bool mips_cpu_has_work(CPUState *cs)
  {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
 -    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
 -    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
 -    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
      cc->gdb_read_register = rx_cpu_gdb_read_register;
      cc->gdb_write_register = rx_cpu_gdb_write_register;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
 -    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
      cc->tlb_fill = superh_cpu_tlb_fill;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
 -    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
      cc->tlb_fill = sparc_cpu_tlb_fill;
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->dump_state = tricore_cpu_dump_state;
      cc->set_pc = tricore_cpu_set_pc;
 -    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
 +    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
      cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
      cc->tcg_ops.initialize = tricore_tcg_init;
      cc->tlb_fill = tricore_cpu_tlb_fill;
 --
-.25.1
+.34.1

-[PULL 08/46] tcg/tci: Inline tci_write_reg32s into the only caller
+[PULL 14/20] accel/tcg: Remove translator_ldsw
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+The only user can easily use translator_lduw and
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+adjust the type to signed during the return.
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c | 10 +---------
+ include/exec/translator.h   | 1 -
-file changed, 1 insertion(+), 9 deletions(-)
+ target/i386/tcg/translate.c | 2 +-
 files changed, 1 insertion(+), 2 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/exec/translator.h
-+++ b/tcg/tci.c
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
+@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
-     regs[index] = value;
  #define FOR_EACH_TRANSLATOR_LD(F)                                       \
      F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 -    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
      F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
      F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
      F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
  static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
  {
 -    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
 +    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
  }
--#if TCG_TARGET_REG_BITS == 64
+ static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
 -static void
 -tci_write_reg32s(tcg_target_ulong *regs, TCGReg index, int32_t value)
 -{
 -    tci_write_reg(regs, index, value);
 -}
 -#endif
 -
  static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
  {
      tci_write_reg(regs, index, value);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = *tb_ptr++;
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_write_reg32s(regs, t0, *(int32_t *)(t1 + t2));
 +            tci_write_reg(regs, t0, *(int32_t *)(t1 + t2));
              break;
          case INDEX_op_ld_i64:
              t0 = *tb_ptr++;
 --
-.25.1
+.34.1

-[PULL 05/46] tcg/tci: Make tci_tb_ptr thread-local
+[PULL 15/20] accel/tcg: Add pc and host_pc params to gen_intermediate_code
-Each thread must have its own pc, even under TCI.
+Pass these along to translator_loop -- pc may be used instead
 of tb->pc, and host_pc is currently unused.  Adjust all targets
 at one time.
-Remove the GETPC ifdef, because GETPC is always available for
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-helpers, and thus is always required.  Move the assignment
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-under INDEX_op_call, because the value is only visible when
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 we make a call to a helper function.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h | 2 +-
+ include/exec/exec-all.h       |  1 -
- tcg/tcg-common.c        | 4 ----
+ include/exec/translator.h     | 24 ++++++++++++++++++++----
- tcg/tci.c               | 7 +++----
+ accel/tcg/translate-all.c     |  6 ++++--
-files changed, 4 insertions(+), 9 deletions(-)
+ accel/tcg/translator.c        |  9 +++++----
  target/alpha/translate.c      |  5 +++--
  target/arm/translate.c        |  5 +++--
  target/avr/translate.c        |  5 +++--
  target/cris/translate.c       |  5 +++--
  target/hexagon/translate.c    |  6 ++++--
  target/hppa/translate.c       |  5 +++--
  target/i386/tcg/translate.c   |  5 +++--
  target/loongarch/translate.c  |  6 ++++--
  target/m68k/translate.c       |  5 +++--
  target/microblaze/translate.c |  5 +++--
  target/mips/tcg/translate.c   |  5 +++--
  target/nios2/translate.c      |  5 +++--
  target/openrisc/translate.c   |  6 ++++--
  target/ppc/translate.c        |  5 +++--
  target/riscv/translate.c      |  5 +++--
  target/rx/translate.c         |  5 +++--
  target/s390x/tcg/translate.c  |  5 +++--
  target/sh4/translate.c        |  5 +++--
  target/sparc/translate.c      |  5 +++--
  target/tricore/translate.c    |  6 ++++--
  target/xtensa/translate.c     |  6 ++++--
 files changed, 97 insertions(+), 53 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
+ #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
- /* GETPC is the true target of the return instruction that we'll execute.  */
+ #endif
- #if defined(CONFIG_TCG_INTERPRETER)
--extern uintptr_t tci_tb_ptr;
+-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
-+extern __thread uintptr_t tci_tb_ptr;
+ void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
- # define GETPC() tci_tb_ptr
+                           target_ulong *data);
- #else
- # define GETPC() \
+diff --git a/include/exec/translator.h b/include/exec/translator.h
-diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/translator.h
---- a/tcg/tcg-common.c
++++ b/include/exec/translator.h
 +++ b/tcg/tcg-common.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
+ #include "exec/translate-all.h"
  #include "tcg/tcg.h"
--#if defined(CONFIG_TCG_INTERPRETER)
++/**
--uintptr_t tci_tb_ptr;
++ * gen_intermediate_code
--#endif
++ * @cpu: cpu context
--
++ * @tb: translation block
- TCGOpDef tcg_op_defs[] = {
++ * @max_insns: max number of instructions to translate
- #define DEF(s, oargs, iargs, cargs, flags) \
++ * @pc: guest virtual program counter address
-          { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
++ * @host_pc: host physical program counter address
-diff --git a/tcg/tci.c b/tcg/tci.c
++ *
-index XXXXXXX..XXXXXXX 100644
++ * This function must be provided by the target, which should create
---- a/tcg/tci.c
++ * the target-specific DisasContext, and then invoke translator_loop.
-+++ b/tcg/tci.c
++ */
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
++void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
-                                     tcg_target_ulong, tcg_target_ulong);
++                           target_ulong pc, void *host_pc);
  /**
   * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  /**
   * translator_loop:
 - * @ops: Target-specific operations.
 - * @db: Disassembly context.
   * @cpu: Target vCPU.
   * @tb: Translation block.
   * @max_insns: Maximum number of insns to translate.
 + * @pc: guest virtual program counter address
 + * @host_pc: host physical program counter address
 + * @ops: Target-specific operations.
 + * @db: Disassembly context.
   *
   * Generic translator loop.
   *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
   * - When single-stepping is enabled (system-wide or on the current vCPU).
   * - When too many instructions have been translated.
   */
 -void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
 -                     CPUState *cpu, TranslationBlock *tb, int max_insns);
 +void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                     target_ulong pc, void *host_pc,
 +                     const TranslatorOps *ops, DisasContextBase *db);
  void translator_loop_temp_check(DisasContextBase *db);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/cputlb.h"
  #include "exec/translate-all.h"
 +#include "exec/translator.h"
  #include "qemu/bitmap.h"
  #include "qemu/qemu-print.h"
  #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      TCGProfile *prof = &tcg_ctx->prof;
      int64_t ti;
  #endif
++    void *host_pc;
-+__thread uintptr_t tci_tb_ptr;
-+
+     assert_memory_lock();
- static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
+     qemu_thread_jit_write();
- {
-     tci_assert(index < TCG_TARGET_NB_REGS);
+-    phys_pc = get_page_addr_code(env, pc);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
++    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
      if (phys_pc == -1) {
          /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tcg_func_start(tcg_ctx);
      tcg_ctx->cpu = env_cpu(env);
 -    gen_intermediate_code(cpu, tb, max_insns);
 +    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
      assert(tb->size != 0);
      tcg_ctx->cpu = NULL;
      max_insns = tb->icount;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
  #endif
-         TCGMemOpIdx oi;
+ }
--#if defined(GETPC)
+-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
--        tci_tb_ptr = (uintptr_t)tb_ptr;
+-                     CPUState *cpu, TranslationBlock *tb, int max_insns)
--#endif
++void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
--
++                     target_ulong pc, void *host_pc,
-         /* Skip opcode and size entry. */
++                     const TranslatorOps *ops, DisasContextBase *db)
-         tb_ptr += 2;
+ {
+     uint32_t cflags = tb_cflags(tb);
-         switch (opc) {
+     bool plugin_enabled;
-         case INDEX_op_call:
-             t0 = tci_read_ri(regs, &tb_ptr);
+     /* Initialize DisasContext */
-+            tci_tb_ptr = (uintptr_t)tb_ptr;
+     db->tb = tb;
- #if TCG_TARGET_REG_BITS == 32
+-    db->pc_first = tb->pc;
-             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
+-    db->pc_next = db->pc_first;
-                                           tci_read_reg(regs, TCG_REG_R1),
++    db->pc_first = pc;
 +    db->pc_next = pc;
      db->is_jmp = DISAS_NEXT;
      db->num_insns = 0;
      db->max_insns = max_insns;
 diff --git a/target/alpha/translate.c b/target/alpha/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/translate.c
 +++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
      .disas_log          = alpha_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
      const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
      }
  #endif
 -    translator_loop(ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
  }
  void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
 diff --git a/target/avr/translate.c b/target/avr/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/translate.c
 +++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
      .disas_log          = avr_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = { };
 -    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
 diff --git a/target/cris/translate.c b/target/cris/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/translate.c
 +++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
      .disas_log          = cris_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
  }
  void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/translate.c
 +++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
      .disas_log          = hexagon_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &hexagon_tr_ops, &ctx.base);
  }
  #define NAME_LEN               64
 diff --git a/target/hppa/translate.c b/target/hppa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/translate.c
 +++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
      .disas_log          = hppa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
 diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
  };
  /* generate intermediate code for basic block 'tb'.  */
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
 diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/translate.c
 +++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
      .disas_log          = loongarch_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &loongarch_tr_ops, &ctx.base);
  }
  void loongarch_translate_init(void)
 diff --git a/target/m68k/translate.c b/target/m68k/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/translate.c
 +++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
      .disas_log          = m68k_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
  }
  static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
 diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/translate.c
 +++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
      .disas_log          = mb_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
  }
  void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/translate.c
 +++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
      .disas_log          = mips_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
  }
  void mips_tcg_init(void)
 diff --git a/target/nios2/translate.c b/target/nios2/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/translate.c
 +++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
      .disas_log          = nios2_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
  }
  void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/translate.c
 +++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
      .disas_log          = openrisc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &openrisc_tr_ops, &ctx.base);
  }
  void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 diff --git a/target/ppc/translate.c b/target/ppc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate.c
 +++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
      .disas_log          = ppc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
      .disas_log          = riscv_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
  }
  void riscv_translate_init(void)
 diff --git a/target/rx/translate.c b/target/rx/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/translate.c
 +++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
      .disas_log          = rx_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
 diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/translate.c
 +++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
      .disas_log          = s390x_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc;
 -    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
  }
  void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/translate.c
 +++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
      .disas_log          = sh4_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
  }
  void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/translate.c
 +++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
      .disas_log          = sparc_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
  }
  void sparc_tcg_init(void)
 diff --git a/target/tricore/translate.c b/target/tricore/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/translate.c
 +++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
  };
 -void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext ctx;
 -    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
 +    translator_loop(cs, tb, max_insns, pc, host_pc,
 +                    &tricore_tr_ops, &ctx.base);
  }
  void
 diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/translate.c
 +++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
      .disas_log          = xtensa_tr_disas_log,
  };
 -void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
 +void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
 +                           target_ulong pc, void *host_pc)
  {
      DisasContext dc = {};
 -    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
 +    translator_loop(cpu, tb, max_insns, pc, host_pc,
 +                    &xtensa_translator_ops, &dc.base);
  }
  void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 --
-.25.1
+.34.1

-[PULL 06/46] tcg/tci: Implement INDEX_op_ld16s_i32
+Deleted patch
-From: Stefan Weil <sw@weilnetz.de>
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
-    qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reported-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 ++++-
-file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             TODO();
-             break;
-         case INDEX_op_ld16s_i32:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld_i32:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 07/46] tcg/tci: Implement INDEX_op_ld8s_i64
+Deleted patch
-From: Stefan Weil <sw@weilnetz.de>
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
-    qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reported-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 ++++-
-file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i64:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16u_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 09/46] tcg/tci: Inline tci_write_reg8 into its callers
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 9 ++-------
-file changed, 2 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--
- #if TCG_TARGET_REG_BITS == 64
- static void
- tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i32:
-             TODO();
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 10/46] tcg/tci: Inline tci_write_reg16 into the only caller
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 10 +---------
-file changed, 1 insertion(+), 9 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--#if TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--#endif
--
- static void
- tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
- {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg16(regs, t0, *(uint16_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16s_i64:
-             TODO();
---
-.25.1

-[PULL 11/46] tcg/tci: Inline tci_write_reg32 into all callers
+Deleted patch
-For a 64-bit TCI, the upper bits of a 32-bit operation are
-undefined (much like a native ppc64 32-bit operation).  It
-simplifies everything if we don't force-extend the result.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
-file changed, 30 insertions(+), 36 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--static void
--tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--
- #if TCG_TARGET_REG_BITS == 32
- static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
-                             uint32_t low_index, uint64_t value)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t1 = tci_read_r32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
-+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
-             break;
- #if TCG_TARGET_REG_BITS == 32
-         case INDEX_op_setcond2_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp64 = tci_read_r64(regs, &tb_ptr);
-             v64 = tci_read_ri64(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
-+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
-             break;
- #elif TCG_TARGET_REG_BITS == 64
-         case INDEX_op_setcond_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_mov_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-         case INDEX_op_tci_movi_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_i32(&tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-             /* Load/store operations (32 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
-         case INDEX_op_st8_i32:
-             t0 = tci_read_r8(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 + t2);
-+            tci_write_reg(regs, t0, t1 + t2);
-             break;
-         case INDEX_op_sub_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 - t2);
-+            tci_write_reg(regs, t0, t1 - t2);
-             break;
-         case INDEX_op_mul_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 * t2);
-+            tci_write_reg(regs, t0, t1 * t2);
-             break;
- #if TCG_TARGET_HAS_div_i32
-         case INDEX_op_div_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
-+            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
-             break;
-         case INDEX_op_divu_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 / t2);
-+            tci_write_reg(regs, t0, t1 / t2);
-             break;
-         case INDEX_op_rem_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
-+            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
-             break;
-         case INDEX_op_remu_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 % t2);
-+            tci_write_reg(regs, t0, t1 % t2);
-             break;
- #elif TCG_TARGET_HAS_div2_i32
-         case INDEX_op_div2_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 & t2);
-+            tci_write_reg(regs, t0, t1 & t2);
-             break;
-         case INDEX_op_or_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 | t2);
-+            tci_write_reg(regs, t0, t1 | t2);
-             break;
-         case INDEX_op_xor_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 ^ t2);
-+            tci_write_reg(regs, t0, t1 ^ t2);
-             break;
-             /* Shift/rotate operations (32 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 << (t2 & 31));
-+            tci_write_reg(regs, t0, t1 << (t2 & 31));
-             break;
-         case INDEX_op_shr_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
-+            tci_write_reg(regs, t0, t1 >> (t2 & 31));
-             break;
-         case INDEX_op_sar_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
-+            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
-             break;
- #if TCG_TARGET_HAS_rot_i32
-         case INDEX_op_rotl_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
-+            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
-             break;
-         case INDEX_op_rotr_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
-+            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
-             break;
- #endif
- #if TCG_TARGET_HAS_deposit_i32
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp16 = *tb_ptr++;
-             tmp8 = *tb_ptr++;
-             tmp32 = (((1 << tmp8) - 1) << tmp16);
--            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
-+            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
-             break;
- #endif
-         case INDEX_op_brcond_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext8s_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8s(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16s_i32
-         case INDEX_op_ext16s_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16s(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext8u_i32
-         case INDEX_op_ext8u_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16u_i32
-         case INDEX_op_ext16u_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap16_i32
-         case INDEX_op_bswap16_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, bswap16(t1));
-+            tci_write_reg(regs, t0, bswap16(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap32_i32
-         case INDEX_op_bswap32_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, bswap32(t1));
-+            tci_write_reg(regs, t0, bswap32(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_not_i32
-         case INDEX_op_not_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ~t1);
-+            tci_write_reg(regs, t0, ~t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_neg_i32
-         case INDEX_op_neg_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, -t1);
-+            tci_write_reg(regs, t0, -t1);
-             break;
- #endif
- #if TCG_TARGET_REG_BITS == 64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld32s_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 12/46] tcg/tci: Inline tci_write_reg64 into 64-bit callers
+Deleted patch
-Note that we had two functions of the same name: a 32-bit version
-which took two register numbers and a 64-bit version which was a
-no-op wrapper for tcg_write_reg.  After this, we are left with
-only the 32-bit version.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
-file changed, 27 insertions(+), 33 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
-     tci_write_reg(regs, low_index, value);
-     tci_write_reg(regs, high_index, value >> 32);
- }
--#elif TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
--{
--    tci_write_reg(regs, index, value);
--}
- #endif
- #if TCG_TARGET_REG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t1 = tci_read_r64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
-+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
-             break;
- #endif
-         case INDEX_op_mov_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_mov_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-         case INDEX_op_tci_movi_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_i64(&tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-             /* Load/store operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
-         case INDEX_op_st8_i64:
-             t0 = tci_read_r8(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 + t2);
-+            tci_write_reg(regs, t0, t1 + t2);
-             break;
-         case INDEX_op_sub_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 - t2);
-+            tci_write_reg(regs, t0, t1 - t2);
-             break;
-         case INDEX_op_mul_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 * t2);
-+            tci_write_reg(regs, t0, t1 * t2);
-             break;
- #if TCG_TARGET_HAS_div_i64
-         case INDEX_op_div_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 & t2);
-+            tci_write_reg(regs, t0, t1 & t2);
-             break;
-         case INDEX_op_or_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 | t2);
-+            tci_write_reg(regs, t0, t1 | t2);
-             break;
-         case INDEX_op_xor_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 ^ t2);
-+            tci_write_reg(regs, t0, t1 ^ t2);
-             break;
-             /* Shift/rotate operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 << (t2 & 63));
-+            tci_write_reg(regs, t0, t1 << (t2 & 63));
-             break;
-         case INDEX_op_shr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
-+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
-             break;
-         case INDEX_op_sar_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-             break;
- #if TCG_TARGET_HAS_rot_i64
-         case INDEX_op_rotl_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
-             break;
-         case INDEX_op_rotr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
-             break;
- #endif
- #if TCG_TARGET_HAS_deposit_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp16 = *tb_ptr++;
-             tmp8 = *tb_ptr++;
-             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
--            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-             break;
- #endif
-         case INDEX_op_brcond_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext8u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext8s_i64
-         case INDEX_op_ext8s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16s_i64
-         case INDEX_op_ext16s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16u_i64
-         case INDEX_op_ext16u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext32s_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_ext32u_i64
-         case INDEX_op_ext32u_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_extu_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_bswap16_i64
-         case INDEX_op_bswap16_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap16(t1));
-+            tci_write_reg(regs, t0, bswap16(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap32_i64
-         case INDEX_op_bswap32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap32(t1));
-+            tci_write_reg(regs, t0, bswap32(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap64_i64
-         case INDEX_op_bswap64_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap64(t1));
-+            tci_write_reg(regs, t0, bswap64(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_not_i64
-         case INDEX_op_not_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ~t1);
-+            tci_write_reg(regs, t0, ~t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_neg_i64
-         case INDEX_op_neg_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, -t1);
-+            tci_write_reg(regs, t0, -t1);
-             break;
- #endif
- #endif /* TCG_TARGET_REG_BITS == 64 */
---
-.25.1

-[PULL 14/46] tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld8s_i32.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 13 +++++--------
-file changed, 5 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld8s_i32:
--            TODO();
-+        CASE_32_64(ld8s)
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16u_i32:
-             TODO();
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld8s_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld16u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 15/46] tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld16u_i32.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 13 +++++--------
-file changed, 5 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld16u_i32:
--            TODO();
-+        CASE_32_64(ld16u)
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16s_i32:
-             t0 = *tb_ptr++;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld16u_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld16s_i64:
-             TODO();
-             break;
---
-.25.1

-[PULL 16/46] tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld16s_i64.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld16s_i32:
-+        CASE_32_64(ld16s)
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld16s_i64:
--            TODO();
--            break;
-         case INDEX_op_ld32u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 17/46] tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld_i32:
-+        CASE_64(ld32u)
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld32u_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld32s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 18/46] tcg/tci: Merge INDEX_op_st8_{i32,i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 +-------
-file changed, 1 insertion(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
--        case INDEX_op_st8_i32:
-+        CASE_32_64(st8)
-             t0 = tci_read_r8(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st8_i64:
--            t0 = tci_read_r8(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint8_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st16_i64:
-             t0 = tci_read_r16(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 19/46] tcg/tci: Merge INDEX_op_st16_{i32,i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 +-------
-file changed, 1 insertion(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             *(uint8_t *)(t1 + t2) = t0;
-             break;
--        case INDEX_op_st16_i32:
-+        CASE_32_64(st16)
-             t0 = tci_read_r16(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st16_i64:
--            t0 = tci_read_r16(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint16_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st32_i64:
-             t0 = tci_read_r32(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 39/46] cpu: move do_unaligned_access to tcg_ops
+[PULL 16/20] accel/tcg: Add fast path for translator_ld*
-From: Claudio Fontana <cfontana@suse.de>
+Cache the translation from guest to host address, so we may
 use direct loads when we hit on the primary translation page.
-make it consistently SOFTMMU-only.
+Look up the second translation page only once, during translation.
 This obviates another lookup of the second page within tb_gen_code
 after translation.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Fixes a bug in that plugin_insn_append should be passed the bytes
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+in the original memory order, not bswapped by pieces.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Message-Id: <20210204163931.7358-12-cfontana@suse.de>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 13 +++++++------
+ include/exec/translator.h |  63 +++++++++++--------
- target/alpha/cpu.c              |  2 +-
+ accel/tcg/translate-all.c |  23 +++----
- target/arm/cpu.c                |  2 +-
+ accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
- target/hppa/cpu.c               |  4 +++-
+files changed, 141 insertions(+), 71 deletions(-)
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  3 ++-
  target/nios2/cpu.c              |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/s390x/excp_helper.c      |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 23 insertions(+), 19 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/include/exec/translator.h b/include/exec/translator.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/include/exec/translator.h
-+++ b/include/hw/core/cpu.h
++++ b/include/exec/translator.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
-                                   unsigned size, MMUAccessType access_type,
+  * Architecture-agnostic disassembly context.
-                                   int mmu_idx, MemTxAttrs attrs,
+  */
-                                   MemTxResult response, uintptr_t retaddr);
+ typedef struct DisasContextBase {
-+    /**
+-    const TranslationBlock *tb;
-+     * @do_unaligned_access: Callback for unaligned access handling
++    TranslationBlock *tb;
-+     */
+     target_ulong pc_first;
-+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+     target_ulong pc_next;
-+                                MMUAccessType access_type,
+     DisasJumpType is_jmp;
-+                                int mmu_idx, uintptr_t retaddr);
+     int num_insns;
- } TcgCpuOperations;
+     int max_insns;
      bool singlestep_enabled;
 -#ifdef CONFIG_USER_ONLY
 -    /*
 -     * Guest address of the last byte of the last protected page.
 -     *
 -     * Pages containing the translated instructions are made non-writable in
 -     * order to achieve consistency in case another thread is modifying the
 -     * code while translate_insn() fetches the instruction bytes piecemeal.
 -     * Such writer threads are blocked on mmap_lock() in page_unprotect().
 -     */
 -    target_ulong page_protect_end;
 -#endif
 +    void *host_addr[2];
  } DisasContextBase;
  /**
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
-  * @parse_features: Callback to parse command line arguments.
+  * the relevant information at translation time.
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
+  */
-  * @has_work: Callback for checking if there is work to do.
-- * @do_unaligned_access: Callback for unaligned access handling, if
+-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-- * the target defines #TARGET_ALIGNED_ONLY.
+-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
+-                           abi_ptr pc, bool do_swap);                   \
-  * runtime configurable endianness is currently big-endian. Non-configurable
+-    static inline type fullname(CPUArchState *env,                      \
-  * CPUs can use the default implementation of this method. This method should
+-                                DisasContextBase *dcbase, abi_ptr pc)   \
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+-    {                                                                   \
+-        return fullname ## _swap(env, dcbase, pc, false);               \
-     int reset_dump_flags;
++uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
-     bool (*has_work)(CPUState *cpu);
++uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
--    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
++uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
--                                MMUAccessType access_type,
++uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
--                                int mmu_idx, uintptr_t retaddr);
++
-     bool (*virtio_is_big_endian)(CPUState *cpu);
++static inline uint16_t
-     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
++translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
-                            uint8_t *buf, int len, bool is_write);
++                     abi_ptr pc, bool do_swap)
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
++{
 +    uint16_t ret = translator_lduw(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap16(ret);
      }
 +    return ret;
 +}
 -#define FOR_EACH_TRANSLATOR_LD(F)                                       \
 -    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
 -    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
 -    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
 -    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
 +static inline uint32_t
 +translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint32_t ret = translator_ldl(env, db, pc);
 +    if (do_swap) {
 +        ret = bswap32(ret);
 +    }
 +    return ret;
 +}
 -FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 -
 -#undef GEN_TRANSLATOR_LD
 +static inline uint64_t
 +translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
 +                    abi_ptr pc, bool do_swap)
 +{
 +    uint64_t ret = translator_ldq_swap(env, db, pc, false);
 +    if (do_swap) {
 +        ret = bswap64(ret);
 +    }
 +    return ret;
 +}
  /*
   * Return whether addr is on the same page as where disassembly started.
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+     CPUArchState *env = cpu->env_ptr;
+     TranslationBlock *tb, *existing_tb;
--    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+-    tb_page_addr_t phys_pc, phys_page2;
-+    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+-    target_ulong virt_page2;
 +    tb_page_addr_t phys_pc;
      tcg_insn_unit *gen_code_buf;
      int gen_code_size, search_size, max_insns;
  #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tb->flags = flags;
      tb->cflags = cflags;
      tb->trace_vcpu_dstate = *cpu->trace_dstate;
 +    tb->page_addr[0] = phys_pc;
 +    tb->page_addr[1] = -1;
      tcg_ctx->tb_cflags = cflags;
   tb_overflow:
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      }
      /*
 -     * If the TB is not associated with a physical RAM page then
 -     * it must be a temporary one-insn TB, and we have nothing to do
 -     * except fill in the page_addr[] fields. Return early before
 -     * attempting to link to other TBs or add to the lookup table.
 +     * If the TB is not associated with a physical RAM page then it must be
 +     * a temporary one-insn TB, and we have nothing left to do. Return early
 +     * before attempting to link to other TBs or add to the lookup table.
       */
 -    if (phys_pc == -1) {
 -        tb->page_addr[0] = tb->page_addr[1] = -1;
 +    if (tb->page_addr[0] == -1) {
          return tb;
      }
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
       */
      tcg_tb_insert(tb);
 -    /* check next page if needed */
 -    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
 -    phys_page2 = -1;
 -    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
 -        phys_page2 = get_page_addr_code(env, virt_page2);
 -    }
      /*
       * No explicit memory barrier is required -- tb_link_page() makes the
       * TB visible in a consistent state.
       */
 -    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
 +    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
      /* if the TB already exists, discard what we just translated */
      if (unlikely(existing_tb != tb)) {
          uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
 diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translator.c
 +++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
      return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
  }
- static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+-static inline void translator_page_protect(DisasContextBase *dcbase,
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
+-                                           target_ulong pc)
-index XXXXXXX..XXXXXXX 100644
+-{
---- a/target/alpha/cpu.c
+-#ifdef CONFIG_USER_ONLY
-+++ b/target/alpha/cpu.c
+-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+-    page_protect(pc);
-     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
+-#endif
- #ifndef CONFIG_USER_ONLY
+-}
-     cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
+-
--    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
+ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
-+    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
+                      target_ulong pc, void *host_pc,
-     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
+                      const TranslatorOps *ops, DisasContextBase *db)
-     dc->vmsd = &vmstate_alpha_cpu;
+@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
      db->num_insns = 0;
      db->max_insns = max_insns;
      db->singlestep_enabled = cflags & CF_SINGLE_STEP;
 -    translator_page_protect(db, db->pc_next);
 +    db->host_addr[0] = host_pc;
 +    db->host_addr[1] = NULL;
 +
 +#ifdef CONFIG_USER_ONLY
 +    page_protect(pc);
 +#endif
      ops->init_disas_context(db, cpu);
      tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
  #endif
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
--    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
- #if !defined(CONFIG_USER_ONLY)
-     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
-     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/cpu.c
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
-     info->print_insn = print_insn_hppa;
  }
-+#ifndef CONFIG_USER_ONLY
+-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
- static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+-                                                 target_ulong pc, size_t len)
-                                          MMUAccessType access_type,
++static void *translator_access(CPUArchState *env, DisasContextBase *db,
-                                          int mmu_idx, uintptr_t retaddr)
++                               target_ulong pc, size_t len)
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+ {
+-#ifdef CONFIG_USER_ONLY
-     cpu_loop_exit_restore(cs, retaddr);
+-    target_ulong end = pc + len - 1;
 +    void *host;
 +    target_ulong base, end;
 +    TranslationBlock *tb;
 -    if (end > dcbase->page_protect_end) {
 -        translator_page_protect(dcbase, end);
 +    tb = db->tb;
 +
 +    /* Use slow path if first page is MMIO. */
 +    if (unlikely(tb->page_addr[0] == -1)) {
 +        return NULL;
      }
 +
 +    end = pc + len - 1;
 +    if (likely(is_same_page(db, end))) {
 +        host = db->host_addr[0];
 +        base = db->pc_first;
 +    } else {
 +        host = db->host_addr[1];
 +        base = TARGET_PAGE_ALIGN(db->pc_first);
 +        if (host == NULL) {
 +            tb->page_addr[1] =
 +                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
 +#ifdef CONFIG_USER_ONLY
 +            page_protect(end);
  #endif
 +            /* We cannot handle MMIO as second page. */
 +            assert(tb->page_addr[1] != -1);
 +            host = db->host_addr[1];
 +        }
 +
 +        /* Use slow path when crossing pages. */
 +        if (is_same_page(db, pc)) {
 +            return NULL;
 +        }
 +    }
 +
 +    tcg_debug_assert(pc >= base);
 +    return host + (pc - base);
  }
-+#endif /* CONFIG_USER_ONLY */
+-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
- static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
+-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
- {
+-                           abi_ptr pc, bool do_swap)                    \
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+-    {                                                                   \
-     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
+-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
- #ifndef CONFIG_USER_ONLY
+-        type ret = load_fn(env, pc);                                    \
-     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+-        if (do_swap) {                                                  \
-+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
+-            ret = swap_fn(ret);                                         \
-     dc->vmsd = &vmstate_hppa_cpu;
+-        }                                                               \
- #endif
+-        plugin_insn_append(pc, &ret, sizeof(ret));                      \
--    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
+-        return ret;                                                     \
-     cc->disas_set_info = hppa_cpu_disas_set_info;
++uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
-     cc->tcg_ops.initialize = hppa_translate_init;
++{
++    uint8_t ret;
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
++    void *p = translator_access(env, db, pc, sizeof(ret));
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/microblaze/cpu.c
++    if (p) {
-+++ b/target/microblaze/cpu.c
++        plugin_insn_append(pc, p, sizeof(ret));
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
++        return ldub_p(p);
-     cc->class_by_name = mb_cpu_class_by_name;
+     }
-     cc->has_work = mb_cpu_has_work;
++    ret = cpu_ldub_code(env, pc);
-     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
++    plugin_insn_append(pc, &ret, sizeof(ret));
--    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
++    return ret;
-     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
++}
-     cc->dump_state = mb_cpu_dump_state;
-     cc->set_pc = mb_cpu_set_pc;
+-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
++uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
-     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
++{
- #ifndef CONFIG_USER_ONLY
++    uint16_t ret, plug;
-     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
++    void *p = translator_access(env, db, pc, sizeof(ret));
-+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
+-#undef GEN_TRANSLATOR_LD
-     dc->vmsd = &vmstate_mb_cpu;
++    if (p) {
- #endif
++        plugin_insn_append(pc, p, sizeof(ret));
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
++        return lduw_p(p);
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/target/mips/cpu.c
++    ret = cpu_lduw_code(env, pc);
-+++ b/target/mips/cpu.c
++    plug = tswap16(ret);
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
++    plugin_insn_append(pc, &plug, sizeof(ret));
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
++    return ret;
-     cc->gdb_write_register = mips_cpu_gdb_write_register;
++}
- #ifndef CONFIG_USER_ONLY
++
--    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
++uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
-     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
++{
-     cc->vmsd = &vmstate_mips_cpu;
++    uint32_t ret, plug;
- #endif
++    void *p = translator_access(env, db, pc, sizeof(ret));
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
++
-     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
++    if (p) {
- #ifndef CONFIG_USER_ONLY
++        plugin_insn_append(pc, p, sizeof(ret));
-     cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
++        return ldl_p(p);
-+    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
++    }
-+
++    ret = cpu_ldl_code(env, pc);
- #endif /* CONFIG_USER_ONLY */
++    plug = tswap32(ret);
- #endif /* CONFIG_TCG */
++    plugin_insn_append(pc, &plug, sizeof(ret));
++    return ret;
-diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
++}
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/nios2/cpu.c
++uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
-+++ b/target/nios2/cpu.c
++{
-@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
++    uint64_t ret, plug;
-     cc->disas_set_info = nios2_cpu_disas_set_info;
++    void *p = translator_access(env, db, pc, sizeof(ret));
-     cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
++
- #ifndef CONFIG_USER_ONLY
++    if (p) {
--    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
++        plugin_insn_append(pc, p, sizeof(ret));
-+    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
++        return ldq_p(p);
-     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
++    }
- #endif
++    ret = cpu_ldq_code(env, pc);
-     cc->gdb_read_register = nios2_cpu_gdb_read_register;
++    plug = tswap64(ret);
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
++    plugin_insn_append(pc, &plug, sizeof(ret));
-index XXXXXXX..XXXXXXX 100644
++    return ret;
---- a/target/riscv/cpu.c
++}
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
      cc->vmsd = &vmstate_riscv_cpu;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
      cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/excp_helper.c
 +++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
      }
  }
 -#endif /* CONFIG_USER_ONLY */
 +#endif /* !CONFIG_USER_ONLY */
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_write_register = superh_cpu_gdb_write_register;
      cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = ppc_cpu_set_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
      cc->gdb_write_register = ppc_cpu_gdb_write_register;
 -    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 +    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
  #endif /* !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 --
-.25.1
+.34.1

-[PULL 44/46] accel: extend AccelState and AccelClass to user-mode
+[PULL 17/20] target/s390x: Make translator stop before the end of a page
-From: Claudio Fontana <cfontana@suse.de>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Right now translator stops right *after* the end of a page, which
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
-[claudio: rebased on Richard's splitwx work]
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
 Message-Id: <20210204163931.7358-17-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/boards.h                |  2 +-
+ target/s390x/tcg/translate.c     |  15 +++-
- include/{sysemu => qemu}/accel.h   | 14 +++++----
+ tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
- include/sysemu/hvf.h               |  2 +-
+ tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
- include/sysemu/kvm.h               |  2 +-
+ tests/tcg/s390x/Makefile.target  |   1 +
- include/sysemu/kvm_int.h           |  2 +-
+files changed, 257 insertions(+), 4 deletions(-)
- target/i386/hvf/hvf-i386.h         |  2 +-
+ create mode 100644 tests/tcg/s390x/noexec.c
- accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
+ create mode 100644 tests/tcg/multiarch/noexec.c.inc
  accel/{accel.c => accel-softmmu.c} | 27 ++--------------
  accel/accel-user.c                 | 24 ++++++++++++++
  accel/qtest/qtest.c                |  2 +-
  accel/tcg/tcg-all.c                | 15 +++++++--
  accel/xen/xen-all.c                |  2 +-
  bsd-user/main.c                    |  6 +++-
  linux-user/main.c                  |  6 +++-
  softmmu/memory.c                   |  2 +-
  softmmu/qtest.c                    |  2 +-
  softmmu/vl.c                       |  2 +-
  target/i386/hax/hax-all.c          |  2 +-
  target/i386/hvf/hvf.c              |  2 +-
  target/i386/hvf/x86_task.c         |  2 +-
  target/i386/whpx/whpx-all.c        |  2 +-
  MAINTAINERS                        |  2 +-
  accel/meson.build                  |  4 ++-
  accel/tcg/meson.build              |  2 +-
 files changed, 125 insertions(+), 53 deletions(-)
  rename include/{sysemu => qemu}/accel.h (95%)
  create mode 100644 accel/accel-common.c
  rename accel/{accel.c => accel-softmmu.c} (75%)
  create mode 100644 accel/accel-user.c
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/s390x/tcg/translate.c
-+++ b/include/hw/boards.h
++++ b/target/s390x/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
- #include "exec/memory.h"
+     dc->insn_start = tcg_last_op();
- #include "sysemu/hostmem.h"
+ }
- #include "sysemu/blockdev.h"
--#include "sysemu/accel.h"
++static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
-+#include "qemu/accel.h"
++                                uint64_t pc)
- #include "qapi/qapi-types-machine.h"
++{
- #include "qemu/module.h"
++    uint64_t insn = ld_code2(env, s, pc);
- #include "qom/object.h"
++
-diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
++    return pc + get_ilen((insn >> 8) & 0xff);
-similarity index 95%
++}
-rename from include/sysemu/accel.h
++
-rename to include/qemu/accel.h
+ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/include/sysemu/accel.h
+     CPUS390XState *env = cs->env_ptr;
-+++ b/include/qemu/accel.h
+@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
-@@ -XXX,XX +XXX,XX @@
-  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+     dc->base.is_jmp = translate_one(env, dc);
-  * THE SOFTWARE.
+     if (dc->base.is_jmp == DISAS_NEXT) {
-  */
+-        uint64_t page_start;
 -#ifndef HW_ACCEL_H
 -#define HW_ACCEL_H
 +#ifndef QEMU_ACCEL_H
 +#define QEMU_ACCEL_H
  #include "qom/object.h"
  #include "exec/hwaddr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
      /*< public >*/
      const char *name;
 -#ifndef CONFIG_USER_ONLY
      int (*init_machine)(MachineState *ms);
 +#ifndef CONFIG_USER_ONLY
      void (*setup_post)(MachineState *ms, AccelState *accel);
      bool (*has_memory)(MachineState *ms, AddressSpace *as,
                         hwaddr start_addr, hwaddr size);
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
      OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
  AccelClass *accel_find(const char *opt_name);
 +AccelState *current_accel(void);
 +
 +#ifndef CONFIG_USER_ONLY
  int accel_init_machine(AccelState *accel, MachineState *ms);
  /* Called just before os_setup_post (ie just before drop OS privs) */
  void accel_setup_post(MachineState *ms);
 +#endif /* !CONFIG_USER_ONLY */
 -AccelState *current_accel(void);
 -
--#endif
+-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-+#endif /* QEMU_ACCEL_H */
+-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
-diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
++        if (!is_same_page(dcbase, dc->base.pc_next) ||
-index XXXXXXX..XXXXXXX 100644
++            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
---- a/include/sysemu/hvf.h
++            dc->ex_value) {
-+++ b/include/sysemu/hvf.h
+             dc->base.is_jmp = DISAS_TOO_MANY;
-@@ -XXX,XX +XXX,XX @@
+         }
- #ifndef HVF_H
+     }
- #define HVF_H
+diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "qom/object.h"
  #ifdef CONFIG_HVF
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/kvm.h
 +++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@
  #include "qemu/queue.h"
  #include "hw/core/cpu.h"
  #include "exec/memattrs.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "qom/object.h"
  #ifdef NEED_CPU_H
 diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/kvm_int.h
 +++ b/include/sysemu/kvm_int.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_KVM_INT_H
  #include "exec/memory.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/kvm.h"
  typedef struct KVMSlot
 diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-i386.h
 +++ b/target/i386/hvf/hvf-i386.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HVF_I386_H
  #define HVF_I386_H
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/hvf.h"
  #include "cpu.h"
  #include "x86.h"
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/accel/accel-common.c
++++ b/tests/tcg/s390x/noexec.c
 @@ -XXX,XX +XXX,XX @@
-+/*
++#include "../multiarch/noexec.c.inc"
-+ * QEMU accel class, components common to system emulation and user mode
++
-+ *
++static void *arch_mcontext_pc(const mcontext_t *ctx)
-+ * Copyright (c) 2003-2008 Fabrice Bellard
++{
-+ * Copyright (c) 2014 Red Hat Inc.
++    return (void *)ctx->psw.addr;
-+ *
++}
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++
-+ * of this software and associated documentation files (the "Software"), to deal
++static int arch_mcontext_arg(const mcontext_t *ctx)
-+ * in the Software without restriction, including without limitation the rights
++{
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++    return ctx->gregs[2];
-+ * copies of the Software, and to permit persons to whom the Software is
++}
-+ * furnished to do so, subject to the following conditions:
++
-+ *
++static void arch_flush(void *p, int len)
-+ * The above copyright notice and this permission notice shall be included in
++{
-+ * all copies or substantial portions of the Software.
++}
-+ *
++
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++extern char noexec_1[];
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++extern char noexec_2[];
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++extern char noexec_end[];
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++asm("noexec_1:\n"
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
-+ * THE SOFTWARE.
++    "noexec_2:\n"
-+ */
++    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
-+
++    "   br %r14\n"          /* return */
-+#include "qemu/osdep.h"
++    "noexec_end:");
-+#include "qemu/accel.h"
++
-+
++extern char exrl_1[];
-+static const TypeInfo accel_type = {
++extern char exrl_2[];
-+    .name = TYPE_ACCEL,
++extern char exrl_end[];
-+    .parent = TYPE_OBJECT,
++
-+    .class_size = sizeof(AccelClass),
++asm("exrl_1:\n"
-+    .instance_size = sizeof(AccelState),
++    "   exrl %r0, exrl_2\n"
-+};
++    "   br %r14\n"
-+
++    "exrl_2:\n"
-+/* Lookup AccelClass from opt_name. Returns NULL if not found */
++    "   lgfi %r2,2\n"
-+AccelClass *accel_find(const char *opt_name)
++    "exrl_end:");
-+{
++
-+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
++int main(void)
-+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
++{
-+    g_free(class_name);
++    struct noexec_test noexec_tests[] = {
-+    return ac;
++        {
-+}
++            .name = "fallthrough",
-+
++            .test_code = noexec_1,
-+static void register_accel_types(void)
++            .test_len = noexec_end - noexec_1,
-+{
++            .page_ofs = noexec_1 - noexec_2,
-+    type_register_static(&accel_type);
++            .entry_ofs = noexec_1 - noexec_2,
-+}
++            .expected_si_ofs = 0,
-+
++            .expected_pc_ofs = 0,
-+type_init(register_accel_types);
++            .expected_arg = 1,
-diff --git a/accel/accel.c b/accel/accel-softmmu.c
++        },
-similarity index 75%
++        {
-rename from accel/accel.c
++            .name = "jump",
-rename to accel/accel-softmmu.c
++            .test_code = noexec_1,
-index XXXXXXX..XXXXXXX 100644
++            .test_len = noexec_end - noexec_1,
---- a/accel/accel.c
++            .page_ofs = noexec_1 - noexec_2,
-+++ b/accel/accel-softmmu.c
++            .entry_ofs = 0,
-@@ -XXX,XX +XXX,XX @@
++            .expected_si_ofs = 0,
- /*
++            .expected_pc_ofs = 0,
-- * QEMU System Emulator, accelerator interfaces
++            .expected_arg = 0,
-+ * QEMU accel class, system emulation components
++        },
-  *
++        {
-  * Copyright (c) 2003-2008 Fabrice Bellard
++            .name = "exrl",
-  * Copyright (c) 2014 Red Hat Inc.
++            .test_code = exrl_1,
-@@ -XXX,XX +XXX,XX @@
++            .test_len = exrl_end - exrl_1,
-  */
++            .page_ofs = exrl_1 - exrl_2,
++            .entry_ofs = exrl_1 - exrl_2,
- #include "qemu/osdep.h"
++            .expected_si_ofs = 0,
--#include "sysemu/accel.h"
++            .expected_pc_ofs = exrl_1 - exrl_2,
-+#include "qemu/accel.h"
++            .expected_arg = 0,
- #include "hw/boards.h"
++        },
- #include "sysemu/arch_init.h"
++        {
- #include "sysemu/sysemu.h"
++            .name = "fallthrough [cross]",
- #include "qom/object.h"
++            .test_code = noexec_1,
++            .test_len = noexec_end - noexec_1,
--static const TypeInfo accel_type = {
++            .page_ofs = noexec_1 - noexec_2 - 2,
--    .name = TYPE_ACCEL,
++            .entry_ofs = noexec_1 - noexec_2 - 2,
--    .parent = TYPE_OBJECT,
++            .expected_si_ofs = 0,
--    .class_size = sizeof(AccelClass),
++            .expected_pc_ofs = -2,
--    .instance_size = sizeof(AccelState),
++            .expected_arg = 1,
--};
++        },
--
++        {
--/* Lookup AccelClass from opt_name. Returns NULL if not found */
++            .name = "jump [cross]",
--AccelClass *accel_find(const char *opt_name)
++            .test_code = noexec_1,
--{
++            .test_len = noexec_end - noexec_1,
--    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
++            .page_ofs = noexec_1 - noexec_2 - 2,
--    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
++            .entry_ofs = -2,
--    g_free(class_name);
++            .expected_si_ofs = 0,
--    return ac;
++            .expected_pc_ofs = -2,
--}
++            .expected_arg = 0,
--
++        },
- int accel_init_machine(AccelState *accel, MachineState *ms)
++        {
- {
++            .name = "exrl [cross]",
-     AccelClass *acc = ACCEL_GET_CLASS(accel);
++            .test_code = exrl_1,
-@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
++            .test_len = exrl_end - exrl_1,
-         acc->setup_post(ms, accel);
++            .page_ofs = exrl_1 - exrl_2 - 2,
-     }
++            .entry_ofs = exrl_1 - exrl_2 - 2,
- }
++            .expected_si_ofs = 0,
--
++            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
--static void register_accel_types(void)
++            .expected_arg = 0,
--{
++        },
--    type_register_static(&accel_type);
++    };
--}
++
--
++    return test_noexec(noexec_tests,
--type_init(register_accel_types);
++                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
-diff --git a/accel/accel-user.c b/accel/accel-user.c
++}
 diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/accel/accel-user.c
++++ b/tests/tcg/multiarch/noexec.c.inc
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU accel class, user-mode components
++ * Common code for arch-specific MMU_INST_FETCH fault testing.
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
-+#include "qemu/osdep.h"
++#define _GNU_SOURCE
-+#include "qemu/accel.h"
++
-+
++#include <assert.h>
-+AccelState *current_accel(void)
++#include <signal.h>
-+{
++#include <stdio.h>
-+    static AccelState *accel;
++#include <stdlib.h>
-+
++#include <string.h>
-+    if (!accel) {
++#include <errno.h>
-+        AccelClass *ac = accel_find("tcg");
++#include <unistd.h>
-+
++#include <sys/mman.h>
-+        g_assert(ac != NULL);
++#include <sys/ucontext.h>
-+        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
++
-+    }
++/* Forward declarations. */
-+    return accel;
++
-+}
++static void *arch_mcontext_pc(const mcontext_t *ctx);
-diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
++static int arch_mcontext_arg(const mcontext_t *ctx);
 +static void arch_flush(void *p, int len);
 +
 +/* Testing infrastructure. */
 +
 +struct noexec_test {
 +    const char *name;
 +    const char *test_code;
 +    int test_len;
 +    int page_ofs;
 +    int entry_ofs;
 +    int expected_si_ofs;
 +    int expected_pc_ofs;
 +    int expected_arg;
 +};
 +
 +static void *page_base;
 +static int page_size;
 +static const struct noexec_test *current_noexec_test;
 +
 +static void handle_err(const char *syscall)
 +{
 +    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
 +    exit(EXIT_FAILURE);
 +}
 +
 +static void handle_segv(int sig, siginfo_t *info, void *ucontext)
 +{
 +    const struct noexec_test *test = current_noexec_test;
 +    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
 +    void *expected_si;
 +    void *expected_pc;
 +    void *pc;
 +    int arg;
 +
 +    if (test == NULL) {
 +        printf("[  FAILED  ] unexpected SEGV\n");
 +        exit(EXIT_FAILURE);
 +    }
 +    current_noexec_test = NULL;
 +
 +    expected_si = page_base + test->expected_si_ofs;
 +    if (info->si_addr != expected_si) {
 +        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
 +               info->si_addr, expected_si);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    pc = arch_mcontext_pc(mc);
 +    expected_pc = page_base + test->expected_pc_ofs;
 +    if (pc != expected_pc) {
 +        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    arg = arch_mcontext_arg(mc);
 +    if (arg != test->expected_arg) {
 +        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    if (mprotect(page_base, page_size,
 +                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
 +        handle_err("mprotect");
 +    }
 +}
 +
 +static void test_noexec_1(const struct noexec_test *test)
 +{
 +    void *start = page_base + test->page_ofs;
 +    void (*fn)(int arg) = page_base + test->entry_ofs;
 +
 +    memcpy(start, test->test_code, test->test_len);
 +    arch_flush(start, test->test_len);
 +
 +    /* Trigger TB creation in order to test invalidation. */
 +    fn(0);
 +
 +    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
 +        handle_err("mprotect");
 +    }
 +
 +    /* Trigger SEGV and check that handle_segv() ran. */
 +    current_noexec_test = test;
 +    fn(0);
 +    assert(current_noexec_test == NULL);
 +}
 +
 +static int test_noexec(struct noexec_test *tests, size_t n_tests)
 +{
 +    struct sigaction act;
 +    size_t i;
 +
 +    memset(&act, 0, sizeof(act));
 +    act.sa_sigaction = handle_segv;
 +    act.sa_flags = SA_SIGINFO;
 +    if (sigaction(SIGSEGV, &act, NULL) < 0) {
 +        handle_err("sigaction");
 +    }
 +
 +    page_size = getpagesize();
 +    page_base = mmap(NULL, 2 * page_size,
 +                     PROT_READ | PROT_WRITE | PROT_EXEC,
 +                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
 +    if (page_base == MAP_FAILED) {
 +        handle_err("mmap");
 +    }
 +    page_base += page_size;
 +
 +    for (i = 0; i < n_tests; i++) {
 +        struct noexec_test *test = &tests[i];
 +
 +        printf("[ RUN      ] %s\n", test->name);
 +        test_noexec_1(test);
 +        printf("[       OK ]\n");
 +    }
 +
 +    printf("[  PASSED  ]\n");
 +    return EXIT_SUCCESS;
 +}
 diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/accel/qtest/qtest.c
+--- a/tests/tcg/s390x/Makefile.target
-+++ b/accel/qtest/qtest.c
++++ b/tests/tcg/s390x/Makefile.target
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ TESTS+=shift
- #include "qemu/module.h"
+ TESTS+=trap
- #include "qemu/option.h"
+ TESTS+=signals-s390x
- #include "qemu/config-file.h"
+ TESTS+=branch-relative-long
--#include "sysemu/accel.h"
++TESTS+=noexec
-+#include "qemu/accel.h"
- #include "sysemu/qtest.h"
+ Z14_TESTS=vfminmax
- #include "sysemu/cpus.h"
+ vfminmax: LDFLAGS+=-lm
  #include "sysemu/cpu-timers.h"
 diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-all.c
 +++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
  #include "tcg/tcg.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/boards.h"
 +#include "qemu/accel.h"
  #include "qapi/qapi-builtin-visit.h"
 +
 +#ifndef CONFIG_USER_ONLY
  #include "tcg-cpus.h"
 +#endif /* CONFIG_USER_ONLY */
  struct TCGState {
      AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
      s->mttcg_enabled = default_mttcg_enabled();
      /* If debugging enabled, default "auto on", otherwise off. */
 -#ifdef CONFIG_DEBUG_TCG
 +#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
      s->splitwx_enabled = -1;
  #else
      s->splitwx_enabled = 0;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      mttcg_enabled = s->mttcg_enabled;
      /*
 -     * Initialize TCG regions
 +     * Initialize TCG regions only for softmmu.
 +     *
 +     * This needs to be done later for user mode, because the prologue
 +     * generation needs to be delayed so that GUEST_BASE is already set.
       */
 +#ifndef CONFIG_USER_ONLY
      tcg_region_init();
      if (mttcg_enabled) {
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      } else {
          cpus_register_accel(&tcg_cpus_rr);
      }
 +#endif /* !CONFIG_USER_ONLY */
 +
      return 0;
  }
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/xen/xen-legacy-backend.h"
  #include "hw/xen/xen_pt.h"
  #include "chardev/char.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/cpus.h"
  #include "sysemu/xen.h"
  #include "sysemu/runstate.h"
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu-common.h"
  #include "qemu/units.h"
 +#include "qemu/accel.h"
  #include "sysemu/tcg.h"
  #include "qemu-version.h"
  #include <machine/trap.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      }
      /* init tcg before creating CPUs and to get qemu_host_page_size */
 -    tcg_exec_init(0, false);
 +    {
 +        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 +        ac->init_machine(NULL);
 +    }
      cpu_type = parse_cpu_option(cpu_model);
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu-common.h"
  #include "qemu/units.h"
 +#include "qemu/accel.h"
  #include "sysemu/tcg.h"
  #include "qemu-version.h"
  #include <sys/syscall.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
      cpu_type = parse_cpu_option(cpu_model);
      /* init tcg before creating CPUs and to get qemu_host_page_size */
 -    tcg_exec_init(0, false);
 +    {
 +        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 +        ac->init_machine(NULL);
 +    }
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
      cpu_reset(cpu);
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "sysemu/runstate.h"
  #include "sysemu/tcg.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "hw/boards.h"
  #include "migration/vmstate.h"
 diff --git a/softmmu/qtest.c b/softmmu/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/qtest.c
 +++ b/softmmu/qtest.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/ioport.h"
  #include "exec/memory.h"
  #include "hw/irq.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/cpu-timers.h"
  #include "qemu/config-file.h"
  #include "qemu/option.h"
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "qemu/sockets.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "hw/usb.h"
  #include "hw/isa/isa.h"
  #include "hw/scsi/scsi.h"
 diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-all.c
 +++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu-common.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/reset.h"
  #include "sysemu/runstate.h"
  #include "hw/boards.h"
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "hw/i386/apic_internal.h"
  #include "qemu/main-loop.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "target/i386/cpu.h"
  #include "hvf-cpus.h"
 diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/x86_task.c
 +++ b/target/i386/hvf/x86_task.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/i386/apic_internal.h"
  #include "qemu/main-loop.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "target/i386/cpu.h"
  // TODO: taskswitch handling
 diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-all.c
 +++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "exec/ioport.h"
  #include "qemu-common.h"
 -#include "sysemu/accel.h"
 +#include "qemu/accel.h"
  #include "sysemu/whpx.h"
  #include "sysemu/cpus.h"
  #include "sysemu/runstate.h"
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Overall
  M: Richard Henderson <richard.henderson@linaro.org>
  R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
 -F: include/sysemu/accel.h
 +F: include/qemu/accel.h
  F: accel/accel.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 diff --git a/accel/meson.build b/accel/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -XXX,XX +XXX,XX @@
 -softmmu_ss.add(files('accel.c'))
 +specific_ss.add(files('accel-common.c'))
 +softmmu_ss.add(files('accel-softmmu.c'))
 +user_ss.add(files('accel-user.c'))
  subdir('qtest')
  subdir('kvm')
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
  tcg_ss = ss.source_set()
  tcg_ss.add(files(
 +  'tcg-all.c',
    'cpu-exec-common.c',
    'cpu-exec.c',
    'tcg-runtime-gvec.c',
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
  specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
 -  'tcg-all.c',
    'cputlb.c',
    'tcg-cpus.c',
    'tcg-cpus-mttcg.c',
 --
-.25.1
+.34.1

-[PULL 46/46] accel: introduce AccelCPUClass extending CPUClass
+[PULL 18/20] target/i386: Make translator stop before the end of a page
-From: Claudio Fontana <cfontana@suse.de>
+From: Ilya Leoshkevich <iii@linux.ibm.com>
-add a new optional interface to CPUClass, which allows accelerators
+Right now translator stops right *after* the end of a page, which
-to extend the CPUClass with additional accelerator-specific
+breaks reporting of fault locations when the last instruction of a
-initializations.
+multi-insn translation block crosses a page boundary.
-This will allow to separate the target cpu code that is specific
+An implementation, like the one arm and s390x have, would require an
-to each accelerator, and register it automatically with object
+i386 length disassembler, which is burdensome to maintain. Another
-hierarchy lookup depending on accelerator code availability,
+alternative would be to single-step at the end of a guest page, but
-as part of the accel_init_interfaces() initialization step.
+this may come with a performance impact.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Fix by snapshotting disassembly state and restoring it after we figure
-Message-Id: <20210204163931.7358-19-cfontana@suse.de>
+out we crossed a page boundary. This includes rolling back cc_op
 updates and emitted ops.
 Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
 Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
 [rth: Simplify end-of-insn cross-page checks.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
+ target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
- include/hw/core/cpu.h       |  4 ++++
+ tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
- accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
+ tests/tcg/x86_64/Makefile.target |  3 +-
- MAINTAINERS                 |  1 +
+files changed, 116 insertions(+), 26 deletions(-)
-files changed, 87 insertions(+)
+ create mode 100644 tests/tcg/x86_64/noexec.c
- create mode 100644 include/hw/core/accel-cpu.h
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
+index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/translate.c
 +++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      TCGv_i64 tmp1_i64;
      sigjmp_buf jmpbuf;
 +    TCGOp *prev_insn_end;
  } DisasContext;
  /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
  {
      uint64_t pc = s->pc;
 +    /* This is a subsequent insn that crosses a page boundary.  */
 +    if (s->base.num_insns > 1 &&
 +        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
 +        siglongjmp(s->jmpbuf, 2);
 +    }
 +
      s->pc += num_bytes;
      if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
          /* If the instruction's 16th byte is on a different page than the 1st, a
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
      int modrm, reg, rm, mod, op, opreg, val;
      target_ulong next_eip, tval;
      target_ulong pc_start = s->base.pc_next;
 +    bool orig_cc_op_dirty = s->cc_op_dirty;
 +    CCOp orig_cc_op = s->cc_op;
      s->pc_start = s->pc = pc_start;
      s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
      s->rip_offset = 0; /* for relative ip address */
      s->vex_l = 0;
      s->vex_v = 0;
 -    if (sigsetjmp(s->jmpbuf, 0) != 0) {
 +    switch (sigsetjmp(s->jmpbuf, 0)) {
 +    case 0:
 +        break;
 +    case 1:
          gen_exception_gpf(s);
          return s->pc;
 +    case 2:
 +        /* Restore state that may affect the next instruction. */
 +        s->cc_op_dirty = orig_cc_op_dirty;
 +        s->cc_op = orig_cc_op;
 +        s->base.num_insns--;
 +        tcg_remove_ops_after(s->prev_insn_end);
 +        s->base.is_jmp = DISAS_TOO_MANY;
 +        return pc_start;
 +    default:
 +        g_assert_not_reached();
      }
      prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  {
      DisasContext *dc = container_of(dcbase, DisasContext, base);
 +    dc->prev_insn_end = tcg_last_op();
      tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
  }
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
  #endif
      pc_next = disas_insn(dc, cpu);
 -
 -    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 -        /* if single step mode, we generate only one instruction and
 -           generate an exception */
 -        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 -           the flag and abort the translation to give the irqs a
 -           chance to happen */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
 -               && ((pc_next & TARGET_PAGE_MASK)
 -                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
 -                       & TARGET_PAGE_MASK)
 -                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
 -        /* Do not cross the boundary of the pages in icount mode,
 -           it can cause an exception. Do it only when boundary is
 -           crossed by the first instruction in the block.
 -           If current instruction already crossed the bound - it's ok,
 -           because an exception hasn't stopped this code.
 -         */
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
 -        dc->base.is_jmp = DISAS_TOO_MANY;
 -    }
 -
      dc->base.pc_next = pc_next;
 +
 +    if (dc->base.is_jmp == DISAS_NEXT) {
 +        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
 +            /*
 +             * If single step mode, we generate only one instruction and
 +             * generate an exception.
 +             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
 +             * the flag and abort the translation to give the irqs a
 +             * chance to happen.
 +             */
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        } else if (!is_same_page(&dc->base, pc_next)) {
 +            dc->base.is_jmp = DISAS_TOO_MANY;
 +        }
 +    }
  }
  static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/core/accel-cpu.h
++++ b/tests/tcg/x86_64/noexec.c
 @@ -XXX,XX +XXX,XX @@
-+/*
++#include "../multiarch/noexec.c.inc"
-+ * Accelerator interface, specializes CPUClass
++
-+ * This header is used only by target-specific code.
++static void *arch_mcontext_pc(const mcontext_t *ctx)
-+ *
++{
-+ * Copyright 2021 SUSE LLC
++    return (void *)ctx->gregs[REG_RIP];
-+ *
++}
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++
-+ * See the COPYING file in the top-level directory.
++int arch_mcontext_arg(const mcontext_t *ctx)
-+ */
++{
-+
++    return ctx->gregs[REG_RDI];
-+#ifndef ACCEL_CPU_H
++}
-+#define ACCEL_CPU_H
++
-+
++static void arch_flush(void *p, int len)
-+/*
++{
-+ * This header is used to define new accelerator-specific target-specific
++}
-+ * accelerator cpu subclasses.
++
-+ * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
++extern char noexec_1[];
-+ *
++extern char noexec_2[];
-+ * Do not try to use for any other purpose than the implementation of new
++extern char noexec_end[];
-+ * subclasses in target/, or the accel implementation itself in accel/
++
-+ */
++asm("noexec_1:\n"
-+
++    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
-+#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
++    "noexec_2:\n"
-+#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
++    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
-+typedef struct AccelCPUClass AccelCPUClass;
++    "    ret\n"
-+DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
++    "noexec_end:");
 +
-+typedef struct AccelCPUClass {
++int main(void)
-+    /*< private >*/
++{
-+    ObjectClass parent_class;
++    struct noexec_test noexec_tests[] = {
-+    /*< public >*/
++        {
-+
++            .name = "fallthrough",
-+    void (*cpu_class_init)(CPUClass *cc);
++            .test_code = noexec_1,
-+    void (*cpu_instance_init)(CPUState *cpu);
++            .test_len = noexec_end - noexec_1,
-+    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
++            .page_ofs = noexec_1 - noexec_2,
-+} AccelCPUClass;
++            .entry_ofs = noexec_1 - noexec_2,
-+
++            .expected_si_ofs = 0,
-+#endif /* ACCEL_CPU_H */
++            .expected_pc_ofs = 0,
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
++            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
 diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/tests/tcg/x86_64/Makefile.target
-+++ b/include/hw/core/cpu.h
++++ b/tests/tcg/x86_64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
+@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
- /* see tcg-cpu-ops.h */
- struct TCGCPUOps;
+ ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
+ X86_64_TESTS += vsyscall
-+/* see accel-cpu.h */
++X86_64_TESTS += noexec
-+struct AccelCPUClass;
+ TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
-+
+ else
- /**
+ TESTS=$(MULTIARCH_TESTS)
-  * CPUClass:
+@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
-  * @class_by_name: Callback to map -cpu command line model name to an
+ test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+     $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-     /* Keep non-pointer data at the end to minimize holes.  */
-     int gdb_num_core_regs;
+-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
-     bool gdb_stop_before_watchpoint;
++%: $(SRC_PATH)/tests/tcg/x86_64/%.c
-+    struct AccelCPUClass *accel_cpu;
+     $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
      /* when TCG is not available, this pointer is NULL */
      struct TCGCPUOps *tcg_ops;
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-common.c
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
 +#include "cpu.h"
 +#include "hw/core/accel-cpu.h"
 +
  #ifndef CONFIG_USER_ONLY
  #include "accel-softmmu.h"
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
      return ac;
  }
 +static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
 +{
 +    CPUClass *cc = CPU_CLASS(klass);
 +    AccelCPUClass *accel_cpu = opaque;
 +
 +    cc->accel_cpu = accel_cpu;
 +    if (accel_cpu->cpu_class_init) {
 +        accel_cpu->cpu_class_init(cc);
 +    }
 +}
 +
 +/* initialize the arch-specific accel CpuClass interfaces */
 +static void accel_init_cpu_interfaces(AccelClass *ac)
 +{
 +    const char *ac_name; /* AccelClass name */
 +    char *acc_name;      /* AccelCPUClass name */
 +    ObjectClass *acc;    /* AccelCPUClass */
 +
 +    ac_name = object_class_get_name(OBJECT_CLASS(ac));
 +    g_assert(ac_name != NULL);
 +
 +    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
 +    acc = object_class_by_name(acc_name);
 +    g_free(acc_name);
 +
 +    if (acc) {
 +        object_class_foreach(accel_init_cpu_int_aux,
 +                             CPU_RESOLVING_TYPE, false, acc);
 +    }
 +}
 +
  void accel_init_interfaces(AccelClass *ac)
  {
  #ifndef CONFIG_USER_ONLY
      accel_init_ops_interfaces(ac);
  #endif /* !CONFIG_USER_ONLY */
 +
 +    accel_init_cpu_interfaces(ac);
  }
 +static const TypeInfo accel_cpu_type = {
 +    .name = TYPE_ACCEL_CPU,
 +    .parent = TYPE_OBJECT,
 +    .abstract = true,
 +    .class_size = sizeof(AccelCPUClass),
 +};
 +
  static void register_accel_types(void)
  {
      type_register_static(&accel_type);
 +    type_register_static(&accel_cpu_type);
  }
  type_init(register_accel_types);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
  F: include/sysemu/accel-ops.h
 +F: include/hw/core/accel-cpu.h
  F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 --
-.25.1
+.34.1

-[PULL 20/46] tcg/tci: Move stack bounds check to compile-time
+[PULL 19/20] target/riscv: Add MAX_INSN_LEN and insn_len
-The existing check was incomplete:
+These will be useful in properly ending the TB.
 (1) Only applied to two of the 7 stores, and not to the loads at all.
 (2) Only checked the upper, but not the lower bound of the stack.
-Doing this at compile time means that we don't need to do it
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-at runtime as well.
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                |  2 --
+ target/riscv/translate.c | 10 +++++++++-
- tcg/tci/tcg-target.c.inc | 13 +++++++++++++
+file changed, 9 insertions(+), 1 deletion(-)
 files changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/target/riscv/translate.c
-+++ b/tcg/tci.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
-             t0 = tci_read_r32(regs, &tb_ptr);
+ /* Include decoders for factored-out extensions */
-             t1 = tci_read_r(regs, &tb_ptr);
+ #include "decode-XVentanaCondOps.c.inc"
-             t2 = tci_read_s32(&tb_ptr);
--            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
++/* The specification allows for longer insns, but not supported by qemu. */
-             *(uint32_t *)(t1 + t2) = t0;
++#define MAX_INSN_LEN  4
-             break;
++
++static inline int insn_len(uint16_t first_word)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              t0 = tci_read_r64(regs, &tb_ptr);
              t1 = tci_read_r(regs, &tb_ptr);
              t2 = tci_read_s32(&tb_ptr);
 -            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
              *(uint64_t *)(t1 + t2) = t0;
              break;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
      }
  }
 +static void stack_bounds_check(TCGReg base, target_long offset)
 +{
-+    if (base == TCG_REG_CALL_STACK) {
++    return (first_word & 3) == 3 ? 4 : 2;
 +        tcg_debug_assert(offset < 0);
 +        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
 +    }
 +}
 +
- static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
+ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                         intptr_t arg2)
  {
-     uint8_t *old_code_ptr = s->code_ptr;
+     /*
-+
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-+    stack_bounds_check(arg1, arg2);
+     };
-     if (type == TCG_TYPE_I32) {
-         tcg_out_op_t(s, INDEX_op_ld_i32);
+     /* Check for compressed insn */
-         tcg_out_r(s, ret);
+-    if (extract16(opcode, 0, 2) != 3) {
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
++    if (insn_len(opcode) == 2) {
-     case INDEX_op_st16_i64:
+         if (!has_ext(ctx, RVC)) {
-     case INDEX_op_st32_i64:
+             gen_exception_illegal(ctx);
-     case INDEX_op_st_i64:
+         } else {
 +        stack_bounds_check(args[1], args[2]);
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
          tcg_debug_assert(args[2] == (int32_t)args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                         intptr_t arg2)
  {
      uint8_t *old_code_ptr = s->code_ptr;
 +
 +    stack_bounds_check(arg1, arg2);
      if (type == TCG_TYPE_I32) {
          tcg_out_op_t(s, INDEX_op_st_i32);
          tcg_out_r(s, arg);
 --
-.25.1
+.34.1

-[PULL 21/46] tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             *(uint16_t *)(t1 + t2) = t0;
-             break;
-         case INDEX_op_st_i32:
-+        CASE_64(st32)
-             t0 = tci_read_r32(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st32_i64:
--            t0 = tci_read_r32(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint32_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st_i64:
-             t0 = tci_read_r64(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 22/46] tcg/tci: Use g_assert_not_reached
+Deleted patch
-Three TODO instances are never happen cases.
-Other uses of tcg_abort are also indicating unreachable cases.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Stefan Weil <sw@weilnetz.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 15 +++++++--------
-file changed, 7 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
-         result = (u0 > u1);
-         break;
-     default:
--        TODO();
-+        g_assert_not_reached();
-     }
-     return result;
- }
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
-         result = (u0 > u1);
-         break;
-     default:
--        TODO();
-+        g_assert_not_reached();
-     }
-     return result;
- }
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 tmp32 = qemu_ld_beul;
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             tci_write_reg(regs, t0, tmp32);
-             break;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 tmp64 = qemu_ld_beq;
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             tci_write_reg(regs, t0, tmp64);
-             if (TCG_TARGET_REG_BITS == 32) {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 qemu_st_bel(t0);
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             break;
-         case INDEX_op_qemu_st_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 qemu_st_beq(tmp64);
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             break;
-         case INDEX_op_mb:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             smp_mb();
-             break;
-         default:
--            TODO();
--            break;
-+            g_assert_not_reached();
-         }
-         tci_assert(tb_ptr == old_code_ptr + op_size);
-     }
---
-.25.1

-[PULL 23/46] tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+Deleted patch
-We do not simultaneously support div and div2 -- it's one
-or the other.  TCI is already using div, so remove div2.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c                | 12 ------------
- tcg/tci/tcg-target.c.inc |  8 --------
-files changed, 20 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 * t2);
-             break;
--#if TCG_TARGET_HAS_div_i32
-         case INDEX_op_div_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 % t2);
-             break;
--#elif TCG_TARGET_HAS_div2_i32
--        case INDEX_op_div2_i32:
--        case INDEX_op_divu2_i32:
--            TODO();
--            break;
--#endif
-         case INDEX_op_and_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_remu_i64:
-             TODO();
-             break;
--#elif TCG_TARGET_HAS_div2_i64
--        case INDEX_op_div2_i64:
--        case INDEX_op_divu2_i64:
--            TODO();
--            break;
- #endif
-         case INDEX_op_and_i64:
-             t0 = *tb_ptr++;
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-         TODO();
-         break;
--    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
--    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
--        TODO();
--        break;
-     case INDEX_op_brcond_i64:
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-         tcg_out_ri32(s, const_args[1], args[1]);
-         tcg_out_ri32(s, const_args[2], args[2]);
-         break;
--    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
--    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
--        TODO();
--        break;
- #if TCG_TARGET_REG_BITS == 32
-     case INDEX_op_add2_i32:
-     case INDEX_op_sub2_i32:
---
-.25.1

-[PULL 24/46] tcg/tci: Implement 64-bit division
+Deleted patch
-Trivially implemented like other arithmetic.
-Tested via check-tcg and the ppc64 target.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci/tcg-target.h     |  4 ++--
- tcg/tci.c                | 28 ++++++++++++++++++++++------
- tcg/tci/tcg-target.c.inc | 10 ++++------
-files changed, 28 insertions(+), 14 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
-+++ b/tcg/tci/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
- #define TCG_TARGET_HAS_extract2_i64     0
--#define TCG_TARGET_HAS_div_i64          0
--#define TCG_TARGET_HAS_rem_i64          0
-+#define TCG_TARGET_HAS_div_i64          1
-+#define TCG_TARGET_HAS_rem_i64          1
- #define TCG_TARGET_HAS_ext8s_i64        1
- #define TCG_TARGET_HAS_ext16s_i64       1
- #define TCG_TARGET_HAS_ext32s_i64       1
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri64(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 * t2);
-             break;
--#if TCG_TARGET_HAS_div_i64
-         case INDEX_op_div_i64:
--        case INDEX_op_divu_i64:
--        case INDEX_op_rem_i64:
--        case INDEX_op_remu_i64:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
-+            break;
-+        case INDEX_op_divu_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
-+            break;
-+        case INDEX_op_rem_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
-+            break;
-+        case INDEX_op_remu_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
-             break;
--#endif
-         case INDEX_op_and_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-     case INDEX_op_sar_i64:
-     case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
-     case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
-+    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
-         tcg_out_ri64(s, const_args[2], args[2]);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-         tcg_debug_assert(args[4] <= UINT8_MAX);
-         tcg_out8(s, args[4]);
-         break;
--    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--        TODO();
--        break;
-     case INDEX_op_brcond_i64:
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
---
-.25.1

-[PULL 25/46] tcg/tci: Remove TODO as unused
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 --------
-file changed, 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@
- #include "tcg/tcg-op.h"
- #include "qemu/compiler.h"
--/* Marker for missing code. */
--#define TODO() \
--    do { \
--        fprintf(stderr, "TODO %s:%u: %s()\n", \
--                __FILE__, __LINE__, __func__); \
--        tcg_abort(); \
--    } while (0)
--
- #if MAX_OPC_PARAM_IARGS != 6
- # error Fix needed, number of supported input arguments changed!
- #endif
---
-.25.1

-[PULL 26/46] tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+Deleted patch
-As noted in several comments, 8 regs is not enough for 32-bit
-to perform calls, as currently implemented.  Shortly, we will
-rearrange the encoding which will make 32 regs impossible.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci/tcg-target.h     | 32 +++++---------------------------
- tcg/tci/tcg-target.c.inc | 26 --------------------------
-files changed, 5 insertions(+), 53 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
-+++ b/tcg/tci/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_mulu2_i32        1
- #endif /* TCG_TARGET_REG_BITS == 64 */
--/* Number of registers available.
--   For 32 bit hosts, we need more than 8 registers (call arguments). */
--/* #define TCG_TARGET_NB_REGS 8 */
-+/* Number of registers available. */
- #define TCG_TARGET_NB_REGS 16
--/* #define TCG_TARGET_NB_REGS 32 */
- /* List of registers which are used by TCG. */
- typedef enum {
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     TCG_REG_R5,
-     TCG_REG_R6,
-     TCG_REG_R7,
--#if TCG_TARGET_NB_REGS >= 16
-     TCG_REG_R8,
-     TCG_REG_R9,
-     TCG_REG_R10,
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     TCG_REG_R13,
-     TCG_REG_R14,
-     TCG_REG_R15,
--#if TCG_TARGET_NB_REGS >= 32
--    TCG_REG_R16,
--    TCG_REG_R17,
--    TCG_REG_R18,
--    TCG_REG_R19,
--    TCG_REG_R20,
--    TCG_REG_R21,
--    TCG_REG_R22,
--    TCG_REG_R23,
--    TCG_REG_R24,
--    TCG_REG_R25,
--    TCG_REG_R26,
--    TCG_REG_R27,
--    TCG_REG_R28,
--    TCG_REG_R29,
--    TCG_REG_R30,
--    TCG_REG_R31,
--#endif
--#endif
-+
-+    TCG_AREG0 = TCG_REG_R14,
-+    TCG_REG_CALL_STACK = TCG_REG_R15,
-+
-     /* Special value UINT8_MAX is used by TCI to encode constant values. */
-     TCG_CONST = UINT8_MAX
- } TCGReg;
--#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
--
- /* Used for function call generation. */
--#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
- #define TCG_TARGET_CALL_STACK_OFFSET    0
- #define TCG_TARGET_STACK_ALIGN          16
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
-     TCG_REG_R5,
-     TCG_REG_R6,
-     TCG_REG_R7,
--#if TCG_TARGET_NB_REGS >= 16
-     TCG_REG_R8,
-     TCG_REG_R9,
-     TCG_REG_R10,
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
-     TCG_REG_R13,
-     TCG_REG_R14,
-     TCG_REG_R15,
--#endif
- };
- #if MAX_OPC_PARAM_IARGS != 6
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
- #if TCG_TARGET_REG_BITS == 32
-     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
-     TCG_REG_R7,
--#if TCG_TARGET_NB_REGS >= 16
-     TCG_REG_R8,
-     TCG_REG_R9,
-     TCG_REG_R10,
-     TCG_REG_R11,
-     TCG_REG_R12,
--#else
--# error Too few input registers available
--#endif
- #endif
- };
-@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
-     "r05",
-     "r06",
-     "r07",
--#if TCG_TARGET_NB_REGS >= 16
-     "r08",
-     "r09",
-     "r10",
-@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
-     "r13",
-     "r14",
-     "r15",
--#if TCG_TARGET_NB_REGS >= 32
--    "r16",
--    "r17",
--    "r18",
--    "r19",
--    "r20",
--    "r21",
--    "r22",
--    "r23",
--    "r24",
--    "r25",
--    "r26",
--    "r27",
--    "r28",
--    "r29",
--    "r30",
--    "r31"
--#endif
--#endif
- };
- #endif
---
-.25.1

-[PULL 27/46] tcg/tci: Fix TCG_REG_R4 misusage
+Deleted patch
-This was removed from tcg_target_reg_alloc_order and
-tcg_target_call_iarg_regs on the assumption that it
-was the stack.  This was incorrectly copied from i386.
-For tci, the stack is R15.
-By adding R4 back to tcg_target_call_iarg_regs, adjust the other
-entries so that 6 (or 12) entries are still present in the array,
-and adjust the numbers in the interpreter.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c                | 8 ++++----
- tcg/tci/tcg-target.c.inc | 7 +------
-files changed, 5 insertions(+), 10 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                                           tci_read_reg(regs, TCG_REG_R1),
-                                           tci_read_reg(regs, TCG_REG_R2),
-                                           tci_read_reg(regs, TCG_REG_R3),
-+                                          tci_read_reg(regs, TCG_REG_R4),
-                                           tci_read_reg(regs, TCG_REG_R5),
-                                           tci_read_reg(regs, TCG_REG_R6),
-                                           tci_read_reg(regs, TCG_REG_R7),
-                                           tci_read_reg(regs, TCG_REG_R8),
-                                           tci_read_reg(regs, TCG_REG_R9),
-                                           tci_read_reg(regs, TCG_REG_R10),
--                                          tci_read_reg(regs, TCG_REG_R11),
--                                          tci_read_reg(regs, TCG_REG_R12));
-+                                          tci_read_reg(regs, TCG_REG_R11));
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
-             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
- #else
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                                           tci_read_reg(regs, TCG_REG_R1),
-                                           tci_read_reg(regs, TCG_REG_R2),
-                                           tci_read_reg(regs, TCG_REG_R3),
--                                          tci_read_reg(regs, TCG_REG_R5),
--                                          tci_read_reg(regs, TCG_REG_R6));
-+                                          tci_read_reg(regs, TCG_REG_R4),
-+                                          tci_read_reg(regs, TCG_REG_R5));
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
- #endif
-             break;
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
-     TCG_REG_R1,
-     TCG_REG_R2,
-     TCG_REG_R3,
--#if 0 /* used for TCG_REG_CALL_STACK */
-     TCG_REG_R4,
--#endif
-     TCG_REG_R5,
-     TCG_REG_R6,
-     TCG_REG_R7,
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
-     TCG_REG_R1,
-     TCG_REG_R2,
-     TCG_REG_R3,
--#if 0 /* used for TCG_REG_CALL_STACK */
-     TCG_REG_R4,
--#endif
-     TCG_REG_R5,
--    TCG_REG_R6,
- #if TCG_TARGET_REG_BITS == 32
-     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
-+    TCG_REG_R6,
-     TCG_REG_R7,
-     TCG_REG_R8,
-     TCG_REG_R9,
-     TCG_REG_R10,
-     TCG_REG_R11,
--    TCG_REG_R12,
- #endif
- };
---
-.25.1

-[PULL 45/46] accel: replace struct CpusAccel with AccelOpsClass
+[PULL 20/20] target/riscv: Make translator stop before the end of a page
-From: Claudio Fontana <cfontana@suse.de>
+Right now the translator stops right *after* the end of a page, which
 breaks reporting of fault locations when the last instruction of a
 multi-insn translation block crosses a page boundary.
-This will allow us to centralize the registration of
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
-the cpus.c module accelerator operations (in accel/accel-softmmu.c),
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-and trigger it automatically using object hierarchy lookup from the
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
-new accel_init_interfaces() initialization step, depending just on
+Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
 which accelerators are available in the code.
 Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
 kvm-accel-ops.c, etc, matching the object type names.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-18-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/accel-softmmu.h                         | 15 ++++++
+ target/riscv/translate.c          | 17 +++++--
- accel/kvm/kvm-cpus.h                          |  2 -
+ tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
- ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
+ tests/tcg/riscv64/Makefile.target |  1 +
- accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
+files changed, 93 insertions(+), 4 deletions(-)
- .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
+ create mode 100644 tests/tcg/riscv64/noexec.c
  accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
  include/qemu/accel.h                          |  2 +
  include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
  include/sysemu/cpus.h                         | 26 ++--------
  .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
  target/i386/hax/hax-windows.h                 |  2 +-
  .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
  .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
  accel/accel-common.c                          | 11 +++++
  accel/accel-softmmu.c                         | 44 +++++++++++++++--
  accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
  accel/kvm/kvm-all.c                           |  2 -
  accel/qtest/qtest.c                           | 23 ++++++---
  ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
  ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
  .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
  accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
  accel/tcg/tcg-all.c                           | 12 -----
  accel/xen/xen-all.c                           | 24 ++++++----
  bsd-user/main.c                               |  3 +-
  linux-user/main.c                             |  1 +
  softmmu/cpus.c                                | 12 ++---
  softmmu/vl.c                                  |  7 ++-
  .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
  target/i386/hax/hax-all.c                     |  5 +-
  target/i386/hax/hax-mem.c                     |  2 +-
  target/i386/hax/hax-posix.c                   |  2 +-
  target/i386/hax/hax-windows.c                 |  2 +-
  .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
  target/i386/hvf/hvf.c                         |  3 +-
  target/i386/hvf/x86hvf.c                      |  2 +-
  .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
  target/i386/whpx/whpx-all.c                   |  7 +--
  MAINTAINERS                                   |  3 +-
  accel/kvm/meson.build                         |  2 +-
  accel/tcg/meson.build                         |  8 ++--
  target/i386/hax/meson.build                   |  2 +-
  target/i386/hvf/meson.build                   |  2 +-
  target/i386/whpx/meson.build                  |  2 +-
 files changed, 361 insertions(+), 163 deletions(-)
  create mode 100644 accel/accel-softmmu.h
  rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
  create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
  rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
  rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
  create mode 100644 include/sysemu/accel-ops.h
  rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
  rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
  rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
  rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
  rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
  rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
  rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
  rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
  rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
  rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
  rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)
-diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      }
      ctx->nftemp = 0;
 +    /* Only the first insn within a TB is allowed to cross a page boundary. */
      if (ctx->base.is_jmp == DISAS_NEXT) {
 -        target_ulong page_start;
 -
 -        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
 -        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
 +        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
              ctx->base.is_jmp = DISAS_TOO_MANY;
 +        } else {
 +            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
 +
 +            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
 +                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
 +                int len = insn_len(next_insn);
 +
 +                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
 +                    ctx->base.is_jmp = DISAS_TOO_MANY;
 +                }
 +            }
          }
      }
  }
 diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/accel/accel-softmmu.h
++++ b/tests/tcg/riscv64/noexec.c
 @@ -XXX,XX +XXX,XX @@
-+/*
++#include "../multiarch/noexec.c.inc"
 + * QEMU System Emulation accel internal functions
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
-+#ifndef ACCEL_SOFTMMU_H
++static void *arch_mcontext_pc(const mcontext_t *ctx)
 +#define ACCEL_SOFTMMU_H
 +
 +void accel_init_ops_interfaces(AccelClass *ac);
 +
 +#endif /* ACCEL_SOFTMMU_H */
 diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-cpus.h
 +++ b/accel/kvm/kvm-cpus.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel kvm_cpus;
 -
  int kvm_init_vcpu(CPUState *cpu, Error **errp);
  int kvm_cpu_exec(CPUState *cpu);
  void kvm_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
 similarity index 88%
 rename from accel/tcg/tcg-cpus-icount.h
 rename to accel/tcg/tcg-accel-ops-icount.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.h
 +++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
  void icount_prepare_for_run(CPUState *cpu);
  void icount_process_data(CPUState *cpu);
 +void icount_handle_interrupt(CPUState *cpu, int mask);
 +
  #endif /* TCG_CPUS_ICOUNT_H */
 diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU TCG Multi Threaded vCPUs implementation
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef TCG_CPUS_MTTCG_H
 +#define TCG_CPUS_MTTCG_H
 +
 +/* kick MTTCG vCPU thread */
 +void mttcg_kick_vcpu_thread(CPUState *cpu);
 +
 +/* start an mttcg vCPU thread */
 +void mttcg_start_vcpu_thread(CPUState *cpu);
 +
 +#endif /* TCG_CPUS_MTTCG_H */
 diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
 similarity index 100%
 rename from accel/tcg/tcg-cpus-rr.h
 rename to accel/tcg/tcg-accel-ops-rr.h
 diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
 similarity index 72%
 rename from accel/tcg/tcg-cpus.h
 rename to accel/tcg/tcg-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.h
 +++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel tcg_cpus_mttcg;
 -extern const CpusAccel tcg_cpus_icount;
 -extern const CpusAccel tcg_cpus_rr;
 -
  void tcg_cpus_destroy(CPUState *cpu);
  int tcg_cpus_exec(CPUState *cpu);
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
 +void tcg_handle_interrupt(CPUState *cpu, int mask);
  #endif /* TCG_CPUS_H */
 diff --git a/include/qemu/accel.h b/include/qemu/accel.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/accel.h
 +++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
  AccelClass *accel_find(const char *opt_name);
  AccelState *current_accel(void);
 +void accel_init_interfaces(AccelClass *ac);
 +
  #ifndef CONFIG_USER_ONLY
  int accel_init_machine(AccelState *accel, MachineState *ms);
 diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Accelerator OPS, used for cpus.c module
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_OPS_H
 +#define ACCEL_OPS_H
 +
 +#include "qom/object.h"
 +
 +#define ACCEL_OPS_SUFFIX "-ops"
 +#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
 +#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
 +
 +typedef struct AccelOpsClass AccelOpsClass;
 +DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
 +
 +/* cpus.c operations interface */
 +struct AccelOpsClass {
 +    /*< private >*/
 +    ObjectClass parent_class;
 +    /*< public >*/
 +
 +    /* initialization function called when accel is chosen */
 +    void (*ops_init)(AccelOpsClass *ops);
 +
 +    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
 +    void (*kick_vcpu_thread)(CPUState *cpu);
 +
 +    void (*synchronize_post_reset)(CPUState *cpu);
 +    void (*synchronize_post_init)(CPUState *cpu);
 +    void (*synchronize_state)(CPUState *cpu);
 +    void (*synchronize_pre_loadvm)(CPUState *cpu);
 +
 +    void (*handle_interrupt)(CPUState *cpu, int mask);
 +
 +    int64_t (*get_virtual_clock)(void);
 +    int64_t (*get_elapsed_ticks)(void);
 +};
 +
 +#endif /* ACCEL_OPS_H */
 diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/cpus.h
 +++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_CPUS_H
  #include "qemu/timer.h"
 +#include "sysemu/accel-ops.h"
 -/* cpus.c */
 +/* register accel-specific operations */
 +void cpus_register_accel(const AccelOpsClass *i);
 -/* CPU execution threads */
 +/* accel/dummy-cpus.c */
 -typedef struct CpusAccel {
 -    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
 -    void (*kick_vcpu_thread)(CPUState *cpu);
 -
 -    void (*synchronize_post_reset)(CPUState *cpu);
 -    void (*synchronize_post_init)(CPUState *cpu);
 -    void (*synchronize_state)(CPUState *cpu);
 -    void (*synchronize_pre_loadvm)(CPUState *cpu);
 -
 -    void (*handle_interrupt)(CPUState *cpu, int mask);
 -
 -    int64_t (*get_virtual_clock)(void);
 -    int64_t (*get_elapsed_ticks)(void);
 -} CpusAccel;
 -
 -/* register accel-specific cpus interface implementation */
 -void cpus_register_accel(const CpusAccel *i);
 -
 -/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
 +/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
  void dummy_start_vcpu_thread(CPUState *);
  /* interface available for cpus accelerator threads */
 diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
 similarity index 95%
 rename from target/i386/hax/hax-cpus.h
 rename to target/i386/hax/hax-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.h
 +++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hax_cpus;
 -
  #include "hax-interface.h"
  #include "hax-i386.h"
 diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.h
 +++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
  #include <winioctl.h>
  #include <windef.h>
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
 similarity index 94%
 rename from target/i386/hvf/hvf-cpus.h
 rename to target/i386/hvf/hvf-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.h
 +++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hvf_cpus;
 -
  int hvf_init_vcpu(CPUState *);
  int hvf_vcpu_exec(CPUState *);
  void hvf_cpu_synchronize_state(CPUState *);
 diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
 similarity index 96%
 rename from target/i386/whpx/whpx-cpus.h
 rename to target/i386/whpx/whpx-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.h
 +++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel whpx_cpus;
 -
  int whpx_init_vcpu(CPUState *cpu);
  int whpx_vcpu_exec(CPUState *cpu);
  void whpx_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-common.c
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
 +#ifndef CONFIG_USER_ONLY
 +#include "accel-softmmu.h"
 +#endif /* !CONFIG_USER_ONLY */
 +
  static const TypeInfo accel_type = {
      .name = TYPE_ACCEL,
      .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
      return ac;
  }
 +void accel_init_interfaces(AccelClass *ac)
 +{
-+#ifndef CONFIG_USER_ONLY
++    return (void *)ctx->__gregs[REG_PC];
 +    accel_init_ops_interfaces(ac);
 +#endif /* !CONFIG_USER_ONLY */
 +}
 +
- static void register_accel_types(void)
++static int arch_mcontext_arg(const mcontext_t *ctx)
  {
      type_register_static(&accel_type);
 diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-softmmu.c
 +++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
  #include "hw/boards.h"
 -#include "sysemu/arch_init.h"
 -#include "sysemu/sysemu.h"
 -#include "qom/object.h"
 +#include "sysemu/cpus.h"
 +
 +#include "accel-softmmu.h"
  int accel_init_machine(AccelState *accel, MachineState *ms)
  {
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
          acc->setup_post(ms, accel);
      }
  }
 +
 +/* initialize the arch-independent accel operation interfaces */
 +void accel_init_ops_interfaces(AccelClass *ac)
 +{
-+    const char *ac_name;
++    return ctx->__gregs[REG_A0];
 +    char *ops_name;
 +    AccelOpsClass *ops;
 +
 +    ac_name = object_class_get_name(OBJECT_CLASS(ac));
 +    g_assert(ac_name != NULL);
 +
 +    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
 +    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
 +    g_free(ops_name);
 +
 +    /*
 +     * all accelerators need to define ops, providing at least a mandatory
 +     * non-NULL create_vcpu_thread operation.
 +     */
 +    g_assert(ops != NULL);
 +    if (ops->ops_init) {
 +        ops->ops_init(ops);
 +    }
 +    cpus_register_accel(ops);
 +}
 +
-+static const TypeInfo accel_ops_type_info = {
++static void arch_flush(void *p, int len)
 +    .name = TYPE_ACCEL_OPS,
 +    .parent = TYPE_OBJECT,
 +    .abstract = true,
 +    .class_size = sizeof(AccelOpsClass),
 +};
 +
 +static void accel_softmmu_register_types(void)
 +{
-+    type_register_static(&accel_ops_type_info);
++    __builtin___clear_cache(p, p + len);
 +}
 +type_init(accel_softmmu_register_types);
 diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
 similarity index 72%
 rename from accel/kvm/kvm-cpus.c
 rename to accel/kvm/kvm-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-cpus.c
 +++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 -const CpusAccel kvm_cpus = {
 -    .create_vcpu_thread = kvm_start_vcpu_thread,
 +static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
 -    .synchronize_post_init = kvm_cpu_synchronize_post_init,
 -    .synchronize_state = kvm_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = kvm_start_vcpu_thread;
 +    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
 +    ops->synchronize_state = kvm_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
 +}
 +
-+static const TypeInfo kvm_accel_ops_type = {
++extern char noexec_1[];
-+    .name = ACCEL_OPS_NAME("kvm"),
++extern char noexec_2[];
 +extern char noexec_end[];
 +
-+    .parent = TYPE_ACCEL_OPS,
++asm(".option push\n"
-+    .class_init = kvm_accel_ops_class_init,
++    ".option norvc\n"
-+    .abstract = true,
++    "noexec_1:\n"
- };
++    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
 +    "noexec_2:\n"
 +    "   li a0,2\n"      /* a0 is 0/1; set 2. */
 +    "   ret\n"
 +    "noexec_end:\n"
 +    ".option pop");
 +
-+static void kvm_accel_ops_register_types(void)
++int main(void)
 +{
-+    type_register_static(&kvm_accel_ops_type);
++    struct noexec_test noexec_tests[] = {
 +        {
 +            .name = "fallthrough",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = noexec_1 - noexec_2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2,
 +            .entry_ofs = 0,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = 0,
 +            .expected_arg = 0,
 +        },
 +        {
 +            .name = "fallthrough [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = noexec_1 - noexec_2 - 2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 1,
 +        },
 +        {
 +            .name = "jump [cross]",
 +            .test_code = noexec_1,
 +            .test_len = noexec_end - noexec_1,
 +            .page_ofs = noexec_1 - noexec_2 - 2,
 +            .entry_ofs = -2,
 +            .expected_si_ofs = 0,
 +            .expected_pc_ofs = -2,
 +            .expected_arg = 0,
 +        },
 +    };
 +
 +    return test_noexec(noexec_tests,
 +                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
 +}
-+type_init(kvm_accel_ops_register_types);
+diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/kvm/kvm-all.c
+--- a/tests/tcg/riscv64/Makefile.target
-+++ b/accel/kvm/kvm-all.c
++++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
          ret = ram_block_discard_disable(true);
          assert(!ret);
      }
 -
 -    cpus_register_accel(&kvm_cpus);
      return 0;
  err:
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/main-loop.h"
- #include "hw/core/cpu.h"
+ VPATH += $(SRC_PATH)/tests/tcg/riscv64
+ TESTS += test-div
--const CpusAccel qtest_cpus = {
++TESTS += noexec
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -    .get_virtual_clock = qtest_get_virtual_clock,
 -};
 -
  static int qtest_init_accel(MachineState *ms)
  {
 -    cpus_register_accel(&qtest_cpus);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
      .class_init = qtest_accel_class_init,
  };
 +static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +    ops->get_virtual_clock = qtest_get_virtual_clock;
 +};
 +
 +static const TypeInfo qtest_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("qtest"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = qtest_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void qtest_type_init(void)
  {
      type_register_static(&qtest_accel_type);
 +    type_register_static(&qtest_accel_ops_type);
  }
  type_init(qtest_type_init);
 diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
 similarity index 89%
 rename from accel/tcg/tcg-cpus-icount.c
 rename to accel/tcg/tcg-accel-ops-icount.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.c
 +++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-icount.h"
 -#include "tcg-cpus-rr.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-icount.h"
 +#include "tcg-accel-ops-rr.h"
  static int64_t icount_get_limit(void)
  {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
      /*
       * These should always be cleared by icount_process_data after
       * each vCPU execution. However u16.high can be raised
 -     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
 +     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
       */
      g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
      g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
      replay_mutex_unlock();
  }
 -static void icount_handle_interrupt(CPUState *cpu, int mask)
 +void icount_handle_interrupt(CPUState *cpu, int mask)
  {
      int old_mask = cpu->interrupt_request;
 -    tcg_cpus_handle_interrupt(cpu, mask);
 +    tcg_handle_interrupt(cpu, mask);
      if (qemu_cpu_is_self(cpu) &&
          !cpu->can_do_io
          && (mask & ~old_mask) != 0) {
          cpu_abort(cpu, "Raised interrupt while not in I/O function");
      }
  }
 -
 -const CpusAccel tcg_cpus_icount = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = icount_handle_interrupt,
 -    .get_virtual_clock = icount_get,
 -    .get_elapsed_ticks = icount_get,
 -};
 diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
 similarity index 92%
 rename from accel/tcg/tcg-cpus-mttcg.c
 rename to accel/tcg/tcg-accel-ops-mttcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-mttcg.c
 +++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
  /*
   * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
      return NULL;
  }
 -static void mttcg_kick_vcpu_thread(CPUState *cpu)
 +void mttcg_kick_vcpu_thread(CPUState *cpu)
  {
      cpu_exit(cpu);
  }
 -static void mttcg_start_vcpu_thread(CPUState *cpu)
 +void mttcg_start_vcpu_thread(CPUState *cpu)
  {
      char thread_name[VCPU_THREAD_NAME_SIZE];
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
      cpu->hThread = qemu_thread_get_handle(cpu->thread);
  #endif
  }
 -
 -const CpusAccel tcg_cpus_mttcg = {
 -    .create_vcpu_thread = mttcg_start_vcpu_thread,
 -    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
 similarity index 97%
 rename from accel/tcg/tcg-cpus-rr.c
 rename to accel/tcg/tcg-accel-ops-rr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-rr.c
 +++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-rr.h"
 -#include "tcg-cpus-icount.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* Kick all RR vCPUs */
  void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
          cpu->created = true;
      }
  }
 -
 -const CpusAccel tcg_cpus_rr = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
 similarity index 63%
 rename from accel/tcg/tcg-cpus.c
 rename to accel/tcg/tcg-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.c
 +++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* common functionality among all TCG variants */
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
  }
  /* mask must never be zero, except for A20 change call */
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
 +void tcg_handle_interrupt(CPUState *cpu, int mask)
  {
      g_assert(qemu_mutex_iothread_locked());
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
          qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
      }
  }
 +
 +static void tcg_accel_ops_init(AccelOpsClass *ops)
 +{
 +    if (qemu_tcg_mttcg_enabled()) {
 +        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
 +        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    } else if (icount_enabled()) {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = icount_handle_interrupt;
 +        ops->get_virtual_clock = icount_get;
 +        ops->get_elapsed_ticks = icount_get;
 +    } else {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    }
 +}
 +
 +static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->ops_init = tcg_accel_ops_init;
 +}
 +
 +static const TypeInfo tcg_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("tcg"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = tcg_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
 +static void tcg_accel_ops_register_types(void)
 +{
 +    type_register_static(&tcg_accel_ops_type);
 +}
 +type_init(tcg_accel_ops_register_types);
 diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-all.c
 +++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "qapi/qapi-builtin-visit.h"
 -#ifndef CONFIG_USER_ONLY
 -#include "tcg-cpus.h"
 -#endif /* CONFIG_USER_ONLY */
 -
  struct TCGState {
      AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
       */
  #ifndef CONFIG_USER_ONLY
      tcg_region_init();
 -
 -    if (mttcg_enabled) {
 -        cpus_register_accel(&tcg_cpus_mttcg);
 -    } else if (icount_enabled()) {
 -        cpus_register_accel(&tcg_cpus_icount);
 -    } else {
 -        cpus_register_accel(&tcg_cpus_rr);
 -    }
  #endif /* !CONFIG_USER_ONLY */
      return 0;
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
      }
  }
 -const CpusAccel xen_cpus = {
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -};
 -
  static int xen_init(MachineState *ms)
  {
      MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
       * opt out of system RAM being allocated by generic code
       */
      mc->default_ram_id = NULL;
 -
 -    cpus_register_accel(&xen_cpus);
 -
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
      .class_init = xen_accel_class_init,
  };
 +static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +}
 +
 +static const TypeInfo xen_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("xen"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = xen_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void xen_type_init(void)
  {
      type_register_static(&xen_accel_type);
 +    type_register_static(&xen_accel_ops_type);
  }
 -
  type_init(xen_type_init);
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
  #endif
      }
 +    cpu_type = parse_cpu_option(cpu_model);
      /* init tcg before creating CPUs and to get qemu_host_page_size */
      {
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
 -    cpu_type = parse_cpu_option(cpu_model);
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
  #if defined(TARGET_SPARC) || defined(TARGET_PPC)
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
  /*
   * The chosen accelerator is supposed to register this.
   */
 -static const CpusAccel *cpus_accel;
 +static const AccelOpsClass *cpus_accel;
  void cpu_synchronize_all_states(void)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
      qemu_mutex_lock_iothread();
  }
 -void cpus_register_accel(const CpusAccel *ca)
 +void cpus_register_accel(const AccelOpsClass *ops)
  {
 -    assert(ca != NULL);
 -    assert(ca->create_vcpu_thread != NULL); /* mandatory */
 -    cpus_accel = ca;
 +    assert(ops != NULL);
 +    assert(ops->create_vcpu_thread != NULL); /* mandatory */
 +    cpus_accel = ops;
  }
  void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
          cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
      }
 -    /* accelerators all implement the CpusAccel interface */
 +    /* accelerators all implement the AccelOpsClass */
      g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
      cpus_accel->create_vcpu_thread(cpu);
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
          return false;
      }
 -    /* Allocation of large amounts of memory may delay
 +    /*
 +     * Allocation of large amounts of memory may delay
       * chardev initialization for too long, and trigger timeouts
       * on software that waits for a monitor socket to be created
       * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
       *
       * Machine compat properties: object_set_machine_compat_props().
       * Accelerator compat props: object_set_accelerator_compat_props(),
 -     * called from configure_accelerator().
 +     * called from do_configure_accelerator().
       */
      machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      if (cpu_option) {
          current_machine->cpu_type = parse_cpu_option(cpu_option);
      }
 +    /* NB: for machine none cpu_type could STILL be NULL here! */
 +    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
      qemu_resolve_machine_memdev();
      parse_numa_opts(current_machine);
 diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
 similarity index 69%
 rename from target/i386/hax/hax-cpus.c
 rename to target/i386/hax/hax-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.c
 +++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
  #include "qemu/guest-random.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  static void *hax_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
  #endif
  }
 -const CpusAccel hax_cpus = {
 -    .create_vcpu_thread = hax_start_vcpu_thread,
 -    .kick_vcpu_thread = hax_kick_vcpu_thread,
 +static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hax_cpu_synchronize_post_init,
 -    .synchronize_state = hax_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hax_start_vcpu_thread;
 +    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
 +    ops->synchronize_state = hax_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo hax_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hax"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hax_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void hax_accel_ops_register_types(void)
 +{
 +    type_register_static(&hax_accel_ops_type);
 +}
 +type_init(hax_accel_ops_register_types);
 diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-all.c
 +++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/boards.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define DEBUG_HAX 0
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                  !ret ? "working" : "not working",
                  !ret ? "fast virt" : "emulation");
      }
 -    if (ret == 0) {
 -        cpus_register_accel(&hax_cpus);
 -    }
      return ret;
  }
 diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-mem.c
 +++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/error-report.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #include "qemu/queue.h"
  #define DEBUG_HAX_MEM 0
 diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-posix.c
 +++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
  #include <sys/ioctl.h>
  #include "sysemu/cpus.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  hax_fd hax_mod_open(void)
  {
 diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.c
 +++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  /*
   * return 0 when success, -1 when driver not loaded,
 diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
 similarity index 84%
 rename from target/i386/hvf/hvf-cpus.c
 rename to target/i386/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.c
 +++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "target/i386/cpu.h"
  #include "qemu/guest-random.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  /*
   * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 -const CpusAccel hvf_cpus = {
 -    .create_vcpu_thread = hvf_start_vcpu_thread,
 +static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hvf_cpu_synchronize_post_init,
 -    .synchronize_state = hvf_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hvf_start_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
 +    ops->synchronize_state = hvf_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
  };
 +static const TypeInfo hvf_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hvf"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hvf_accel_ops_class_init,
 +    .abstract = true,
 +};
 +static void hvf_accel_ops_register_types(void)
 +{
 +    type_register_static(&hvf_accel_ops_type);
 +}
 +type_init(hvf_accel_ops_register_types);
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "target/i386/cpu.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  HVFState *hvf_state;
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
      hvf_state = s;
      memory_listener_register(&hvf_memory_listener, &address_space_memory);
 -    cpus_register_accel(&hvf_cpus);
      return 0;
  }
 diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/x86hvf.c
 +++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
  #include <Hypervisor/hv.h>
  #include <Hypervisor/hv_vmx.h>
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                       SegmentCache *qseg, bool is_tr)
 diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
 similarity index 71%
 rename from target/i386/whpx/whpx-cpus.c
 rename to target/i386/whpx/whpx-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.c
 +++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/whpx.h"
  #include "whpx-internal.h"
 -#include "whpx-cpus.h"
 +#include "whpx-accel-ops.h"
  static void *whpx_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
      }
  }
 -const CpusAccel whpx_cpus = {
 -    .create_vcpu_thread = whpx_start_vcpu_thread,
 -    .kick_vcpu_thread = whpx_kick_vcpu_thread,
 +static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
 -    .synchronize_post_init = whpx_cpu_synchronize_post_init,
 -    .synchronize_state = whpx_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = whpx_start_vcpu_thread;
 +    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
 +    ops->synchronize_state = whpx_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo whpx_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("whpx"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = whpx_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void whpx_accel_ops_register_types(void)
 +{
 +    type_register_static(&whpx_accel_ops_type);
 +}
 +type_init(whpx_accel_ops_register_types);
 diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-all.c
 +++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/blocker.h"
  #include <winerror.h>
 -#include "whpx-cpus.h"
  #include "whpx-internal.h"
 +#include "whpx-accel-ops.h"
 +
 +#include <WinHvPlatform.h>
 +#include <WinHvEmulation.h>
  #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
      whpx_memory_init();
 -    cpus_register_accel(&whpx_cpus);
 -
      printf("Windows Hypervisor Platform accelerator is operational\n");
      return 0;
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
  R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
 -F: accel/accel.c
 +F: include/sysemu/accel-ops.h
 +F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/meson.build
 +++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
  kvm_ss = ss.source_set()
  kvm_ss.add(files(
    'kvm-all.c',
 -  'kvm-cpus.c',
 +  'kvm-accel-ops.c',
  ))
  kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
    'cputlb.c',
 -  'tcg-cpus.c',
 -  'tcg-cpus-mttcg.c',
 -  'tcg-cpus-icount.c',
 -  'tcg-cpus-rr.c'
 +  'tcg-accel-ops.c',
 +  'tcg-accel-ops-mttcg.c',
 +  'tcg-accel-ops-icount.c',
 +  'tcg-accel-ops-rr.c'
  ))
 diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/meson.build
 +++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
    'hax-all.c',
    'hax-mem.c',
 -  'hax-cpus.c',
 +  'hax-accel-ops.c',
  ))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
 diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/meson.build
 +++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
    'hvf.c',
 -  'hvf-cpus.c',
 +  'hvf-accel-ops.c',
    'x86.c',
    'x86_cpuid.c',
    'x86_decode.c',
 diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/meson.build
 +++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
    'whpx-all.c',
    'whpx-apic.c',
 -  'whpx-cpus.c',
 +  'whpx-accel-ops.c',
  ))
 --
-.25.1
+.34.1

The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205

for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:

accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)

----------------------------------------------------------------
TCGCPUOps cleanups (claudio)
tcg/s390 compare fix (phil)
tcg/aarch64 rotli_vec fix
tcg/tci cleanups and fixes

----------------------------------------------------------------
Claudio Fontana (13):
      target/riscv: remove CONFIG_TCG, as it is always TCG
      accel/tcg: split TCG-only code from cpu_exec_realizefn
      target/arm: do not use cc->do_interrupt for KVM directly
      cpu: move cc->do_interrupt to tcg_ops
      cpu: move cc->transaction_failed to tcg_ops
      cpu: move do_unaligned_access to tcg_ops
      physmem: make watchpoint checking code TCG-only
      cpu: move adjust_watchpoint_address to tcg_ops
      cpu: move debug_check_watchpoint to tcg_ops
      cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
      accel: extend AccelState and AccelClass to user-mode
      accel: replace struct CpusAccel with AccelOpsClass
      accel: introduce AccelCPUClass extending CPUClass

Eduardo Habkost (5):
      cpu: Introduce TCGCpuOperations struct
      cpu: Move synchronize_from_tb() to tcg_ops
      cpu: Move cpu_exec_* to tcg_ops
      cpu: Move tlb_fill to tcg_ops
      cpu: Move debug_excp_handler to tcg_ops

Philippe Mathieu-Daudé (2):
      tcg/s390: Fix compare instruction from extended-immediate facility
      exec/cpu-defs: Remove TCG backends dependency

Richard Henderson (24):
      tcg/aarch64: Do not convert TCGArg to temps that are not temps
      configure: Fix --enable-tcg-interpreter
      tcg/tci: Make tci_tb_ptr thread-local
      tcg/tci: Inline tci_write_reg32s into the only caller
      tcg/tci: Inline tci_write_reg8 into its callers
      tcg/tci: Inline tci_write_reg16 into the only caller
      tcg/tci: Inline tci_write_reg32 into all callers
      tcg/tci: Inline tci_write_reg64 into 64-bit callers
      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
      tcg/tci: Merge INDEX_op_st8_{i32,i64}
      tcg/tci: Merge INDEX_op_st16_{i32,i64}
      tcg/tci: Move stack bounds check to compile-time
      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
      tcg/tci: Use g_assert_not_reached
      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
      tcg/tci: Implement 64-bit division
      tcg/tci: Remove TODO as unused
      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
      tcg/tci: Fix TCG_REG_R4 misusage
      tcg/tci: Remove TCG_CONST

Stefan Weil (2):
      tcg/tci: Implement INDEX_op_ld16s_i32
      tcg/tci: Implement INDEX_op_ld8s_i64

configure                                          |   5 +-
 accel/accel-softmmu.h                              |  15 +
 accel/kvm/kvm-cpus.h                               |   2 -
 .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
 accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
 accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
 include/exec/cpu-all.h                             |  11 +-
 include/exec/cpu-defs.h                            |   3 -
 include/exec/exec-all.h                            |   2 +-
 include/hw/boards.h                                |   2 +-
 include/hw/core/accel-cpu.h                        |  38 ++
 include/hw/core/cpu.h                              |  86 +---
 include/hw/core/tcg-cpu-ops.h                      |  97 +++++
 include/{sysemu => qemu}/accel.h                   |  16 +-
 include/sysemu/accel-ops.h                         |  45 ++
 include/sysemu/cpus.h                              |  26 +-
 include/sysemu/hvf.h                               |   2 +-
 include/sysemu/kvm.h                               |   2 +-
 include/sysemu/kvm_int.h                           |   2 +-
 target/arm/internals.h                             |   6 +
 target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
 target/i386/hax/hax-windows.h                      |   2 +-
 target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
 target/i386/hvf/hvf-i386.h                         |   2 +-
 target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
 tcg/tci/tcg-target-con-set.h                       |   6 +-
 tcg/tci/tcg-target.h                               |  37 +-
 accel/accel-common.c                               | 105 +++++
 accel/{accel.c => accel-softmmu.c}                 |  61 ++-
 accel/accel-user.c                                 |  24 ++
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
 accel/kvm/kvm-all.c                                |   2 -
 accel/qtest/qtest.c                                |  25 +-
 accel/tcg/cpu-exec.c                               |  53 ++-
 accel/tcg/cputlb.c                                 |  34 +-
 .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
 .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
 accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
 accel/tcg/tcg-all.c                                |  19 +-
 accel/tcg/user-exec.c                              |   8 +-
 accel/xen/xen-all.c                                |  26 +-
 bsd-user/main.c                                    |  11 +-
 cpu.c                                              |  66 +--
 hw/core/cpu.c                                      |  21 +-
 hw/mips/jazz.c                                     |  12 +-
 linux-user/main.c                                  |   7 +-
 softmmu/cpus.c                                     |  12 +-
 softmmu/memory.c                                   |   2 +-
 softmmu/physmem.c                                  | 149 ++++---
 softmmu/qtest.c                                    |   2 +-
 softmmu/vl.c                                       |   9 +-
 target/alpha/cpu.c                                 |  21 +-
 target/arm/cpu.c                                   |  45 +-
 target/arm/cpu64.c                                 |   4 +-
 target/arm/cpu_tcg.c                               |  32 +-
 target/arm/helper.c                                |   4 +
 target/arm/kvm64.c                                 |   6 +-
 target/avr/cpu.c                                   |  19 +-
 target/avr/helper.c                                |   5 +-
 target/cris/cpu.c                                  |  43 +-
 target/cris/helper.c                               |   5 +-
 target/hppa/cpu.c                                  |  24 +-
 target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
 target/i386/hax/hax-all.c                          |   7 +-
 target/i386/hax/hax-mem.c                          |   2 +-
 target/i386/hax/hax-posix.c                        |   2 +-
 target/i386/hax/hax-windows.c                      |   2 +-
 target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
 target/i386/hvf/hvf.c                              |   5 +-
 target/i386/hvf/x86_task.c                         |   2 +-
 target/i386/hvf/x86hvf.c                           |   2 +-
 target/i386/tcg/tcg-cpu.c                          |  26 +-
 target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
 target/i386/whpx/whpx-all.c                        |   9 +-
 target/lm32/cpu.c                                  |  19 +-
 target/m68k/cpu.c                                  |  19 +-
 target/microblaze/cpu.c                            |  25 +-
 target/mips/cpu.c                                  |  35 +-
 target/moxie/cpu.c                                 |  15 +-
 target/nios2/cpu.c                                 |  18 +-
 target/openrisc/cpu.c                              |  17 +-
 target/riscv/cpu.c                                 |  26 +-
 target/riscv/cpu_helper.c                          |   2 +-
 target/rx/cpu.c                                    |  20 +-
 target/s390x/cpu.c                                 |  33 +-
 target/s390x/excp_helper.c                         |   2 +-
 target/sh4/cpu.c                                   |  21 +-
 target/sparc/cpu.c                                 |  25 +-
 target/tilegx/cpu.c                                |  17 +-
 target/tricore/cpu.c                               |  12 +-
 target/unicore32/cpu.c                             |  17 +-
 target/xtensa/cpu.c                                |  23 +-
 target/xtensa/helper.c                             |   4 +-
 tcg/tcg-common.c                                   |   4 -
 tcg/tci.c                                          | 479 ++++++++-------------
 target/ppc/translate_init.c.inc                    |  39 +-
 tcg/aarch64/tcg-target.c.inc                       |   7 +-
 tcg/s390/tcg-target.c.inc                          |   2 +-
 tcg/tci/tcg-target.c.inc                           | 149 ++-----
 MAINTAINERS                                        |   7 +-
 accel/kvm/meson.build                              |   2 +-
 accel/meson.build                                  |   4 +-
 accel/tcg/meson.build                              |  10 +-
 target/i386/hax/meson.build                        |   2 +-
 target/i386/hvf/meson.build                        |   2 +-
 target/i386/whpx/meson.build                       |   2 +-
 108 files changed, 1565 insertions(+), 1065 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/hw/core/accel-cpu.h
 create mode 100644 include/hw/core/tcg-cpu-ops.h
 rename include/{sysemu => qemu}/accel.h (94%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (64%)
 create mode 100644 accel/accel-user.c
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The code is currently comparing c2 to the type promotion of
uint32_t and int32_t. That is, the conversion rules are as:

(common_type) c2 == (common_type) (uint32_t)
                        (is_unsigned
                        ? (uint32_t)c2
                        : (uint32_t)(int32_t)c2)

In the signed case we lose the desired sign extensions because
of the argument promotion rules of the ternary operator.

Solve the problem by doing the round-trip parsing through the
intermediate type and back to the desired common type (all at
one expression).

Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

"exec/cpu-defs.h" contains generic CPU definitions for the
TCG frontends (mostly related to TLB). TCG backends definitions
aren't relevant here.

See tcg/README description:

4) Backend

tcg-target.h contains the target specific definitions. tcg-target.c.inc
  contains the target specific code; it is #included by tcg/tcg.c, rather
  than being a standalone C file.

So far only "tcg/tcg.h" requires these headers.

Remove the "target-tcg.h" header dependency on TCG frontends, so we
don't have to rebuild all frontends when hacking a single backend.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/host-utils.h"
 #include "qemu/thread.h"
-#ifdef CONFIG_TCG
-#include "tcg-target.h"
-#endif
 #ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
 #endif
-- 
2.25.1

Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
argument is an integer, not a temporary, which now tickles
an assert added in e89b28a6350.

Previously, the value computed into v2 would be garbage for
rotli_vec, but as the value was unused it caused no harm.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     v0 = temp_tcgv_vec(arg_temp(a0));
     v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
     a2 = va_arg(va, TCGArg);
-    v2 = temp_tcgv_vec(arg_temp(a2));
+    va_end(va);
 
     switch (opc) {
     case INDEX_op_rotli_vec:
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     case INDEX_op_shrv_vec:
     case INDEX_op_sarv_vec:
         /* Right shifts are negative left shifts for AArch64.  */
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         tcg_gen_neg_vec(vece, t1, v2);
         opc = (opc == INDEX_op_shrv_vec
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotlv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
         tcg_gen_sub_vec(vece, t1, v2, c1);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotrv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         t2 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     default:
         g_assert_not_reached();
     }
-
-    va_end(va);
 }
 
 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
-- 
2.25.1

The configure option was backward, and we failed to
pass the value on to meson.

Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
Tested-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-whpx) whpx="enabled"
   ;;
-  --disable-tcg-interpreter) tcg_interpreter="true"
+  --disable-tcg-interpreter) tcg_interpreter="false"
   ;;
-  --enable-tcg-interpreter) tcg_interpreter="false"
+  --enable-tcg-interpreter) tcg_interpreter="true"
   ;;
   --disable-cap-ng)  cap_ng="disabled"
   ;;
@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
         -Dvhost_user_blk_server=$vhost_user_blk_server \
         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
+	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
         "$PWD" "$source_path"
 
-- 
2.25.1

Each thread must have its own pc, even under TCI.

Remove the GETPC ifdef, because GETPC is always available for
helpers, and thus is always required.  Move the assignment
under INDEX_op_call, because the value is only visible when
we make a call to a helper function.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 2 +-
 tcg/tcg-common.c        | 4 ----
 tcg/tci.c               | 7 +++----
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
 #if defined(CONFIG_TCG_INTERPRETER)
-extern uintptr_t tci_tb_ptr;
+extern __thread uintptr_t tci_tb_ptr;
 # define GETPC() tci_tb_ptr
 #else
 # define GETPC() \
diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-common.c
+++ b/tcg/tcg-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "tcg/tcg.h"
 
-#if defined(CONFIG_TCG_INTERPRETER)
-uintptr_t tci_tb_ptr;
-#endif
-
 TCGOpDef tcg_op_defs[] = {
 #define DEF(s, oargs, iargs, cargs, flags) \
          { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
                                     tcg_target_ulong, tcg_target_ulong);
 #endif
 
+__thread uintptr_t tci_tb_ptr;
+
 static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
 {
     tci_assert(index < TCG_TARGET_NB_REGS);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         TCGMemOpIdx oi;
 
-#if defined(GETPC)
-        tci_tb_ptr = (uintptr_t)tb_ptr;
-#endif
-
         /* Skip opcode and size entry. */
         tb_ptr += 2;
 
         switch (opc) {
         case INDEX_op_call:
             t0 = tci_read_ri(regs, &tb_ptr);
+            tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
                                           tci_read_reg(regs, TCG_REG_R1),
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             TODO();
             break;
         case INDEX_op_ld16s_i32:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
             t0 = *tb_ptr++;
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
             break;
         case INDEX_op_ld8s_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

For a 64-bit TCI, the upper bits of a 32-bit operation are
undefined (much like a native ppc64 32-bit operation).  It
simplifies everything if we don't force-extend the result.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
     regs[index] = value;
 }
 
-static void
-tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
-{
-    tci_write_reg(regs, index, value);
-}
-
 #if TCG_TARGET_REG_BITS == 32
 static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                             uint32_t low_index, uint64_t value)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp64 = tci_read_r64(regs, &tb_ptr);
             v64 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
 #elif TCG_TARGET_REG_BITS == 64
         case INDEX_op_setcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_i32(&tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i32:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 / t2);
+            tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 % t2);
+            tci_write_reg(regs, t0, t1 % t2);
             break;
 #elif TCG_TARGET_HAS_div2_i32
         case INDEX_op_div2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 << (t2 & 31));
+            tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
+            tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
+            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
+            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
+            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp32 = (((1 << tmp8) - 1) << tmp16);
-            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
+            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
             break;
 #endif
         case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i32
         case INDEX_op_ext16s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8u_i32
         case INDEX_op_ext8u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i32
         case INDEX_op_ext16u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_bswap16_i32
         case INDEX_op_bswap16_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i32
         case INDEX_op_bswap32_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i32
         case INDEX_op_not_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i32
         case INDEX_op_neg_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

Note that we had two functions of the same name: a 32-bit version
which took two register numbers and a 64-bit version which was a
no-op wrapper for tcg_write_reg.  After this, we are left with
only the 32-bit version.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
 1 file changed, 27 insertions(+), 33 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
     tci_write_reg(regs, low_index, value);
     tci_write_reg(regs, high_index, value >> 32);
 }
-#elif TCG_TARGET_REG_BITS == 64
-static void
-tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
-{
-    tci_write_reg(regs, index, value);
-}
 #endif
 
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
 #endif
         case INDEX_op_mov_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_i64(&tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i64:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 << (t2 & 63));
+            tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
-            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
             break;
 #endif
         case INDEX_op_brcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8s_i64
         case INDEX_op_ext8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i64
         case INDEX_op_ext16s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i64
         case INDEX_op_ext16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext32s_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_ext32u_i64
         case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_extu_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_bswap16_i64
         case INDEX_op_bswap16_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i64
         case INDEX_op_bswap32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap64_i64
         case INDEX_op_bswap64_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap64(t1));
+            tci_write_reg(regs, t0, bswap64(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i64
         case INDEX_op_not_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i64
         case INDEX_op_neg_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #endif /* TCG_TARGET_REG_BITS == 64 */
-- 
2.25.1

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
 #endif
 
+#if TCG_TARGET_REG_BITS == 64
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i64): \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x) \
+        case glue(glue(INDEX_op_, x), _i64):
+#else
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x)
+#endif
+
 /* Interpret pseudo code in tb. */
 /*
  * Disable CFI checks.
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (32 bit). */
 
-        case INDEX_op_ld8u_i32:
+        CASE_32_64(ld8u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld8s_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld8s_i32:
-            TODO();
+        CASE_32_64(ld8s)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i32:
             TODO();
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8s_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld16u_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16u_i32:
-            TODO();
+        CASE_32_64(ld16u)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
         case INDEX_op_ld16s_i32:
             t0 = *tb_ptr++;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16s_i64:
             TODO();
             break;
-- 
2.25.1

Eliminating a TODO for ld16s_i64.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16s_i32:
+        CASE_32_64(ld16s)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16s_i64:
-            TODO();
-            break;
         case INDEX_op_ld32u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
+        CASE_64(ld32u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld32u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-            break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i32:
+        CASE_32_64(st8)
             t0 = tci_read_r8(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i64:
-            t0 = tci_read_r8(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint8_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st16_i64:
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             *(uint8_t *)(t1 + t2) = t0;
             break;
-        case INDEX_op_st16_i32:
+        CASE_32_64(st16)
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st16_i64:
-            t0 = tci_read_r16(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint16_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st32_i64:
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

The existing check was incomplete:
(1) Only applied to two of the 7 stores, and not to the loads at all.
(2) Only checked the upper, but not the lower bound of the stack.

Doing this at compile time means that we don't need to do it
at runtime as well.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                |  2 --
 tcg/tci/tcg-target.c.inc | 13 +++++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint32_t *)(t1 + t2) = t0;
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint64_t *)(t1 + t2) = t0;
             break;
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
     }
 }
 
+static void stack_bounds_check(TCGReg base, target_long offset)
+{
+    if (base == TCG_REG_CALL_STACK) {
+        tcg_debug_assert(offset < 0);
+        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
+    }
+}
+
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_ld_i32);
         tcg_out_r(s, ret);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
+        stack_bounds_check(args[1], args[2]);
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_debug_assert(args[2] == (int32_t)args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_st_i32);
         tcg_out_r(s, arg);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             *(uint16_t *)(t1 + t2) = t0;
             break;
         case INDEX_op_st_i32:
+        CASE_64(st32)
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st32_i64:
-            t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint32_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Three TODO instances are never happen cases.
Other uses of tcg_abort are also indicating unreachable cases.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp32 = qemu_ld_beul;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp32);
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp64 = qemu_ld_beq;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp64);
             if (TCG_TARGET_REG_BITS == 32) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_bel(t0);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_beq(tmp64);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_mb:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             smp_mb();
             break;
         default:
-            TODO();
-            break;
+            g_assert_not_reached();
         }
         tci_assert(tb_ptr == old_code_ptr + op_size);
     }
-- 
2.25.1

We do not simultaneously support div and div2 -- it's one
or the other.  TCI is already using div, so remove div2.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 12 ------------
 tcg/tci/tcg-target.c.inc |  8 --------
 2 files changed, 20 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
-#elif TCG_TARGET_HAS_div2_i32
-        case INDEX_op_div2_i32:
-        case INDEX_op_divu2_i32:
-            TODO();
-            break;
-#endif
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_remu_i64:
             TODO();
             break;
-#elif TCG_TARGET_HAS_div2_i64
-        case INDEX_op_div2_i64:
-        case INDEX_op_divu2_i64:
-            TODO();
-            break;
 #endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         TODO();
         break;
-    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
-    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_ri32(s, const_args[1], args[1]);
         tcg_out_ri32(s, const_args[2], args[2]);
         break;
-    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
-    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
-        TODO();
-        break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
-- 
2.25.1

Trivially implemented like other arithmetic.
Tested via check-tcg and the ppc64 target.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  4 ++--
 tcg/tci.c                | 28 ++++++++++++++++++++++------
 tcg/tci/tcg-target.c.inc | 10 ++++------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_div_i64          0
-#define TCG_TARGET_HAS_rem_i64          0
+#define TCG_TARGET_HAS_div_i64          1
+#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
-        case INDEX_op_divu_i64:
-        case INDEX_op_rem_i64:
-        case INDEX_op_remu_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
+            break;
+        case INDEX_op_divu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
+            break;
+        case INDEX_op_rem_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
+            break;
+        case INDEX_op_remu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
-#endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
     case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
+    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
         tcg_out_ri64(s, const_args[2], args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_debug_assert(args[4] <= UINT8_MAX);
         tcg_out8(s, args[4]);
         break;
-    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
-- 
2.25.1

As noted in several comments, 8 regs is not enough for 32-bit
to perform calls, as currently implemented.  Shortly, we will
rearrange the encoding which will make 32 regs impossible.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     | 32 +++++---------------------------
 tcg/tci/tcg-target.c.inc | 26 --------------------------
 2 files changed, 5 insertions(+), 53 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_mulu2_i32        1
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
-/* Number of registers available.
-   For 32 bit hosts, we need more than 8 registers (call arguments). */
-/* #define TCG_TARGET_NB_REGS 8 */
+/* Number of registers available. */
 #define TCG_TARGET_NB_REGS 16
-/* #define TCG_TARGET_NB_REGS 32 */
 
 /* List of registers which are used by TCG. */
 typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#if TCG_TARGET_NB_REGS >= 32
-    TCG_REG_R16,
-    TCG_REG_R17,
-    TCG_REG_R18,
-    TCG_REG_R19,
-    TCG_REG_R20,
-    TCG_REG_R21,
-    TCG_REG_R22,
-    TCG_REG_R23,
-    TCG_REG_R24,
-    TCG_REG_R25,
-    TCG_REG_R26,
-    TCG_REG_R27,
-    TCG_REG_R28,
-    TCG_REG_R29,
-    TCG_REG_R30,
-    TCG_REG_R31,
-#endif
-#endif
+
+    TCG_AREG0 = TCG_REG_R14,
+    TCG_REG_CALL_STACK = TCG_REG_R15,
+
     /* Special value UINT8_MAX is used by TCI to encode constant values. */
     TCG_CONST = UINT8_MAX
 } TCGReg;
 
-#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
-
 /* Used for function call generation. */
-#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
 #define TCG_TARGET_CALL_STACK_OFFSET    0
 #define TCG_TARGET_STACK_ALIGN          16
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#endif
 };
 
 #if MAX_OPC_PARAM_IARGS != 6
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
     TCG_REG_R12,
-#else
-# error Too few input registers available
-#endif
 #endif
 };
 
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r05",
     "r06",
     "r07",
-#if TCG_TARGET_NB_REGS >= 16
     "r08",
     "r09",
     "r10",
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r13",
     "r14",
     "r15",
-#if TCG_TARGET_NB_REGS >= 32
-    "r16",
-    "r17",
-    "r18",
-    "r19",
-    "r20",
-    "r21",
-    "r22",
-    "r23",
-    "r24",
-    "r25",
-    "r26",
-    "r27",
-    "r28",
-    "r29",
-    "r30",
-    "r31"
-#endif
-#endif
 };
 #endif
 
-- 
2.25.1

This was removed from tcg_target_reg_alloc_order and
tcg_target_call_iarg_regs on the assumption that it
was the stack.  This was incorrectly copied from i386.
For tci, the stack is R15.

By adding R4 back to tcg_target_call_iarg_regs, adjust the other
entries so that 6 (or 12) entries are still present in the array,
and adjust the numbers in the interpreter.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 8 ++++----
 tcg/tci/tcg-target.c.inc | 7 +------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
+                                          tci_read_reg(regs, TCG_REG_R4),
                                           tci_read_reg(regs, TCG_REG_R5),
                                           tci_read_reg(regs, TCG_REG_R6),
                                           tci_read_reg(regs, TCG_REG_R7),
                                           tci_read_reg(regs, TCG_REG_R8),
                                           tci_read_reg(regs, TCG_REG_R9),
                                           tci_read_reg(regs, TCG_REG_R10),
-                                          tci_read_reg(regs, TCG_REG_R11),
-                                          tci_read_reg(regs, TCG_REG_R12));
+                                          tci_read_reg(regs, TCG_REG_R11));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
 #else
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
-                                          tci_read_reg(regs, TCG_REG_R5),
-                                          tci_read_reg(regs, TCG_REG_R6));
+                                          tci_read_reg(regs, TCG_REG_R4),
+                                          tci_read_reg(regs, TCG_REG_R5));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
 #endif
             break;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
-    TCG_REG_R6,
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+    TCG_REG_R6,
     TCG_REG_R7,
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
-    TCG_REG_R12,
 #endif
 };
 
-- 
2.25.1

Restrict all operands to registers.  All constants will be forced
into registers by the middle-end.  Removing the difference in how
immediate integers were encoded will allow more code to be shared
between 32-bit and 64-bit operations.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target-con-set.h |   6 +-
 tcg/tci/tcg-target.h         |   3 -
 tcg/tci.c                    | 189 +++++++++++++----------------------
 tcg/tci/tcg-target.c.inc     |  85 ++++------------
 4 files changed, 89 insertions(+), 194 deletions(-)

diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target-con-set.h
+++ b/tcg/tci/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@
  * tcg-target-con-str.h; the constraint combination is inclusive or.
  */
 C_O0_I2(r, r)
-C_O0_I2(r, ri)
 C_O0_I3(r, r, r)
-C_O0_I4(r, r, ri, ri)
 C_O0_I4(r, r, r, r)
 C_O1_I1(r, r)
 C_O1_I2(r, 0, r)
-C_O1_I2(r, ri, ri)
 C_O1_I2(r, r, r)
-C_O1_I2(r, r, ri)
-C_O1_I4(r, r, r, ri, ri)
+C_O1_I4(r, r, r, r, r)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, r, r, r, r)
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
     TCG_AREG0 = TCG_REG_R14,
     TCG_REG_CALL_STACK = TCG_REG_R15,
-
-    /* Special value UINT8_MAX is used by TCI to encode constant values. */
-    TCG_CONST = UINT8_MAX
 } TCGReg;
 
 /* Used for function call generation. */
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
     return taddr;
 }
 
-/* Read indexed register or constant (native size) from bytecode. */
-static tcg_target_ulong
-tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
-{
-    tcg_target_ulong value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i(tb_ptr);
-    } else {
-        value = tci_read_reg(regs, r);
-    }
-    return value;
-}
-
-/* Read indexed register or constant (32 bit) from bytecode. */
-static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i32(tb_ptr);
-    } else {
-        value = tci_read_reg32(regs, r);
-    }
-    return value;
-}
-
-#if TCG_TARGET_REG_BITS == 32
-/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t low = tci_read_ri32(regs, tb_ptr);
-    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
-}
-#elif TCG_TARGET_REG_BITS == 64
-/* Read indexed register or constant (64 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint64_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i64(tb_ptr);
-    } else {
-        value = tci_read_reg64(regs, r);
-    }
-    return value;
-}
-#endif
-
 static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
 {
     tcg_target_ulong label = tci_read_i(tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         switch (opc) {
         case INDEX_op_call:
-            t0 = tci_read_ri(regs, &tb_ptr);
+            t0 = tci_read_i(&tb_ptr);
             tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond2_i32:
             t0 = *tb_ptr++;
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i32:
             t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
         case INDEX_op_brcond2_i32:
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
             break;
         case INDEX_op_divu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
             break;
         case INDEX_op_rem_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
             break;
         case INDEX_op_remu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
-            t1 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(t0, t1, condition)) {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_add_i32:
     case INDEX_op_add_i64:
     case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
-        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
-        return C_O1_I2(r, ri, ri);
+    case INDEX_op_setcond_i32:
+    case INDEX_op_setcond_i64:
+        return C_O1_I2(r, r, r);
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
-        return C_O0_I2(r, ri);
-
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        return C_O1_I2(r, r, ri);
+        return C_O0_I2(r, r);
 
 #if TCG_TARGET_REG_BITS == 32
     /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, r, r, r, r);
     case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, ri, ri);
+        return C_O0_I4(r, r, r, r);
     case INDEX_op_mulu2_i32:
         return C_O2_I2(r, r, r, r);
     case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, ri, ri);
+        return C_O1_I4(r, r, r, r, r);
 #endif
 
     case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
     tcg_out8(s, t0);
 }
 
-/* Write register or constant (native size). */
-static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out_i(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-/* Write register or constant (32 bit). */
-static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out32(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-#if TCG_TARGET_REG_BITS == 64
-/* Write register or constant (64 bit). */
-static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out64(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-#endif
-
 /* Write label. */
 static void tci_out_label(TCGContext *s, TCGLabel *label)
 {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
 {
     uint8_t *old_code_ptr = s->code_ptr;
     tcg_out_op_t(s, INDEX_op_call);
-    tcg_out_ri(s, 1, (uintptr_t)arg);
+    tcg_out_i(s, (uintptr_t)arg);
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_setcond_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_out_r(s, args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
-        tcg_out_ri32(s, const_args[4], args[4]);
+        tcg_out_r(s, args[3]);
+        tcg_out_r(s, args[4]);
         tcg_out8(s, args[5]);   /* condition */
         break;
 #elif TCG_TARGET_REG_BITS == 64
     case INDEX_op_setcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
     case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
     case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_brcond2_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
+        tcg_out_r(s, args[2]);
+        tcg_out_r(s, args[3]);
         tcg_out8(s, args[4]);           /* condition */
         tci_out_label(s, arg_label(args[5]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 #endif
     case INDEX_op_brcond_i32:
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

The TCG-specific CPU methods will be moved to a separate struct,
to make it easier to move accel-specific code outside generic CPU
code in the future.  Start by moving tcg_initialize().

The new CPUClass.tcg_opts field may eventually become a pointer,
but keep it an embedded struct for now, to make code conversion
easier.

From: Claudio Fontana <cfontana@suse.de>

for now only TCG is allowed as an accelerator for riscv,
so remove the CONFIG_TCG use.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-3-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-#ifdef CONFIG_TCG
     cc->tcg_ops.initialize = riscv_translate_init;
     cc->tlb_fill = riscv_cpu_tlb_fill;
-#endif
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

move away TCG-only code, make it compile only on TCG.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-4-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 11 +++++--
 include/hw/core/cpu.h  |  2 ++
 accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
 cpu.c                  | 70 ++++++++++++++++++++----------------------
 hw/core/cpu.c          |  6 +++-
 5 files changed, 77 insertions(+), 40 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
 }
 
 #ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
 void dump_drift_info(void);
+/* accel/tcg/translate-all.c */
 void dump_exec_info(void);
 void dump_opcount_info(void);
 #endif /* CONFIG_TCG */
 
 #endif /* !CONFIG_USER_ONLY */
 
+#ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
+int cpu_exec(CPUState *cpu);
+void tcg_exec_realizefn(CPUState *cpu, Error **errp);
+void tcg_exec_unrealizefn(CPUState *cpu);
+#endif /* CONFIG_TCG */
+
 /* Returns: 0 on success, -1 on error */
 int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         void *ptr, target_ulong len, bool is_write);
 
-int cpu_exec(CPUState *cpu);
-
 /**
  * cpu_set_cpustate_pointers(cpu)
  * @cpu: The cpu object
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
 
 void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
+
+/* $(top_srcdir)/cpu.c */
 void cpu_exec_initfn(CPUState *cpu);
 void cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
     return ret;
 }
 
+void tcg_exec_realizefn(CPUState *cpu, Error **errp)
+{
+    static bool tcg_target_initialized;
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!tcg_target_initialized) {
+        cc->tcg_ops.initialize();
+        tcg_target_initialized = true;
+    }
+    tlb_init(cpu);
+    qemu_plugin_vcpu_init_hook(cpu);
+
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_init_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+}
+
+/* undo the initializations in reverse order */
+void tcg_exec_unrealizefn(CPUState *cpu)
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_free_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+
+    qemu_plugin_vcpu_exit_hook(cpu);
+    tlb_destroy(cpu);
+}
+
 #ifndef CONFIG_USER_ONLY
 
 void dump_drift_info(void)
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
 };
 #endif
 
-void cpu_exec_unrealizefn(CPUState *cpu)
+void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    tlb_destroy(cpu);
-    cpu_list_remove(cpu);
+    cpu_list_add(cpu);
+
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_realizefn(cpu, errp);
+    }
+#endif /* CONFIG_TCG */
+
+#ifdef CONFIG_USER_ONLY
+    assert(cc->vmsd == NULL);
+#else
+    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
+        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
+    }
+    if (cc->vmsd != NULL) {
+        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
+    }
+#endif /* CONFIG_USER_ONLY */
+}
+
+void cpu_exec_unrealizefn(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
 
 #ifdef CONFIG_USER_ONLY
     assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
         vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
     }
-    tcg_iommu_free_notifier_list(cpu);
 #endif
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_unrealizefn(cpu);
+    }
+#endif /* CONFIG_TCG */
+
+    cpu_list_remove(cpu);
 }
 
 void cpu_exec_initfn(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 #endif
 }
 
-void cpu_exec_realizefn(CPUState *cpu, Error **errp)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-#ifdef CONFIG_TCG
-    static bool tcg_target_initialized;
-#endif /* CONFIG_TCG */
-
-    cpu_list_add(cpu);
-
-#ifdef CONFIG_TCG
-    if (tcg_enabled() && !tcg_target_initialized) {
-        tcg_target_initialized = true;
-        cc->tcg_ops.initialize();
-    }
-#endif /* CONFIG_TCG */
-    tlb_init(cpu);
-
-    qemu_plugin_vcpu_init_hook(cpu);
-
-#ifdef CONFIG_USER_ONLY
-    assert(cc->vmsd == NULL);
-#else /* !CONFIG_USER_ONLY */
-    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
-    }
-    if (cc->vmsd != NULL) {
-        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
-    }
-
-    tcg_iommu_init_notifier_list(cpu);
-#endif
-}
-
 const char *parse_cpu_option(const char *cpu_option)
 {
     ObjectClass *oc;
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
     return target_words_bigendian();
 }
 
+/*
+ * XXX the following #if is always true because this is a common_ss
+ * module, so target CONFIG_* is never defined.
+ */
 #if !defined(CONFIG_USER_ONLY)
 GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 static void cpu_common_unrealizefn(DeviceState *dev)
 {
     CPUState *cpu = CPU(dev);
+
     /* NOTE: latest generic point before the cpu is fully unrealized */
     trace_fini_vcpu(cpu);
-    qemu_plugin_vcpu_exit_hook(cpu);
     cpu_exec_unrealizefn(cpu);
 }
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG, reworded comments]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-5-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 22 +++++++++++++---------
 accel/tcg/cpu-exec.c      |  4 ++--
 target/arm/cpu.c          |  4 +++-
 target/avr/cpu.c          |  2 +-
 target/hppa/cpu.c         |  2 +-
 target/i386/tcg/tcg-cpu.c |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/rx/cpu.c           |  2 +-
 target/sh4/cpu.c          |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/tricore/cpu.c      |  2 +-
 13 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      * Called when the first CPU is realized.
      */
     void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @synchronize_from_tb: Callback for synchronizing state from a TCG
- *       #TranslationBlock. This is called when we abandon execution
- *       of a TB before starting it, and must set all parts of the CPU
- *       state which the previous TB in the chain may not have updated.
- *       This always includes at least the program counter; some targets
- *       will need to do more. If this hook is not implemented then the
- *       default is to call @set_pc(tb->pc).
  * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
  *       address fault.  For system mode, if the access is valid, call
  *       tlb_set_page and return true; if the access is invalid, and
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->synchronize_from_tb) {
-            cc->synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops.synchronize_from_tb) {
+            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void arm_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
         env->regs[15] = tb->pc;
     }
 }
+#endif /* CONFIG_TCG */
 
 static bool arm_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
-    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
     cc->tlb_fill = hppa_cpu_tlb_fill;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->cpu_exec_enter = x86_cpu_exec_enter;
     cc->cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tlb_fill = mb_cpu_tlb_fill;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void mips_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
     env->hflags &= ~MIPS_HFLAG_BMASK;
     env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
 }
+#endif /* CONFIG_TCG */
 
 static bool mips_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
-    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tlb_fill = superh_cpu_tlb_fill;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tlb_fill = sparc_cpu_tlb_fill;
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
     cc->tlb_fill = tricore_cpu_tlb_fill;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-6-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 12 ++++++------
 accel/tcg/cpu-exec.c            | 12 ++++++------
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/arm/cpu64.c              |  5 ++++-
 target/arm/cpu_tcg.c            |  7 ++++++-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  6 +++---
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc | 16 ++++++++++------
 25 files changed, 54 insertions(+), 42 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     void (*synchronize_from_tb)(CPUState *cpu,
                                 const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
  *   gdb stub. Returns a pointer to the XML contents for the specified XML file
  *   or NULL if the CPU doesn't have a dynamically generated content for it.
- * @cpu_exec_enter: Callback for cpu_exec preparation.
- * @cpu_exec_exit: Callback for cpu_exec cleanup.
- * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
  * @disas_set_info: Setup architecture specific components of disassembly info
  * @adjust_watchpoint_address: Perform a target-specific adjustment to an
  * address before attempting to match it against watchpoints.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char *gdb_core_xml_file;
     gchar * (*gdb_arch_name)(CPUState *cpu);
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
-    void (*cpu_exec_enter)(CPUState *cpu);
-    void (*cpu_exec_exit)(CPUState *cpu);
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_enter) {
-        cc->cpu_exec_enter(cpu);
+    if (cc->tcg_ops.cpu_exec_enter) {
+        cc->tcg_ops.cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_exit) {
-        cc->cpu_exec_exit(cpu);
+    if (cc->tcg_ops.cpu_exec_exit) {
+        cc->tcg_ops.cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->cpu_exec_interrupt &&
-                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops.cpu_exec_interrupt &&
+                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
     cc->do_interrupt = alpha_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = arm_cpu_class_by_name;
     cc->has_work = arm_cpu_has_work;
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
+#ifdef CONFIG_TCG
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     CPUClass *cc = CPU_GET_CLASS(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     }
     return ret;
 }
+#endif /* CONFIG_TCG */
 
 static void arm926_initfn(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = arm_v7m_cpu_do_interrupt;
 #endif
 
-    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->has_work = avr_cpu_has_work;
     cc->do_interrupt = avr_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
     cc->do_interrupt = cris_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
     cc->do_interrupt = hppa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->cpu_exec_enter = x86_cpu_exec_enter;
-    cc->cpu_exec_exit = x86_cpu_exec_exit;
+    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
     cc->do_interrupt = lm32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
     cc->do_interrupt = m68k_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = mb_cpu_has_work;
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
-    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
     cc->do_interrupt = mips_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
     cc->do_interrupt = nios2_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
     cc->do_interrupt = riscv_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
     cc->do_interrupt = rx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
-    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
     cc->do_interrupt = superh_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
     cc->do_interrupt = sparc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
     cc->do_interrupt = tilegx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
     cc->tlb_fill = tilegx_cpu_tlb_fill;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
     cc->do_interrupt = uc32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
     cc->tlb_fill = uc32_cpu_tlb_fill;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
     cc->do_interrupt = xtensa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
 }
 
 #ifndef CONFIG_USER_ONLY
+
 static bool ppc_cpu_is_big_endian(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
     return !msr_le;
 }
 
+#ifdef CONFIG_TCG
 static void ppc_cpu_exec_enter(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
         vhc->cpu_exec_exit(cpu->vhyp, cpu);
     }
 }
-#endif
+#endif /* CONFIG_TCG */
+
+#endif /* !CONFIG_USER_ONLY */
 
 static void ppc_cpu_instance_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
     cc->do_interrupt = ppc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #endif
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->tlb_fill = ppc_cpu_tlb_fill;
-#endif
 #ifndef CONFIG_USER_ONLY
-    cc->cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->cpu_exec_exit = ppc_cpu_exec_exit;
-#endif
+    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+#endif /* !CONFIG_USER_ONLY */
+#endif /* CONFIG_TCG */
 
     cc->disas_set_info = ppc_disas_set_info;
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

[claudio: wrapped target code in CONFIG_TCG]

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-7-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 21 ++++++++++++---------
 accel/tcg/cputlb.c              |  7 ++++---
 accel/tcg/user-exec.c           |  6 +++---
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  2 +-
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/moxie/cpu.c              |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/tricore/cpu.c            |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc |  2 +-
 26 files changed, 42 insertions(+), 38 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
- *       address fault.  For system mode, if the access is valid, call
- *       tlb_set_page and return true; if the access is invalid, and
- *       probe is true, return false; otherwise raise an exception and
- *       do not return.  For user-only mode, always raise an exception
- *       and do not return.
  * @get_phys_page_debug: Callback for obtaining a physical address.
  * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
  *       associated memory transaction attributes to use for the access.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
     hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
+                              access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
-                              mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
+                                      mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tlb_fill(cpu, addr, fault_size, access_type,
-                         MMU_USER_IDX, false, ra);
+            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
+                                 MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tlb_fill = alpha_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.initialize = arm_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tlb_fill = arm_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tlb_fill = avr_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tlb_fill = cris_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tlb_fill = hppa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_hppa_cpu;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tlb_fill = x86_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->debug_excp_handler = breakpoint_handler;
 #endif
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tlb_fill = lm32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tlb_fill = m68k_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
     cc->do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tlb_fill = mb_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.initialize = mips_tcg_init;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tlb_fill = mips_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tlb_fill = moxie_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tlb_fill = nios2_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tlb_fill = openrisc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
     cc->tcg_ops.initialize = rx_translate_init;
-    cc->tlb_fill = rx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = s390_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tlb_fill = s390_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tlb_fill = superh_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tlb_fill = sparc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tlb_fill = tilegx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
     cc->tcg_ops.initialize = tilegx_tcg_init;
 }
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tlb_fill = uc32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tlb_fill = xtensa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tlb_fill = ppc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-8-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 4 ++--
 accel/tcg/cpu-exec.c      | 4 ++--
 target/arm/cpu.c          | 2 +-
 target/i386/tcg/tcg-cpu.c | 2 +-
 target/lm32/cpu.c         | 2 +-
 target/s390x/cpu.c        | 2 +-
 target/xtensa/cpu.c       | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_write_register: Callback for letting GDB write a register.
  * @debug_check_watchpoint: Callback: return true if the architectural
  *       watchpoint whose address has matched should really fire.
- * @debug_excp_handler: Callback for handling debug exceptions.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
     bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-    void (*debug_excp_handler)(CPUState *cpu);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->debug_excp_handler) {
-        cc->debug_excp_handler(cpu);
+    if (cc->tcg_ops.debug_excp_handler) {
+        cc->tcg_ops.debug_excp_handler(cpu);
     }
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->debug_excp_handler = arm_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->debug_excp_handler = breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
 #endif
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->debug_excp_handler = lm32_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
     cc->tcg_ops.initialize = lm32_translate_init;
 }
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->debug_excp_handler = xtensa_breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
     cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
to prepare the emulated architecture to take an interrupt as defined
in the hardware specifications,

but in reality the _do_interrupt style of functions in targets are
also occasionally reused by KVM to prepare the architecture state in a
similar way where userspace code has identified that it needs to
deliver an exception to the guest.

In the case of ARM, that includes:

1) the vcpu thread got a SIGBUS indicating a memory error,
   and we need to deliver a Synchronous External Abort to the guest to
   let it know about the error.
2) the kernel told us about a debug exception (breakpoint, watchpoint)
   but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
   so it must be a breakpoint the guest itself has set up, therefore
   we need to deliver it to the guest.

So in order to reuse code, the same arm_do_interrupt function is used.
This is all fine, but we need to avoid calling it using the callback
registered in CPUClass, since that one is now TCG-only.

Fortunately this is easily solved by replacing calls to
CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210204163931.7358-9-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 4 ++++
 target/arm/kvm64.c  | 6 ++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
  * Do any appropriate logging, handle PSCI calls, and then hand off
  * to the AArch64-entry or AArch32-entry function depending on the
  * target exception level's register width.
+ *
+ * Note: this is used for both TCG (as the do_interrupt tcg op),
+ *       and KVM to re-inject guest debug exceptions, and to
+ *       inject a Synchronous-External-Abort.
  */
 void arm_cpu_do_interrupt(CPUState *cs)
 {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 {
     ARMCPU *cpu = ARM_CPU(c);
     CPUARMState *env = &cpu->env;
-    CPUClass *cc = CPU_GET_CLASS(c);
     uint32_t esr;
     bool same_el;
 
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 
     env->exception.syndrome = esr;
 
-    cc->do_interrupt(c);
+    arm_cpu_do_interrupt(c);
 }
 
 #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
 {
     int hsr_ec = syn_get_ec(debug_exit->hsr);
     ARMCPU *cpu = ARM_CPU(cs);
-    CPUClass *cc = CPU_GET_CLASS(cs);
     CPUARMState *env = &cpu->env;
 
     /* Ensure PC is synchronised */
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
     env->exception.vaddress = debug_exit->far;
     env->exception.target_el = 1;
     qemu_mutex_lock_iothread();
-    cc->do_interrupt(cs);
+    arm_cpu_do_interrupt(cs);
     qemu_mutex_unlock_iothread();
 
     return false;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /** @do_interrupt: Callback for interrupt handling. */
+    void (*do_interrupt)(CPUState *cpu);
     /**
      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
      *
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_interrupt: Callback for interrupt handling.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
  * @do_transaction_failed: Callback for handling failed memory transactions
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_interrupt)(CPUState *cpu);
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->do_interrupt(cpu);
+        cc->tcg_ops.do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->do_interrupt(cpu);
+            cc->tcg_ops.do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->do_interrupt = alpha_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->do_interrupt(cs);
+    cc->tcg_ops.do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_cpu_do_interrupt;
     cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
     cc->asidx_from_attrs = arm_asidx_from_attrs;
     cc->vmsd = &vmstate_arm_cpu;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif
 }
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
 
     acc->info = data;
-#ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
-
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
+#endif
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->do_interrupt = avr_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->do_interrupt = cris_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->do_interrupt = hppa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->do_interrupt = x86_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->do_interrupt = lm32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->do_interrupt = m68k_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->do_interrupt = mb_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
-    cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#endif
+#endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->do_interrupt = moxie_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
     cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->do_interrupt = nios2_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->do_interrupt = openrisc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->do_interrupt = riscv_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->do_interrupt = rx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
 #ifdef CONFIG_TCG
-    cc->do_interrupt = s390_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
 #endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->do_interrupt = superh_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->do_interrupt = sparc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->do_interrupt = tilegx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->do_interrupt = uc32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->do_interrupt = xtensa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
-    cc->do_interrupt = ppc_cpu_do_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
+    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
     cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

[claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]

avoiding its use in headers used by common_ss code (should be poisoned).

Note: need to be careful with the use of CONFIG_USER_ONLY,
Message-Id: <20210204163931.7358-11-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 28 +++++++++++++---------------
 hw/mips/jazz.c            |  9 +++++++--
 target/alpha/cpu.c        |  2 +-
 target/arm/cpu.c          |  4 ++--
 target/m68k/cpu.c         |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/riscv/cpu_helper.c |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/xtensa/cpu.c       |  2 +-
 target/xtensa/helper.c    |  4 ++--
 12 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     /** @debug_excp_handler: Callback for handling debug exceptions */
     void (*debug_excp_handler)(CPUState *cpu);
 
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @has_work: Callback for checking if there is work to do.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
- * @do_transaction_failed: Callback for handling failed memory transactions
- * (ie bus faults or external aborts; not MMU faults)
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-#ifdef NEED_CPU_H
-
-#ifdef CONFIG_SOFTMMU
 static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                         MMUAccessType access_type,
                                         int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
-        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
-                                  mmu_idx, attrs, response, retaddr);
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops.do_transaction_failed) {
+        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
+                                          access_type, mmu_idx, attrs,
+                                          response, retaddr);
     }
 }
-#endif
-
-#endif /* NEED_CPU_H */
 
 /**
  * cpu_set_pc:
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
 #define MAGNUM_BIOS_SIZE_MAX 0x7e000
 #define MAGNUM_BIOS_SIZE                                                       \
         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
+
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
                                           vaddr addr, unsigned size,
                                           MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
                                   mmu_idx, attrs, response, retaddr);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void mips_jazz_init(MachineState *machine,
                            enum jazz_model_e jazz_model)
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      * memory region that catches all memory accesses, as we do on Malta.
      */
     cc = CPU_GET_CLASS(cpu);
-    real_do_transaction_failed = cc->do_transaction_failed;
-    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
     memory_region_add_subregion(address_space, 0, machine->ram);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
-    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-#endif
+#endif /* CONFIG_TCG */
 }
 
 #ifdef CONFIG_KVM
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->do_transaction_failed = m68k_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
     cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+#endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
     cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     env->badaddr = addr;
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
 
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
     cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     cpu_loop_exit_restore(cs, retaddr);
 }
 
-#else
+#else /* !CONFIG_USER_ONLY */
 
 void xtensa_cpu_do_unaligned_access(CPUState *cs,
                                     vaddr addr, MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
         qemu_cpu_kick(cpu);
     }
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

make it consistently SOFTMMU-only.

[claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
Message-Id: <20210204163931.7358-12-cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
                                   unsigned size, MMUAccessType access_type,
                                   int mmu_idx, MemTxAttrs attrs,
                                   MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_unaligned_access: Callback for unaligned access handling, if
- * the target defines #TARGET_ALIGNED_ONLY.
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 }
 
 static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
     info->print_insn = print_insn_hppa;
 }
 
+#ifndef CONFIG_USER_ONLY
 static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                          MMUAccessType access_type,
                                          int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 
     cpu_loop_exit_restore(cs, retaddr);
 }
+#endif /* CONFIG_USER_ONLY */
 
 static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
-    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
     cc->disas_set_info = hppa_cpu_disas_set_info;
     cc->tcg_ops.initialize = hppa_translate_init;
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
+
 #endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = nios2_cpu_disas_set_info;
     cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/excp_helper.c
+++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
     }
 }
 
-#endif /* CONFIG_USER_ONLY */
+#endif /* !CONFIG_USER_ONLY */
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = ppc_cpu_set_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
-    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cpu_check_watchpoint, watchpoint_address_matches are TCG-only.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-13-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
 1 file changed, 72 insertions(+), 69 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
     }
 }
 
+#ifdef CONFIG_TCG
 /* Return true if this watchpoint address matches the specified
  * access (ie the address range covered by the watchpoint overlaps
  * partially or completely with the address range covered by the
@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
     return ret;
 }
 
+/* Generate a debug exception if a watchpoint has been hit.  */
+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                          MemTxAttrs attrs, int flags, uintptr_t ra)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUWatchpoint *wp;
+
+    assert(tcg_enabled());
+    if (cpu->watchpoint_hit) {
+        /*
+         * We re-entered the check after replacing the TB.
+         * Now raise the debug interrupt so that it will
+         * trigger after the current instruction.
+         */
+        qemu_mutex_lock_iothread();
+        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
+        qemu_mutex_unlock_iothread();
+        return;
+    }
+
+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+        if (watchpoint_address_matches(wp, addr, len)
+            && (wp->flags & flags)) {
+            if (replay_running_debug()) {
+                /*
+                 * Don't process the watchpoints when we are
+                 * in a reverse debugging operation.
+                 */
+                replay_breakpoint();
+                return;
+            }
+            if (flags == BP_MEM_READ) {
+                wp->flags |= BP_WATCHPOINT_HIT_READ;
+            } else {
+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
+            }
+            wp->hitaddr = MAX(addr, wp->vaddr);
+            wp->hitattrs = attrs;
+            if (!cpu->watchpoint_hit) {
+                if (wp->flags & BP_CPU &&
+                    !cc->debug_check_watchpoint(cpu, wp)) {
+                    wp->flags &= ~BP_WATCHPOINT_HIT;
+                    continue;
+                }
+                cpu->watchpoint_hit = wp;
+
+                mmap_lock();
+                tb_check_watchpoint(cpu, ra);
+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
+                    cpu->exception_index = EXCP_DEBUG;
+                    mmap_unlock();
+                    cpu_loop_exit_restore(cpu, ra);
+                } else {
+                    /* Force execution of one insn next time.  */
+                    cpu->cflags_next_tb = 1 | curr_cflags();
+                    mmap_unlock();
+                    if (ra) {
+                        cpu_restore_state(cpu, ra, true);
+                    }
+                    cpu_loop_exit_noexc(cpu);
+                }
+            }
+        } else {
+            wp->flags &= ~BP_WATCHPOINT_HIT;
+        }
+    }
+}
+
+#endif /* CONFIG_TCG */
+
 /* Called from RCU critical section */
 static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
 {
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
-/* Generate a debug exception if a watchpoint has been hit.  */
-void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                          MemTxAttrs attrs, int flags, uintptr_t ra)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    CPUWatchpoint *wp;
-
-    assert(tcg_enabled());
-    if (cpu->watchpoint_hit) {
-        /*
-         * We re-entered the check after replacing the TB.
-         * Now raise the debug interrupt so that it will
-         * trigger after the current instruction.
-         */
-        qemu_mutex_lock_iothread();
-        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-        qemu_mutex_unlock_iothread();
-        return;
-    }
-
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (watchpoint_address_matches(wp, addr, len)
-            && (wp->flags & flags)) {
-            if (replay_running_debug()) {
-                /*
-                 * Don't process the watchpoints when we are
-                 * in a reverse debugging operation.
-                 */
-                replay_breakpoint();
-                return;
-            }
-            if (flags == BP_MEM_READ) {
-                wp->flags |= BP_WATCHPOINT_HIT_READ;
-            } else {
-                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-            }
-            wp->hitaddr = MAX(addr, wp->vaddr);
-            wp->hitattrs = attrs;
-            if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
-                    wp->flags &= ~BP_WATCHPOINT_HIT;
-                    continue;
-                }
-                cpu->watchpoint_hit = wp;
-
-                mmap_lock();
-                tb_check_watchpoint(cpu, ra);
-                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-                    cpu->exception_index = EXCP_DEBUG;
-                    mmap_unlock();
-                    cpu_loop_exit_restore(cpu, ra);
-                } else {
-                    /* Force execution of one insn next time.  */
-                    cpu->cflags_next_tb = 1 | curr_cflags();
-                    mmap_unlock();
-                    if (ra) {
-                        cpu_restore_state(cpu, ra, true);
-                    }
-                    cpu_loop_exit_noexc(cpu);
-                }
-            }
-        } else {
-            wp->flags &= ~BP_WATCHPOINT_HIT;
-        }
-    }
-}
-
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")

introduced this ARM-specific, TCG-specific hack to adjust the address,
before checking it with cpu_check_watchpoint.

Make adjust_watchpoint_address optional and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-14-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 6 +++++-
 hw/core/cpu.c         | 6 ------
 softmmu/physmem.c     | 5 ++++-
 target/arm/cpu.c      | 2 +-
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
     const char *deprecation_note;
     /* Keep non-pointer data at the end to minimize holes.  */
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
-{
-    return addr;
-}
-
 static Property cpu_common_props[] = {
 #ifndef CONFIG_USER_ONLY
     /* Create a memory property for softmmu CPU object,
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
-    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    if (cc->tcg_ops.adjust_watchpoint_address) {
+        /* this is currently used only by ARM BE32 */
+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+    }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
             && (wp->flags & flags)) {
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
commit 3826121d9298 ("target-arm: Implement checking of fired")
introduced an ARM-specific hack for cpu_check_watchpoint.

Make debug_check_watchpoint optional, and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-15-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 9 ++++++---
 accel/tcg/user-exec.c | 3 ++-
 hw/core/cpu.c         | 9 ---------
 softmmu/physmem.c     | 4 ++--
 target/arm/cpu.c      | 4 ++--
 5 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       a memory access with the specified memory transaction attributes.
  * @gdb_read_register: Callback for letting GDB read a register.
  * @gdb_write_register: Callback for letting GDB write a register.
- * @debug_check_watchpoint: Callback: return true if the architectural
- *       watchpoint whose address has matched should really fire.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
+                         MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
     return 0;
 }
 
-static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
-{
-    /* If no extra check is required, QEMU watchpoint match can be considered
-     * as an architectural match.
-     */
-    return true;
-}
-
 static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
 {
     return target_words_bigendian();
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_read_register = cpu_common_gdb_read_register;
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
-    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
+                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 #if !defined(CONFIG_USER_ONLY)
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
+    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 }
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

we cannot in principle make the TCG Operations field definitions
conditional on CONFIG_TCG in code that is included by both common_ss
and specific_ss modules.

Therefore, what we can do safely to restrict the TCG fields to TCG-only
builds, is to move all tcg cpu operations into a separate header file,
which is only included by TCG, target-specific code.

This leaves just a NULL pointer in the cpu.h for the non-TCG builds.

This also tidies up the code in all targets a bit, having all TCG cpu
operations neatly contained by a dedicated data struct.

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
 
 struct TranslationBlock;
 
-/**
- * struct TcgCpuOperations: TCG operations specific to a CPU class
- */
-typedef struct TcgCpuOperations {
-    /**
-     * @initialize: Initalize TCG state
-     *
-     * Called when the first CPU is realized.
-     */
-    void (*initialize)(void);
-    /**
-     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-     *
-     * This is called when we abandon execution of a TB before starting it,
-     * and must set all parts of the CPU state which the previous TB in the
-     * chain may not have updated.
-     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
-     *
-     * If more state needs to be restored, the target must implement a
-     * function to restore all the state, and register it here.
-     */
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
-    /** @cpu_exec_enter: Callback for cpu_exec preparation */
-    void (*cpu_exec_enter)(CPUState *cpu);
-    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
-    void (*cpu_exec_exit)(CPUState *cpu);
-    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-    /** @do_interrupt: Callback for interrupt handling. */
-    void (*do_interrupt)(CPUState *cpu);
-    /**
-     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-     *
-     * For system mode, if the access is valid, call tlb_set_page
-     * and return true; if the access is invalid, and probe is
-     * true, return false; otherwise raise an exception and do
-     * not return.  For user-only mode, always raise an exception
-     * and do not return.
-     */
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
-    /** @debug_excp_handler: Callback for handling debug exceptions */
-    void (*debug_excp_handler)(CPUState *cpu);
-
-    /**
-     * @do_transaction_failed: Callback for handling failed memory transactions
-     * (ie bus faults or external aborts; not MMU faults)
-     */
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
-    /**
-     * @do_unaligned_access: Callback for unaligned access handling
-     */
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
-    /**
-     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
-     */
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
-
-    /**
-     * @debug_check_watchpoint: return true if the architectural
-     * watchpoint whose address has matched should really fire, used by ARM
-     */
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-
-} TcgCpuOperations;
+/* see tcg-cpu-ops.h */
+struct TCGCPUOps;
 
 /**
  * CPUClass:
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
 
-    TcgCpuOperations tcg_ops;
+    /* when TCG is not available, this pointer is NULL */
+    struct TCGCPUOps *tcg_ops;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-                                        MMUAccessType access_type,
-                                        int mmu_idx, uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
-}
-
-static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
-                                          vaddr addr, unsigned size,
-                                          MMUAccessType access_type,
-                                          int mmu_idx, MemTxAttrs attrs,
-                                          MemTxResult response,
-                                          uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    if (!cpu->ignore_memory_transaction_failures &&
-        cc->tcg_ops.do_transaction_failed) {
-        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
-                                          access_type, mmu_idx, attrs,
-                                          response, retaddr);
-    }
-}
-
 /**
  * cpu_set_pc:
  * @cpu: The CPU to set the program counter for.
diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * TCG CPU-specific operations
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPU_OPS_H
+#define TCG_CPU_OPS_H
+
+#include "hw/core/cpu.h"
+
+struct TCGCPUOps {
+    /**
+     * @initialize: Initalize TCG state
+     *
+     * Called when the first CPU is realized.
+     */
+    void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @do_interrupt: Callback for interrupt handling.
+     *
+     * note that this is in general SOFTMMU only, but it actually isn't
+     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
+     * in the SOFTMMU section in general.
+     */
+    void (*do_interrupt)(CPUState *cpu);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
+
+#ifdef NEED_CPU_H
+#ifdef CONFIG_SOFTMMU
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
+
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
+#endif /* CONFIG_SOFTMMU */
+#endif /* NEED_CPU_H */
+
+};
+
+#endif /* TCG_CPU_OPS_H */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);
 
+#ifdef CONFIG_TCG
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const struct TranslationBlock *tb);
+#endif /* CONFIG_TCG */
+
+
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
     FPROUNDING_POSINF,
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->tcg_ops.synchronize_from_tb) {
-            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops->synchronize_from_tb) {
+            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_enter) {
-        cc->tcg_ops.cpu_exec_enter(cpu);
+    if (cc->tcg_ops->cpu_exec_enter) {
+        cc->tcg_ops->cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_exit) {
-        cc->tcg_ops.cpu_exec_exit(cpu);
+    if (cc->tcg_ops->cpu_exec_exit) {
+        cc->tcg_ops->cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->tcg_ops.debug_excp_handler) {
-        cc->tcg_ops.debug_excp_handler(cpu);
+    if (cc->tcg_ops->debug_excp_handler) {
+        cc->tcg_ops->debug_excp_handler(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->tcg_ops.do_interrupt(cpu);
+        cc->tcg_ops->do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->tcg_ops.do_interrupt(cpu);
+            cc->tcg_ops->do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->tcg_ops.cpu_exec_interrupt &&
-                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops->cpu_exec_interrupt &&
+                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
     if (!tcg_target_initialized) {
-        cc->tcg_ops.initialize();
+        cc->tcg_ops->initialize();
         tcg_target_initialized = true;
     }
     tlb_init(cpu);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
-                              access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
+                               access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
+static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
+                                        MMUAccessType access_type,
+                                        int mmu_idx, uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+}
+
+static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+                                          vaddr addr, unsigned size,
+                                          MMUAccessType access_type,
+                                          int mmu_idx, MemTxAttrs attrs,
+                                          MemTxResult response,
+                                          uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops->do_transaction_failed) {
+        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
+                                           access_type, mmu_idx, attrs,
+                                           response, retaddr);
+    }
+}
+
 static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
-                                      mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
+                                       mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
-                         MMU_USER_IDX, false, pc);
+    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
+                          MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
-                                 MMU_USER_IDX, false, ra);
+            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
+                                  MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/help_option.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 
 enum jazz_model_e {
     JAZZ_MAGNUM,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      */
     cc = CPU_GET_CLASS(cpu);
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
-    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
+    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/cutils.h"
 #include "qemu/cacheflush.h"
 #include "cpu.h"
+
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
+
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "hw/qdev-core.h"
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    if (cc->tcg_ops.adjust_watchpoint_address) {
+    if (cc->tcg_ops->adjust_watchpoint_address) {
         /* this is currently used only by ARM BE32 */
-        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
     }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
-                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
+                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps alpha_tcg_ops = {
+    .initialize = alpha_translate_init,
+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
+    .tlb_fill = alpha_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = alpha_cpu_do_interrupt,
+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
     cc->disas_set_info = alpha_cpu_disas_set_info;
-    cc->tcg_ops.initialize = alpha_translate_init;
 
+    cc->tcg_ops = &alpha_tcg_ops;
     cc->gdb_num_core_regs = 67;
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
 }
 
 #ifdef CONFIG_TCG
-static void arm_cpu_synchronize_from_tb(CPUState *cs,
-                                        const TranslationBlock *tb)
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const TranslationBlock *tb)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->tcg_ops.do_interrupt(cs);
+    cc->tcg_ops->do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
     return g_strdup("arm");
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_cpu_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = arm_disas_set_info;
+
 #ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = arm_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-#if !defined(CONFIG_USER_ONLY)
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
-    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+    cc->tcg_ops = &arm_tcg_ops;
 #endif /* CONFIG_TCG */
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "qemu/module.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-#endif /* CONFIG_TCG */
-
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 
     acc->info = data;
 #ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
+    cc->tcg_ops = &arm_v7m_tcg_ops;
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     qemu_fprintf(f, "\n");
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps avr_tcg_ops = {
+    .initialize = avr_cpu_tcg_init,
+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
+    .tlb_fill = avr_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = avr_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void avr_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
-    cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
     cc->gdb_core_xml_file = "avr-cpu.xml";
+    cc->tcg_ops = &avr_tcg_ops;
 }
 
 /*
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/address-spaces.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps crisv10_tcg_ops = {
+    .initialize = cris_initialize_crisv10_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = crisv10_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static struct TCGCPUOps crisv32_tcg_ops = {
+    .initialize = cris_initialize_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = cris_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
 {
+    CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 32;
+    cc->tcg_ops = &crisv32_tcg_ops;
 }
 
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
 
     cc->disas_set_info = cris_disas_set_info;
-    cc->tcg_ops.initialize = cris_initialize_tcg;
 }
 
 #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "mmu.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_HPPA_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps hppa_tcg_ops = {
+    .initialize = hppa_translate_init,
+    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
+    .tlb_fill = hppa_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = hppa_cpu_do_interrupt,
+    .do_unaligned_access = hppa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
     cc->disas_set_info = hppa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = hppa_translate_init;
-
     cc->gdb_num_core_regs = 128;
+    cc->tcg_ops = &hppa_tcg_ops;
 }
 
 static const TypeInfo hppa_cpu_type_info = {
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps x86_tcg_ops = {
+    .initialize = tcg_x86_init,
+    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
+    .cpu_exec_enter = x86_cpu_exec_enter,
+    .cpu_exec_exit = x86_cpu_exec_exit,
+    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+    .do_interrupt = x86_cpu_do_interrupt,
+    .tlb_fill = x86_cpu_tlb_fill,
+#ifndef CONFIG_USER_ONLY
+    .debug_excp_handler = breakpoint_handler,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
-    cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
-#endif
+    cc->tcg_ops = &x86_tcg_ops;
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps lm32_tcg_ops = {
+    .initialize = lm32_translate_init,
+    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
+    .tlb_fill = lm32_cpu_tlb_fill,
+    .debug_excp_handler = lm32_debug_excp_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = lm32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 {
     LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
-    cc->tcg_ops.initialize = lm32_translate_init;
+    cc->tcg_ops = &lm32_tcg_ops;
 }
 
 #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
 };
 #endif
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps m68k_tcg_ops = {
+    .initialize = m68k_tcg_init,
+    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
+    .tlb_fill = m68k_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = m68k_cpu_do_interrupt,
+    .do_transaction_failed = m68k_cpu_transaction_failed,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void m68k_cpu_class_init(ObjectClass *c, void *data)
 {
     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
     cc->disas_set_info = m68k_cpu_disas_set_info;
-    cc->tcg_ops.initialize = m68k_tcg_init;
 
     cc->gdb_num_core_regs = 18;
+    cc->tcg_ops = &m68k_tcg_ops;
 }
 
 static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_MICROBLAZE_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps mb_tcg_ops = {
+    .initialize = mb_tcg_init,
+    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
+    .tlb_fill = mb_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = mb_cpu_do_interrupt,
+    .do_transaction_failed = mb_cpu_transaction_failed,
+    .do_unaligned_access = mb_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void mb_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
+
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
+
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_num_core_regs = 32 + 27;
 
     cc->disas_set_info = mb_disas_set_info;
-    cc->tcg_ops.initialize = mb_tcg_init;
+    cc->tcg_ops = &mb_tcg_ops;
 }
 
 static const TypeInfo mb_cpu_type_info = {
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+/*
+ * NB: cannot be const, as some elements are changed for specific
+ * mips hardware (see hw/mips/jazz.c).
+ */
+static struct TCGCPUOps mips_tcg_ops = {
+    .initialize = mips_tcg_init,
+    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+    .tlb_fill = mips_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = mips_cpu_do_interrupt,
+    .do_transaction_failed = mips_cpu_do_transaction_failed,
+    .do_unaligned_access = mips_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void mips_cpu_class_init(ObjectClass *c, void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->vmsd = &vmstate_mips_cpu;
 #endif
     cc->disas_set_info = mips_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = mips_tcg_init;
-    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
-
-#endif /* CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &mips_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps moxie_tcg_ops = {
+    .initialize = moxie_translate_init,
+    .tlb_fill = moxie_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = moxie_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void moxie_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
 #endif
     cc->disas_set_info = moxie_cpu_disas_set_info;
-    cc->tcg_ops.initialize = moxie_translate_init;
+    cc->tcg_ops = &moxie_tcg_ops;
 }
 
 static void moxielite_initfn(Object *obj)
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps nios2_tcg_ops = {
+    .initialize = nios2_tcg_init,
+    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
+    .tlb_fill = nios2_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = nios2_cpu_do_interrupt,
+    .do_unaligned_access = nios2_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
 
 static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
     cc->gdb_write_register = nios2_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 49;
-    cc->tcg_ops.initialize = nios2_tcg_init;
+    cc->tcg_ops = &nios2_tcg_ops;
 }
 
 static const TypeInfo nios2_cpu_type_info = {
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
                       | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps openrisc_tcg_ops = {
+    .initialize = openrisc_translate_init,
+    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
+    .tlb_fill = openrisc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = openrisc_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 {
     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 3;
-    cc->tcg_ops.initialize = openrisc_translate_init;
     cc->disas_set_info = openrisc_disas_set_info;
+    cc->tcg_ops = &openrisc_tcg_ops;
 }
 
 /* Sort alphabetically by type name, except for "any". */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
     return NULL;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps riscv_tcg_ops = {
+    .initialize = riscv_translate_init,
+    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
+    .tlb_fill = riscv_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = riscv_cpu_do_interrupt,
+    .do_transaction_failed = riscv_cpu_do_transaction_failed,
+    .do_unaligned_access = riscv_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-    cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops = &riscv_tcg_ops;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
     qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps rx_tcg_ops = {
+    .initialize = rx_translate_init,
+    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
+    .tlb_fill = rx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = rx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void rx_cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
+
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
-    cc->tcg_ops.initialize = rx_translate_init;
-    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
+    cc->tcg_ops = &rx_tcg_ops;
 }
 
 static const TypeInfo rx_cpu_info = {
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
     return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
 }
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps s390_tcg_ops = {
+    .initialize = s390x_translate_init,
+    .tlb_fill = s390_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+    .do_interrupt = s390_cpu_do_interrupt,
+    .debug_excp_handler = s390x_cpu_debug_excp_handler,
+    .do_unaligned_access = s390x_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void s390_cpu_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *scc = S390_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     scc->reset = s390_cpu_reset;
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
-#endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vmstate_s390_cpu;
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
-#endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
-#endif
-
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
     cc->gdb_core_xml_file = "s390x-core64.xml";
     cc->gdb_arch_name = s390_gdb_arch_name;
 
     s390_cpu_model_class_register_props(oc);
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &s390_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo s390_cpu_type_info = {
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps superh_tcg_ops = {
+    .initialize = sh4_translate_init,
+    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
+    .tlb_fill = superh_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = superh_cpu_do_interrupt,
+    .do_unaligned_access = superh_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void superh_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
-    cc->tcg_ops.initialize = sh4_translate_init;
 
     cc->gdb_num_core_regs = 59;
 
     dc->vmsd = &vmstate_sh_cpu;
+    cc->tcg_ops = &superh_tcg_ops;
 }
 
 #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps sparc_tcg_ops = {
+    .initialize = sparc_tcg_init,
+    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
+    .tlb_fill = sparc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = sparc_cpu_do_interrupt,
+    .do_transaction_failed = sparc_cpu_do_transaction_failed,
+    .do_unaligned_access = sparc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
     cc->disas_set_info = cpu_sparc_disas_set_info;
-    cc->tcg_ops.initialize = sparc_tcg_init;
 
 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
     cc->gdb_num_core_regs = 86;
 #else
     cc->gdb_num_core_regs = 72;
 #endif
+    cc->tcg_ops = &sparc_tcg_ops;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     return false;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tilegx_tcg_ops = {
+    .initialize = tilegx_tcg_init,
+    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
+    .tlb_fill = tilegx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = tilegx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
-    cc->tcg_ops.initialize = tilegx_tcg_init;
+    cc->tcg_ops = &tilegx_tcg_ops;
 }
 
 static const TypeInfo tilegx_cpu_type_info = {
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
     set_feature(&cpu->env, TRICORE_FEATURE_161);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tricore_tcg_ops = {
+    .initialize = tricore_tcg_init,
+    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
+    .tlb_fill = tricore_cpu_tlb_fill,
+};
+
 static void tricore_cpu_class_init(ObjectClass *c, void *data)
 {
     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops = &tricore_tcg_ops;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps uc32_tcg_ops = {
+    .initialize = uc32_translate_init,
+    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
+    .tlb_fill = uc32_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = uc32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
+    cc->tcg_ops = &uc32_tcg_ops;
 }
 
 #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps xtensa_tcg_ops = {
+    .initialize = xtensa_translate_init,
+    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
+    .tlb_fill = xtensa_cpu_tlb_fill,
+    .debug_excp_handler = xtensa_breakpoint_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = xtensa_cpu_do_interrupt,
+    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
+    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
+    cc->tcg_ops = &xtensa_tcg_ops;
 }
 
 static const TypeInfo xtensa_cpu_type_info = {
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps ppc_tcg_ops = {
+  .initialize = ppc_translate_init,
+  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
+  .tlb_fill = ppc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+  .do_interrupt = ppc_cpu_do_interrupt,
+  .cpu_exec_enter = ppc_cpu_exec_enter,
+  .cpu_exec_exit = ppc_cpu_exec_exit,
+  .do_unaligned_access = ppc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
 #endif
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = ppc_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
-    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
-#endif /* !CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->disas_set_info = ppc_disas_set_info;
 
     dc->fw_name = "PowerPC,UNKNOWN";
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &ppc_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
 F: include/exec/tb-hash.h
 F: include/sysemu/cpus.h
 F: include/sysemu/tcg.h
+F: include/hw/core/tcg-cpu-ops.h
 
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

[claudio: rebased on Richard's splitwx work]

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-17-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/boards.h                |  2 +-
 include/{sysemu => qemu}/accel.h   | 14 +++++----
 include/sysemu/hvf.h               |  2 +-
 include/sysemu/kvm.h               |  2 +-
 include/sysemu/kvm_int.h           |  2 +-
 target/i386/hvf/hvf-i386.h         |  2 +-
 accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
 accel/{accel.c => accel-softmmu.c} | 27 ++--------------
 accel/accel-user.c                 | 24 ++++++++++++++
 accel/qtest/qtest.c                |  2 +-
 accel/tcg/tcg-all.c                | 15 +++++++--
 accel/xen/xen-all.c                |  2 +-
 bsd-user/main.c                    |  6 +++-
 linux-user/main.c                  |  6 +++-
 softmmu/memory.c                   |  2 +-
 softmmu/qtest.c                    |  2 +-
 softmmu/vl.c                       |  2 +-
 target/i386/hax/hax-all.c          |  2 +-
 target/i386/hvf/hvf.c              |  2 +-
 target/i386/hvf/x86_task.c         |  2 +-
 target/i386/whpx/whpx-all.c        |  2 +-
 MAINTAINERS                        |  2 +-
 accel/meson.build                  |  4 ++-
 accel/tcg/meson.build              |  2 +-
 24 files changed, 125 insertions(+), 53 deletions(-)
 rename include/{sysemu => qemu}/accel.h (95%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (75%)
 create mode 100644 accel/accel-user.c

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/blockdev.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-types-machine.h"
 #include "qemu/module.h"
 #include "qom/object.h"
diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
similarity index 95%
rename from include/sysemu/accel.h
rename to include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#ifndef HW_ACCEL_H
-#define HW_ACCEL_H
+#ifndef QEMU_ACCEL_H
+#define QEMU_ACCEL_H
 
 #include "qom/object.h"
 #include "exec/hwaddr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     /*< public >*/
 
     const char *name;
-#ifndef CONFIG_USER_ONLY
     int (*init_machine)(MachineState *ms);
+#ifndef CONFIG_USER_ONLY
     void (*setup_post)(MachineState *ms, AccelState *accel);
     bool (*has_memory)(MachineState *ms, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
 
 AccelClass *accel_find(const char *opt_name);
+AccelState *current_accel(void);
+
+#ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
 /* Called just before os_setup_post (ie just before drop OS privs) */
 void accel_setup_post(MachineState *ms);
+#endif /* !CONFIG_USER_ONLY */
 
-AccelState *current_accel(void);
-
-#endif
+#endif /* QEMU_ACCEL_H */
diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_H
 #define HVF_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef CONFIG_HVF
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/queue.h"
 #include "hw/core/cpu.h"
 #include "exec/memattrs.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef NEED_CPU_H
diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm_int.h
+++ b/include/sysemu/kvm_int.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_KVM_INT_H
 
 #include "exec/memory.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/kvm.h"
 
 typedef struct KVMSlot
diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-i386.h
+++ b/target/i386/hvf/hvf-i386.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_I386_H
 #define HVF_I386_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/hvf.h"
 #include "cpu.h"
 #include "x86.h"
diff --git a/accel/accel-common.c b/accel/accel-common.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, components common to system emulation and user mode
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2014 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+static const TypeInfo accel_type = {
+    .name = TYPE_ACCEL,
+    .parent = TYPE_OBJECT,
+    .class_size = sizeof(AccelClass),
+    .instance_size = sizeof(AccelState),
+};
+
+/* Lookup AccelClass from opt_name. Returns NULL if not found */
+AccelClass *accel_find(const char *opt_name)
+{
+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
+    g_free(class_name);
+    return ac;
+}
+
+static void register_accel_types(void)
+{
+    type_register_static(&accel_type);
+}
+
+type_init(register_accel_types);
diff --git a/accel/accel.c b/accel/accel-softmmu.c
similarity index 75%
rename from accel/accel.c
rename to accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 /*
- * QEMU System Emulator, accelerator interfaces
+ * QEMU accel class, system emulation components
  *
  * Copyright (c) 2003-2008 Fabrice Bellard
  * Copyright (c) 2014 Red Hat Inc.
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "qom/object.h"
 
-static const TypeInfo accel_type = {
-    .name = TYPE_ACCEL,
-    .parent = TYPE_OBJECT,
-    .class_size = sizeof(AccelClass),
-    .instance_size = sizeof(AccelState),
-};
-
-/* Lookup AccelClass from opt_name. Returns NULL if not found */
-AccelClass *accel_find(const char *opt_name)
-{
-    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
-    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
-    g_free(class_name);
-    return ac;
-}
-
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
     AccelClass *acc = ACCEL_GET_CLASS(accel);
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
-
-static void register_accel_types(void)
-{
-    type_register_static(&accel_type);
-}
-
-type_init(register_accel_types);
diff --git a/accel/accel-user.c b/accel/accel-user.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-user.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, user-mode components
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+AccelState *current_accel(void)
+{
+    static AccelState *accel;
+
+    if (!accel) {
+        AccelClass *ac = accel_find("tcg");
+
+        g_assert(ac != NULL);
+        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
+    }
+    return accel;
+}
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/qtest.h"
 #include "sysemu/cpus.h"
 #include "sysemu/cpu-timers.h"
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/boards.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
+
+#ifndef CONFIG_USER_ONLY
 #include "tcg-cpus.h"
+#endif /* CONFIG_USER_ONLY */
 
 struct TCGState {
     AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
     s->mttcg_enabled = default_mttcg_enabled();
 
     /* If debugging enabled, default "auto on", otherwise off. */
-#ifdef CONFIG_DEBUG_TCG
+#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
     s->splitwx_enabled = -1;
 #else
     s->splitwx_enabled = 0;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     mttcg_enabled = s->mttcg_enabled;
 
     /*
-     * Initialize TCG regions
+     * Initialize TCG regions only for softmmu.
+     *
+     * This needs to be done later for user mode, because the prologue
+     * generation needs to be delayed so that GUEST_BASE is already set.
      */
+#ifndef CONFIG_USER_ONLY
     tcg_region_init();
 
     if (mttcg_enabled) {
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     } else {
         cpus_register_accel(&tcg_cpus_rr);
     }
+#endif /* !CONFIG_USER_ONLY */
+
     return 0;
 }
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/xen/xen-legacy-backend.h"
 #include "hw/xen/xen_pt.h"
 #include "chardev/char.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpus.h"
 #include "sysemu/xen.h"
 #include "sysemu/runstate.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <machine/trap.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     }
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <sys/syscall.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
     cpu_type = parse_cpu_option(cpu_model);
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
     cpu_reset(cpu);
diff --git a/softmmu/memory.c b/softmmu/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "sysemu/runstate.h"
 #include "sysemu/tcg.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "migration/vmstate.h"
 
diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/ioport.h"
 #include "exec/memory.h"
 #include "hw/irq.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpu-timers.h"
 #include "qemu/config-file.h"
 #include "qemu/option.h"
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/error-report.h"
 #include "qemu/sockets.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/usb.h"
 #include "hw/isa/isa.h"
 #include "hw/scsi/scsi.h"
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 #include "hvf-cpus.h"
diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86_task.c
+++ b/target/i386/hvf/x86_task.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 // TODO: taskswitch handling
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "exec/ioport.h"
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/whpx.h"
 #include "sysemu/cpus.h"
 #include "sysemu/runstate.h"
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Overall
 M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
-F: include/sysemu/accel.h
+F: include/qemu/accel.h
 F: accel/accel.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
diff --git a/accel/meson.build b/accel/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -XXX,XX +XXX,XX @@
-softmmu_ss.add(files('accel.c'))
+specific_ss.add(files('accel-common.c'))
+softmmu_ss.add(files('accel-softmmu.c'))
+user_ss.add(files('accel-user.c'))
 
 subdir('qtest')
 subdir('kvm')
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
 tcg_ss = ss.source_set()
 tcg_ss.add(files(
+  'tcg-all.c',
   'cpu-exec-common.c',
   'cpu-exec.c',
   'tcg-runtime-gvec.c',
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
-  'tcg-all.c',
   'cputlb.c',
   'tcg-cpus.c',
   'tcg-cpus-mttcg.c',
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

This will allow us to centralize the registration of
the cpus.c module accelerator operations (in accel/accel-softmmu.c),
and trigger it automatically using object hierarchy lookup from the
new accel_init_interfaces() initialization step, depending just on
which accelerators are available in the code.

Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
kvm-accel-ops.c, etc, matching the object type names.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-18-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/accel-softmmu.h                         | 15 ++++++
 accel/kvm/kvm-cpus.h                          |  2 -
 ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
 accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
 .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
 include/qemu/accel.h                          |  2 +
 include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
 include/sysemu/cpus.h                         | 26 ++--------
 .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
 target/i386/hax/hax-windows.h                 |  2 +-
 .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
 .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
 accel/accel-common.c                          | 11 +++++
 accel/accel-softmmu.c                         | 44 +++++++++++++++--
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
 accel/kvm/kvm-all.c                           |  2 -
 accel/qtest/qtest.c                           | 23 ++++++---
 ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
 ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
 .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
 accel/tcg/tcg-all.c                           | 12 -----
 accel/xen/xen-all.c                           | 24 ++++++----
 bsd-user/main.c                               |  3 +-
 linux-user/main.c                             |  1 +
 softmmu/cpus.c                                | 12 ++---
 softmmu/vl.c                                  |  7 ++-
 .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
 target/i386/hax/hax-all.c                     |  5 +-
 target/i386/hax/hax-mem.c                     |  2 +-
 target/i386/hax/hax-posix.c                   |  2 +-
 target/i386/hax/hax-windows.c                 |  2 +-
 .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
 target/i386/hvf/hvf.c                         |  3 +-
 target/i386/hvf/x86hvf.c                      |  2 +-
 .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
 target/i386/whpx/whpx-all.c                   |  7 +--
 MAINTAINERS                                   |  3 +-
 accel/kvm/meson.build                         |  2 +-
 accel/tcg/meson.build                         |  8 ++--
 target/i386/hax/meson.build                   |  2 +-
 target/i386/hvf/meson.build                   |  2 +-
 target/i386/whpx/meson.build                  |  2 +-
 44 files changed, 361 insertions(+), 163 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-softmmu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulation accel internal functions
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_SOFTMMU_H
+#define ACCEL_SOFTMMU_H
+
+void accel_init_ops_interfaces(AccelClass *ac);
+
+#endif /* ACCEL_SOFTMMU_H */
diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.h
+++ b/accel/kvm/kvm-cpus.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel kvm_cpus;
-
 int kvm_init_vcpu(CPUState *cpu, Error **errp);
 int kvm_cpu_exec(CPUState *cpu);
 void kvm_destroy_vcpu(CPUState *cpu);
diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
similarity index 88%
rename from accel/tcg/tcg-cpus-icount.h
rename to accel/tcg/tcg-accel-ops-icount.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.h
+++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
 void icount_prepare_for_run(CPUState *cpu);
 void icount_process_data(CPUState *cpu);
 
+void icount_handle_interrupt(CPUState *cpu, int mask);
+
 #endif /* TCG_CPUS_ICOUNT_H */
diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU TCG Multi Threaded vCPUs implementation
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPUS_MTTCG_H
+#define TCG_CPUS_MTTCG_H
+
+/* kick MTTCG vCPU thread */
+void mttcg_kick_vcpu_thread(CPUState *cpu);
+
+/* start an mttcg vCPU thread */
+void mttcg_start_vcpu_thread(CPUState *cpu);
+
+#endif /* TCG_CPUS_MTTCG_H */
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
similarity index 100%
rename from accel/tcg/tcg-cpus-rr.h
rename to accel/tcg/tcg-accel-ops-rr.h
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
similarity index 72%
rename from accel/tcg/tcg-cpus.h
rename to accel/tcg/tcg-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.h
+++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel tcg_cpus_mttcg;
-extern const CpusAccel tcg_cpus_icount;
-extern const CpusAccel tcg_cpus_rr;
-
 void tcg_cpus_destroy(CPUState *cpu);
 int tcg_cpus_exec(CPUState *cpu);
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
+void tcg_handle_interrupt(CPUState *cpu, int mask);
 
 #endif /* TCG_CPUS_H */
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
 AccelClass *accel_find(const char *opt_name);
 AccelState *current_accel(void);
 
+void accel_init_interfaces(AccelClass *ac);
+
 #ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator OPS, used for cpus.c module
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_OPS_H
+#define ACCEL_OPS_H
+
+#include "qom/object.h"
+
+#define ACCEL_OPS_SUFFIX "-ops"
+#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
+#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
+
+typedef struct AccelOpsClass AccelOpsClass;
+DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
+
+/* cpus.c operations interface */
+struct AccelOpsClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    /* initialization function called when accel is chosen */
+    void (*ops_init)(AccelOpsClass *ops);
+
+    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
+    void (*kick_vcpu_thread)(CPUState *cpu);
+
+    void (*synchronize_post_reset)(CPUState *cpu);
+    void (*synchronize_post_init)(CPUState *cpu);
+    void (*synchronize_state)(CPUState *cpu);
+    void (*synchronize_pre_loadvm)(CPUState *cpu);
+
+    void (*handle_interrupt)(CPUState *cpu, int mask);
+
+    int64_t (*get_virtual_clock)(void);
+    int64_t (*get_elapsed_ticks)(void);
+};
+
+#endif /* ACCEL_OPS_H */
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_CPUS_H
 
 #include "qemu/timer.h"
+#include "sysemu/accel-ops.h"
 
-/* cpus.c */
+/* register accel-specific operations */
+void cpus_register_accel(const AccelOpsClass *i);
 
-/* CPU execution threads */
+/* accel/dummy-cpus.c */
 
-typedef struct CpusAccel {
-    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
-    void (*kick_vcpu_thread)(CPUState *cpu);
-
-    void (*synchronize_post_reset)(CPUState *cpu);
-    void (*synchronize_post_init)(CPUState *cpu);
-    void (*synchronize_state)(CPUState *cpu);
-    void (*synchronize_pre_loadvm)(CPUState *cpu);
-
-    void (*handle_interrupt)(CPUState *cpu, int mask);
-
-    int64_t (*get_virtual_clock)(void);
-    int64_t (*get_elapsed_ticks)(void);
-} CpusAccel;
-
-/* register accel-specific cpus interface implementation */
-void cpus_register_accel(const CpusAccel *i);
-
-/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
+/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
 void dummy_start_vcpu_thread(CPUState *);
 
 /* interface available for cpus accelerator threads */
diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
similarity index 95%
rename from target/i386/hax/hax-cpus.h
rename to target/i386/hax/hax-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.h
+++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hax_cpus;
-
 #include "hax-interface.h"
 #include "hax-i386.h"
 
diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.h
+++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
 #include <winioctl.h>
 #include <windef.h>
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 
diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
similarity index 94%
rename from target/i386/hvf/hvf-cpus.h
rename to target/i386/hvf/hvf-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.h
+++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hvf_cpus;
-
 int hvf_init_vcpu(CPUState *);
 int hvf_vcpu_exec(CPUState *);
 void hvf_cpu_synchronize_state(CPUState *);
diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
similarity index 96%
rename from target/i386/whpx/whpx-cpus.h
rename to target/i386/whpx/whpx-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.h
+++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel whpx_cpus;
-
 int whpx_init_vcpu(CPUState *cpu);
 int whpx_vcpu_exec(CPUState *cpu);
 void whpx_destroy_vcpu(CPUState *cpu);
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#ifndef CONFIG_USER_ONLY
+#include "accel-softmmu.h"
+#endif /* !CONFIG_USER_ONLY */
+
 static const TypeInfo accel_type = {
     .name = TYPE_ACCEL,
     .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+void accel_init_interfaces(AccelClass *ac)
+{
+#ifndef CONFIG_USER_ONLY
+    accel_init_ops_interfaces(ac);
+#endif /* !CONFIG_USER_ONLY */
+}
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-softmmu.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
-#include "sysemu/arch_init.h"
-#include "sysemu/sysemu.h"
-#include "qom/object.h"
+#include "sysemu/cpus.h"
+
+#include "accel-softmmu.h"
 
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
+
+/* initialize the arch-independent accel operation interfaces */
+void accel_init_ops_interfaces(AccelClass *ac)
+{
+    const char *ac_name;
+    char *ops_name;
+    AccelOpsClass *ops;
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
+    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
+    g_free(ops_name);
+
+    /*
+     * all accelerators need to define ops, providing at least a mandatory
+     * non-NULL create_vcpu_thread operation.
+     */
+    g_assert(ops != NULL);
+    if (ops->ops_init) {
+        ops->ops_init(ops);
+    }
+    cpus_register_accel(ops);
+}
+
+static const TypeInfo accel_ops_type_info = {
+    .name = TYPE_ACCEL_OPS,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelOpsClass),
+};
+
+static void accel_softmmu_register_types(void)
+{
+    type_register_static(&accel_ops_type_info);
+}
+type_init(accel_softmmu_register_types);
diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
similarity index 72%
rename from accel/kvm/kvm-cpus.c
rename to accel/kvm/kvm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel kvm_cpus = {
-    .create_vcpu_thread = kvm_start_vcpu_thread,
+static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
-    .synchronize_post_init = kvm_cpu_synchronize_post_init,
-    .synchronize_state = kvm_cpu_synchronize_state,
-    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = kvm_start_vcpu_thread;
+    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
+    ops->synchronize_state = kvm_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo kvm_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("kvm"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = kvm_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void kvm_accel_ops_register_types(void)
+{
+    type_register_static(&kvm_accel_ops_type);
+}
+type_init(kvm_accel_ops_register_types);
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
         ret = ram_block_discard_disable(true);
         assert(!ret);
     }
-
-    cpus_register_accel(&kvm_cpus);
     return 0;
 
 err:
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
 
-const CpusAccel qtest_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-    .get_virtual_clock = qtest_get_virtual_clock,
-};
-
 static int qtest_init_accel(MachineState *ms)
 {
-    cpus_register_accel(&qtest_cpus);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
     .class_init = qtest_accel_class_init,
 };
 
+static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->get_virtual_clock = qtest_get_virtual_clock;
+};
+
+static const TypeInfo qtest_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("qtest"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = qtest_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void qtest_type_init(void)
 {
     type_register_static(&qtest_accel_type);
+    type_register_static(&qtest_accel_ops_type);
 }
 
 type_init(qtest_type_init);
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
similarity index 89%
rename from accel/tcg/tcg-cpus-icount.c
rename to accel/tcg/tcg-accel-ops-icount.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-icount.h"
-#include "tcg-cpus-rr.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-icount.h"
+#include "tcg-accel-ops-rr.h"
 
 static int64_t icount_get_limit(void)
 {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
     /*
      * These should always be cleared by icount_process_data after
      * each vCPU execution. However u16.high can be raised
-     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
+     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
      */
     g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
     g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
     replay_mutex_unlock();
 }
 
-static void icount_handle_interrupt(CPUState *cpu, int mask)
+void icount_handle_interrupt(CPUState *cpu, int mask)
 {
     int old_mask = cpu->interrupt_request;
 
-    tcg_cpus_handle_interrupt(cpu, mask);
+    tcg_handle_interrupt(cpu, mask);
     if (qemu_cpu_is_self(cpu) &&
         !cpu->can_do_io
         && (mask & ~old_mask) != 0) {
         cpu_abort(cpu, "Raised interrupt while not in I/O function");
     }
 }
-
-const CpusAccel tcg_cpus_icount = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = icount_handle_interrupt,
-    .get_virtual_clock = icount_get,
-    .get_elapsed_ticks = icount_get,
-};
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
similarity index 92%
rename from accel/tcg/tcg-cpus-mttcg.c
rename to accel/tcg/tcg-accel-ops-mttcg.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
 
 /*
  * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
     return NULL;
 }
 
-static void mttcg_kick_vcpu_thread(CPUState *cpu)
+void mttcg_kick_vcpu_thread(CPUState *cpu)
 {
     cpu_exit(cpu);
 }
 
-static void mttcg_start_vcpu_thread(CPUState *cpu)
+void mttcg_start_vcpu_thread(CPUState *cpu)
 {
     char thread_name[VCPU_THREAD_NAME_SIZE];
 
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
     cpu->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
 }
-
-const CpusAccel tcg_cpus_mttcg = {
-    .create_vcpu_thread = mttcg_start_vcpu_thread,
-    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
similarity index 97%
rename from accel/tcg/tcg-cpus-rr.c
rename to accel/tcg/tcg-accel-ops-rr.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-rr.h"
-#include "tcg-cpus-icount.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* Kick all RR vCPUs */
 void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
         cpu->created = true;
     }
 }
-
-const CpusAccel tcg_cpus_rr = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
similarity index 63%
rename from accel/tcg/tcg-cpus.c
rename to accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* common functionality among all TCG variants */
 
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
 }
 
 /* mask must never be zero, except for A20 change call */
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
+void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
     g_assert(qemu_mutex_iothread_locked());
 
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
         qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
     }
 }
+
+static void tcg_accel_ops_init(AccelOpsClass *ops)
+{
+    if (qemu_tcg_mttcg_enabled()) {
+        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
+        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    } else if (icount_enabled()) {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = icount_handle_interrupt;
+        ops->get_virtual_clock = icount_get;
+        ops->get_elapsed_ticks = icount_get;
+    } else {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    }
+}
+
+static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->ops_init = tcg_accel_ops_init;
+}
+
+static const TypeInfo tcg_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("tcg"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = tcg_accel_ops_class_init,
+    .abstract = true,
+};
+
+static void tcg_accel_ops_register_types(void)
+{
+    type_register_static(&tcg_accel_ops_type);
+}
+type_init(tcg_accel_ops_register_types);
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
 
-#ifndef CONFIG_USER_ONLY
-#include "tcg-cpus.h"
-#endif /* CONFIG_USER_ONLY */
-
 struct TCGState {
     AccelState parent_obj;
 
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      */
 #ifndef CONFIG_USER_ONLY
     tcg_region_init();
-
-    if (mttcg_enabled) {
-        cpus_register_accel(&tcg_cpus_mttcg);
-    } else if (icount_enabled()) {
-        cpus_register_accel(&tcg_cpus_icount);
-    } else {
-        cpus_register_accel(&tcg_cpus_rr);
-    }
 #endif /* !CONFIG_USER_ONLY */
 
     return 0;
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
     }
 }
 
-const CpusAccel xen_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-};
-
 static int xen_init(MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
      * opt out of system RAM being allocated by generic code
      */
     mc->default_ram_id = NULL;
-
-    cpus_register_accel(&xen_cpus);
-
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
+static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+}
+
+static const TypeInfo xen_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("xen"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = xen_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void xen_type_init(void)
 {
     type_register_static(&xen_accel_type);
+    type_register_static(&xen_accel_ops_type);
 }
-
 type_init(xen_type_init);
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 #endif
     }
 
+    cpu_type = parse_cpu_option(cpu_model);
     /* init tcg before creating CPUs and to get qemu_host_page_size */
     {
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
-    cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
 /*
  * The chosen accelerator is supposed to register this.
  */
-static const CpusAccel *cpus_accel;
+static const AccelOpsClass *cpus_accel;
 
 void cpu_synchronize_all_states(void)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
     qemu_mutex_lock_iothread();
 }
 
-void cpus_register_accel(const CpusAccel *ca)
+void cpus_register_accel(const AccelOpsClass *ops)
 {
-    assert(ca != NULL);
-    assert(ca->create_vcpu_thread != NULL); /* mandatory */
-    cpus_accel = ca;
+    assert(ops != NULL);
+    assert(ops->create_vcpu_thread != NULL); /* mandatory */
+    cpus_accel = ops;
 }
 
 void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
         cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
     }
 
-    /* accelerators all implement the CpusAccel interface */
+    /* accelerators all implement the AccelOpsClass */
     g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
     cpus_accel->create_vcpu_thread(cpu);
 
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
         return false;
     }
 
-    /* Allocation of large amounts of memory may delay
+    /*
+     * Allocation of large amounts of memory may delay
      * chardev initialization for too long, and trigger timeouts
      * on software that waits for a monitor socket to be created
      * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      *
      * Machine compat properties: object_set_machine_compat_props().
      * Accelerator compat props: object_set_accelerator_compat_props(),
-     * called from configure_accelerator().
+     * called from do_configure_accelerator().
      */
 
     machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
     if (cpu_option) {
         current_machine->cpu_type = parse_cpu_option(cpu_option);
     }
+    /* NB: for machine none cpu_type could STILL be NULL here! */
+    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
 
     qemu_resolve_machine_memdev();
     parse_numa_opts(current_machine);
diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
similarity index 69%
rename from target/i386/hax/hax-cpus.c
rename to target/i386/hax/hax-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/cpus.h"
 #include "qemu/guest-random.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 static void *hax_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
 #endif
 }
 
-const CpusAccel hax_cpus = {
-    .create_vcpu_thread = hax_start_vcpu_thread,
-    .kick_vcpu_thread = hax_kick_vcpu_thread,
+static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
-    .synchronize_post_init = hax_cpu_synchronize_post_init,
-    .synchronize_state = hax_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hax_start_vcpu_thread;
+    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
+    ops->synchronize_state = hax_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo hax_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hax"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hax_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void hax_accel_ops_register_types(void)
+{
+    type_register_static(&hax_accel_ops_type);
+}
+type_init(hax_accel_ops_register_types);
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define DEBUG_HAX 0
 
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                 !ret ? "working" : "not working",
                 !ret ? "fast virt" : "emulation");
     }
-    if (ret == 0) {
-        cpus_register_accel(&hax_cpus);
-    }
     return ret;
 }
 
diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-mem.c
+++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/error-report.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 #include "qemu/queue.h"
 
 #define DEBUG_HAX_MEM 0
diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-posix.c
+++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/ioctl.h>
 
 #include "sysemu/cpus.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 hax_fd hax_mod_open(void)
 {
diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.c
+++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 /*
  * return 0 when success, -1 when driver not loaded,
diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
similarity index 84%
rename from target/i386/hvf/hvf-cpus.c
rename to target/i386/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.c
+++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "target/i386/cpu.h"
 #include "qemu/guest-random.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 /*
  * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel hvf_cpus = {
-    .create_vcpu_thread = hvf_start_vcpu_thread,
+static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
-    .synchronize_post_init = hvf_cpu_synchronize_post_init,
-    .synchronize_state = hvf_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hvf_start_vcpu_thread;
+
+    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
+    ops->synchronize_state = hvf_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
 };
+static const TypeInfo hvf_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hvf"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hvf_accel_ops_class_init,
+    .abstract = true,
+};
+static void hvf_accel_ops_register_types(void)
+{
+    type_register_static(&hvf_accel_ops_type);
+}
+type_init(hvf_accel_ops_register_types);
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 HVFState *hvf_state;
 
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
   
     hvf_state = s;
     memory_listener_register(&hvf_memory_listener, &address_space_memory);
-    cpus_register_accel(&hvf_cpus);
     return 0;
 }
 
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
 #include <Hypervisor/hv.h>
 #include <Hypervisor/hv_vmx.h>
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr)
diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
similarity index 71%
rename from target/i386/whpx/whpx-cpus.c
rename to target/i386/whpx/whpx-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/whpx.h"
 #include "whpx-internal.h"
-#include "whpx-cpus.h"
+#include "whpx-accel-ops.h"
 
 static void *whpx_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
     }
 }
 
-const CpusAccel whpx_cpus = {
-    .create_vcpu_thread = whpx_start_vcpu_thread,
-    .kick_vcpu_thread = whpx_kick_vcpu_thread,
+static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
-    .synchronize_post_init = whpx_cpu_synchronize_post_init,
-    .synchronize_state = whpx_cpu_synchronize_state,
-    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = whpx_start_vcpu_thread;
+    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
+    ops->synchronize_state = whpx_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo whpx_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("whpx"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = whpx_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void whpx_accel_ops_register_types(void)
+{
+    type_register_static(&whpx_accel_ops_type);
+}
+type_init(whpx_accel_ops_register_types);
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/blocker.h"
 #include <winerror.h>
 
-#include "whpx-cpus.h"
 #include "whpx-internal.h"
+#include "whpx-accel-ops.h"
+
+#include <WinHvPlatform.h>
+#include <WinHvEmulation.h>
 
 #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
 
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
 
     whpx_memory_init();
 
-    cpus_register_accel(&whpx_cpus);
-
     printf("Windows Hypervisor Platform accelerator is operational\n");
     return 0;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
-F: accel/accel.c
+F: include/sysemu/accel-ops.h
+F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 
diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/meson.build
+++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
 kvm_ss = ss.source_set()
 kvm_ss.add(files(
   'kvm-all.c',
-  'kvm-cpus.c',
+  'kvm-accel-ops.c',
 ))
 kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
-  'tcg-cpus.c',
-  'tcg-cpus-mttcg.c',
-  'tcg-cpus-icount.c',
-  'tcg-cpus-rr.c'
+  'tcg-accel-ops.c',
+  'tcg-accel-ops-mttcg.c',
+  'tcg-accel-ops-icount.c',
+  'tcg-accel-ops-rr.c'
 ))
diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/meson.build
+++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
   'hax-all.c',
   'hax-mem.c',
-  'hax-cpus.c',
+  'hax-accel-ops.c',
 ))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/meson.build
+++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
   'hvf.c',
-  'hvf-cpus.c',
+  'hvf-accel-ops.c',
   'x86.c',
   'x86_cpuid.c',
   'x86_decode.c',
diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/meson.build
+++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
   'whpx-all.c',
   'whpx-apic.c',
-  'whpx-cpus.c',
+  'whpx-accel-ops.c',
 ))
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

add a new optional interface to CPUClass, which allows accelerators
to extend the CPUClass with additional accelerator-specific
initializations.

This will allow to separate the target cpu code that is specific
to each accelerator, and register it automatically with object
hierarchy lookup depending on accelerator code availability,
as part of the accel_init_interfaces() initialization step.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-19-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
 include/hw/core/cpu.h       |  4 ++++
 accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
 MAINTAINERS                 |  1 +
 4 files changed, 87 insertions(+)
 create mode 100644 include/hw/core/accel-cpu.h

diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/accel-cpu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator interface, specializes CPUClass
+ * This header is used only by target-specific code.
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_CPU_H
+#define ACCEL_CPU_H
+
+/*
+ * This header is used to define new accelerator-specific target-specific
+ * accelerator cpu subclasses.
+ * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
+ *
+ * Do not try to use for any other purpose than the implementation of new
+ * subclasses in target/, or the accel implementation itself in accel/
+ */
+
+#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
+#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
+typedef struct AccelCPUClass AccelCPUClass;
+DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
+
+typedef struct AccelCPUClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    void (*cpu_class_init)(CPUClass *cc);
+    void (*cpu_instance_init)(CPUState *cpu);
+    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
+} AccelCPUClass;
+
+#endif /* ACCEL_CPU_H */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
 /* see tcg-cpu-ops.h */
 struct TCGCPUOps;
 
+/* see accel-cpu.h */
+struct AccelCPUClass;
+
 /**
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
+    struct AccelCPUClass *accel_cpu;
 
     /* when TCG is not available, this pointer is NULL */
     struct TCGCPUOps *tcg_ops;
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#include "cpu.h"
+#include "hw/core/accel-cpu.h"
+
 #ifndef CONFIG_USER_ONLY
 #include "accel-softmmu.h"
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+{
+    CPUClass *cc = CPU_CLASS(klass);
+    AccelCPUClass *accel_cpu = opaque;
+
+    cc->accel_cpu = accel_cpu;
+    if (accel_cpu->cpu_class_init) {
+        accel_cpu->cpu_class_init(cc);
+    }
+}
+
+/* initialize the arch-specific accel CpuClass interfaces */
+static void accel_init_cpu_interfaces(AccelClass *ac)
+{
+    const char *ac_name; /* AccelClass name */
+    char *acc_name;      /* AccelCPUClass name */
+    ObjectClass *acc;    /* AccelCPUClass */
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
+    acc = object_class_by_name(acc_name);
+    g_free(acc_name);
+
+    if (acc) {
+        object_class_foreach(accel_init_cpu_int_aux,
+                             CPU_RESOLVING_TYPE, false, acc);
+    }
+}
+
 void accel_init_interfaces(AccelClass *ac)
 {
 #ifndef CONFIG_USER_ONLY
     accel_init_ops_interfaces(ac);
 #endif /* !CONFIG_USER_ONLY */
+
+    accel_init_cpu_interfaces(ac);
 }
 
+static const TypeInfo accel_cpu_type = {
+    .name = TYPE_ACCEL_CPU,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelCPUClass),
+};
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
+    type_register_static(&accel_cpu_type);
 }
 
 type_init(register_accel_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
 F: include/sysemu/accel-ops.h
+F: include/hw/core/accel-cpu.h
 F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
-- 
2.25.1

The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

----------------------------------------------------------------
Respect PROT_EXEC in user-only mode.
Fix s390x, i386 and riscv for translations crossing a page.

----------------------------------------------------------------
Ilya Leoshkevich (4):
      linux-user: Clear translations on mprotect()
      accel/tcg: Introduce is_same_page()
      target/s390x: Make translator stop before the end of a page
      target/i386: Make translator stop before the end of a page

Richard Henderson (16):
      linux-user/arm: Mark the commpage executable
      linux-user/hppa: Allocate page zero as a commpage
      linux-user/x86_64: Allocate vsyscall page as a commpage
      linux-user: Honor PT_GNU_STACK
      tests/tcg/i386: Move smc_code2 to an executable section
      accel/tcg: Properly implement get_page_addr_code for user-only
      accel/tcg: Unlock mmap_lock after longjmp
      accel/tcg: Make tb_htable_lookup static
      accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
      accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
      accel/tcg: Document the faulting lookup in tb_lookup_cmp
      accel/tcg: Remove translator_ldsw
      accel/tcg: Add pc and host_pc params to gen_intermediate_code
      accel/tcg: Add fast path for translator_ld*
      target/riscv: Add MAX_INSN_LEN and insn_len
      target/riscv: Make translator stop before the end of a page

include/elf.h                     |   1 +
 include/exec/cpu-common.h         |   1 +
 include/exec/exec-all.h           |  89 ++++++++----------------
 include/exec/translator.h         |  96 ++++++++++++++++---------
 linux-user/arm/target_cpu.h       |   4 +-
 linux-user/qemu.h                 |   1 +
 accel/tcg/cpu-exec.c              | 143 ++++++++++++++++++++------------------
 accel/tcg/cputlb.c                |  93 +++++++------------------
 accel/tcg/translate-all.c         |  29 ++++----
 accel/tcg/translator.c            | 135 ++++++++++++++++++++++++++---------
 accel/tcg/user-exec.c             |  17 ++++-
 linux-user/elfload.c              |  82 ++++++++++++++++++++--
 linux-user/mmap.c                 |   6 +-
 softmmu/physmem.c                 |  12 ++++
 target/alpha/translate.c          |   5 +-
 target/arm/translate.c            |   5 +-
 target/avr/translate.c            |   5 +-
 target/cris/translate.c           |   5 +-
 target/hexagon/translate.c        |   6 +-
 target/hppa/translate.c           |   5 +-
 target/i386/tcg/translate.c       |  71 +++++++++++--------
 target/loongarch/translate.c      |   6 +-
 target/m68k/translate.c           |   5 +-
 target/microblaze/translate.c     |   5 +-
 target/mips/tcg/translate.c       |   5 +-
 target/nios2/translate.c          |   5 +-
 target/openrisc/translate.c       |   6 +-
 target/ppc/translate.c            |   5 +-
 target/riscv/translate.c          |  32 +++++++--
 target/rx/translate.c             |   5 +-
 target/s390x/tcg/translate.c      |  20 ++++--
 target/sh4/translate.c            |   5 +-
 target/sparc/translate.c          |   5 +-
 target/tricore/translate.c        |   6 +-
 target/xtensa/translate.c         |   6 +-
 tests/tcg/i386/test-i386.c        |   2 +-
 tests/tcg/riscv64/noexec.c        |  79 +++++++++++++++++++++
 tests/tcg/s390x/noexec.c          | 106 ++++++++++++++++++++++++++++
 tests/tcg/x86_64/noexec.c         |  75 ++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc  | 139 ++++++++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |   1 +
 tests/tcg/s390x/Makefile.target   |   1 +
 tests/tcg/x86_64/Makefile.target  |   3 +-
 43 files changed, 966 insertions(+), 367 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/x86_64/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

We're about to start validating PAGE_EXEC, which means
that we've got to mark the commpage executable.  We had
been placing the commpage outside of reserved_va, which
was incorrect and lead to an abort.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_cpu.h | 4 ++--
 linux-user/elfload.c        | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_cpu.h
+++ b/linux-user/arm/target_cpu.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
     } else {
         /*
          * We need to be able to map the commpage.
-         * See validate_guest_space in linux-user/elfload.c.
+         * See init_guest_commpage in linux-user/elfload.c.
          */
-        return 0xffff0000ul;
+        return 0xfffffffful;
     }
 }
 #define MAX_RESERVED_VA  arm_max_reserved_va
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
+    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
+    void *want = g2h_untagged(commpage);
     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
         perror("Protecting guest commpage");
         exit(EXIT_FAILURE);
     }
+
+    page_set_flags(commpage, commpage + qemu_host_page_size,
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
     return true;
 }
 
-- 
2.34.1

While there are no target-specific nonfaulting probes,
generic code may grow some uses at some point.

Note that the attrs argument was incorrect -- it should have
been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    int prot = 0;
-    MemTxAttrs attrs = {};
+    int prot, page_size = TARGET_PAGE_SIZE;
     uint32_t paddr;
 
     address &= TARGET_PAGE_MASK;
 
     if (mmu_idx == MMU_CODE_IDX) {
-        /* access to code in flash */
+        /* Access to code in flash. */
         paddr = OFFSET_CODE + address;
         prot = PAGE_READ | PAGE_EXEC;
-        if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
+        if (paddr >= OFFSET_DATA) {
+            /*
+             * This should not be possible via any architectural operations.
+             * There is certainly not an exception that we can deliver.
+             * Accept probing that might come from generic code.
+             */
+            if (probe) {
+                return false;
+            }
             error_report("execution left flash memory");
             abort();
         }
-    } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /*
-         * access to CPU registers, exit and rebuilt this TB to use full access
-         * incase it touches specially handled registers like SREG or SP
-         */
-        AVRCPU *cpu = AVR_CPU(cs);
-        CPUAVRState *env = &cpu->env;
-        env->fullacc = 1;
-        cpu_loop_exit_restore(cs, retaddr);
     } else {
-        /* access to memory. nothing special */
+        /* Access to memory. */
         paddr = OFFSET_DATA + address;
         prot = PAGE_READ | PAGE_WRITE;
+        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
+            /*
+             * Access to CPU registers, exit and rebuilt this TB to use
+             * full access in case it touches specially handled registers
+             * like SREG or SP.  For probing, set page_size = 1, in order
+             * to force tlb_fill to be called for the next access.
+             */
+            if (probe) {
+                page_size = 1;
+            } else {
+                AVRCPU *cpu = AVR_CPU(cs);
+                CPUAVRState *env = &cpu->env;
+                env->fullacc = 1;
+                cpu_loop_exit_restore(cs, retaddr);
+            }
+        }
     }
 
-    tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
-                            mmu_idx, TARGET_PAGE_SIZE);
-
+    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
     return true;
 }
 
-- 
2.34.1

There is no need to go through cc->tcg_ops when
we know what value that must have.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     bool ret = false;
-    CPUClass *cc = CPU_GET_CLASS(cs);
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops->do_interrupt(cs);
+            avr_cpu_do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             if (!env->intsrc) {
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark page zero executable.  We had been special casing this
entirely within translate.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
     regs->gr[31] = infop->entry;
 }
 
+#define LO_COMMPAGE  0
+
+static bool init_guest_commpage(void)
+{
+    void *want = g2h_untagged(LO_COMMPAGE);
+    void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
+                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    if (addr == MAP_FAILED) {
+        perror("Allocating guest commpage");
+        exit(EXIT_FAILURE);
+    }
+    if (addr != want) {
+        return false;
+    }
+
+    /*
+     * On Linux, page zero is normally marked execute only + gateway.
+     * Normal read or write is supposed to fail (thus PROT_NONE above),
+     * but specific offsets have kernel code mapped to raise permissions
+     * and implement syscalls.  Here, simply mark the page executable.
+     * Special case the entry points during translation (see do_page_zero).
+     */
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 #endif /* TARGET_HPPA */
 
 #ifdef TARGET_XTENSA
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 }
 
 #if defined(HI_COMMPAGE)
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #elif defined(LO_COMMPAGE)
 #define HI_COMMPAGE 0
 #else
 #define HI_COMMPAGE 0
-#define LO_COMMPAGE 0
+#define LO_COMMPAGE -1
 #define init_guest_commpage() true
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
         } else {
             offset = -(HI_COMMPAGE & -align);
         }
-    } else if (LO_COMMPAGE != 0) {
+    } else if (LO_COMMPAGE != -1) {
         loaddr = MIN(loaddr, LO_COMMPAGE & -align);
     }
 
-- 
2.34.1

We're about to start validating PAGE_EXEC, which means that we've
got to mark the vsyscall page executable.  We had been special
casing this entirely within translate.

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
 }
 
+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
+#define INIT_GUEST_COMMPAGE
+static bool init_guest_commpage(void)
+{
+    /*
+     * The vsyscall page is at a high negative address aka kernel space,
+     * which means that we cannot actually allocate it with target_mmap.
+     * We still should be able to use page_set_flags, unless the user
+     * has specified -R reserved_va, which would trigger an assert().
+     */
+    if (reserved_va != 0 &&
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
+        error_report("Cannot allocate vsyscall page");
+        exit(EXIT_FAILURE);
+    }
+    page_set_flags(TARGET_VSYSCALL_PAGE,
+                   TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+#endif
 #else
 
 #define ELF_START_MMAP 0x80000000
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #else
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
+#ifndef INIT_GUEST_COMMPAGE
 #define init_guest_commpage() true
 #endif
+#endif
 
 static void pgb_fail_in_use(const char *image_name)
 {
-- 
2.34.1

We cannot deliver two interrupts simultaneously;
the first interrupt handler must execute first.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

This bit is not saved across interrupts, so we must
delay delivering the interrupt until the skip has
been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c    |  9 +++++++++
 target/avr/translate.c | 26 ++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
+    /*
+     * We cannot separate a skip from the next instruction,
+     * as the skip would not be preserved across the interrupt.
+     * Separating the two insn normally only happens at page boundaries.
+     */
+    if (env->skip) {
+        return false;
+    }
+
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     if (skip_label) {
         canonicalize_skip(ctx);
         gen_set_label(skip_label);
-        if (ctx->base.is_jmp == DISAS_NORETURN) {
+
+        switch (ctx->base.is_jmp) {
+        case DISAS_NORETURN:
             ctx->base.is_jmp = DISAS_CHAIN;
+            break;
+        case DISAS_NEXT:
+            if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
+                ctx->base.is_jmp = DISAS_TOO_MANY;
+            }
+            break;
+        default:
+            break;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     bool nonconst_skip = canonicalize_skip(ctx);
+    /*
+     * Because we disable interrupts while env->skip is set,
+     * we must return to the main loop to re-evaluate afterward.
+     */
+    bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
 
     switch (ctx->base.is_jmp) {
     case DISAS_NORETURN:
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
     case DISAS_CHAIN:
-        if (!nonconst_skip) {
+        if (!nonconst_skip && !force_exit) {
             /* Note gen_goto_tb checks singlestep.  */
             gen_goto_tb(ctx, 1, ctx->npc);
             break;
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
         tcg_gen_movi_tl(cpu_pc, ctx->npc);
         /* fall through */
     case DISAS_LOOKUP:
-        tcg_gen_lookup_and_goto_ptr();
-        break;
+        if (!force_exit) {
+            tcg_gen_lookup_and_goto_ptr();
+            break;
+        }
+        /* fall through */
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;
-- 
2.34.1

Map the stack executable if required by default or on demand.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/elf.h        |  1 +
 linux-user/qemu.h    |  1 +
 linux-user/elfload.c | 19 ++++++++++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/elf.h b/include/elf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -XXX,XX +XXX,XX @@ typedef int64_t  Elf64_Sxword;
 #define PT_LOPROC  0x70000000
 #define PT_HIPROC  0x7fffffff
 
+#define PT_GNU_STACK      (PT_LOOS + 0x474e551)
 #define PT_GNU_PROPERTY   (PT_LOOS + 0x474e553)
 
 #define PT_MIPS_REGINFO   0x70000000
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -XXX,XX +XXX,XX @@ struct image_info {
         uint32_t        elf_flags;
         int             personality;
         abi_ulong       alignment;
+        bool            exec_stack;
 
         /* Generic semihosting knows about these pointers. */
         abi_ulong       arg_strings;   /* strings for argv */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
 #define ELF_ARCH        EM_386
 
 #define ELF_PLATFORM get_elf_platform()
+#define EXSTACK_DEFAULT true
 
 static const char *get_elf_platform(void)
 {
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #define ELF_ARCH        EM_ARM
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #else
 
 #define ELF_CLASS       ELFCLASS32
+#define EXSTACK_DEFAULT true
 
 #endif
 
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define ELF_CLASS   ELFCLASS64
 #define ELF_ARCH    EM_LOONGARCH
+#define EXSTACK_DEFAULT true
 
 #define elf_check_arch(x) ((x) == EM_LOONGARCH)
 
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 #define ELF_CLASS   ELFCLASS32
 #endif
 #define ELF_ARCH    EM_MIPS
+#define EXSTACK_DEFAULT true
 
 #ifdef TARGET_ABI_MIPSN32
 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
 #define bswaptls(ptr) bswap32s(ptr)
 #endif
 
+#ifndef EXSTACK_DEFAULT
+#define EXSTACK_DEFAULT false
+#endif
+
 #include "elf.h"
 
 /* We must delay the following stanzas until after "elf.h". */
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
                                  struct image_info *info)
 {
     abi_ulong size, error, guard;
+    int prot;
 
     size = guest_stack_size;
     if (size < STACK_LOWER_LIMIT) {
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
         guard = qemu_real_host_page_size();
     }
 
-    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
+    prot = PROT_READ | PROT_WRITE;
+    if (info->exec_stack) {
+        prot |= PROT_EXEC;
+    }
+    error = target_mmap(0, size + guard, prot,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
     if (error == -1) {
         perror("mmap stack");
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
      */
     loaddr = -1, hiaddr = 0;
     info->alignment = 0;
+    info->exec_stack = EXSTACK_DEFAULT;
     for (i = 0; i < ehdr->e_phnum; ++i) {
         struct elf_phdr *eppnt = phdr + i;
         if (eppnt->p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
                 goto exit_errmsg;
             }
+        } else if (eppnt->p_type == PT_GNU_STACK) {
+            info->exec_stack = eppnt->p_flags & PF_X;
         }
     }
 
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Introduce a function that checks whether a given address is on the same
page as where disassembly started. Having it improves readability of
the following patches.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Make the DisasContextBase parameter const.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
 
 #undef GEN_TRANSLATOR_LD
 
+/*
+ * Return whether addr is on the same page as where disassembly started.
+ * Translators can use this to enforce the rule that only single-insn
+ * translation blocks are allowed to cross page boundaries.
+ */
+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
+{
+    return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
+}
+
 #endif /* EXEC__TRANSLATOR_H */
-- 
2.34.1

The current implementation is a no-op, simply returning addr.
This is incorrect, because we ought to be checking the page
permissions for execution.

Make get_page_addr_code inline for both implementations.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 85 ++++++++++++++---------------------------
 accel/tcg/cputlb.c      |  5 ---
 accel/tcg/user-exec.c   | 14 +++++++
 3 files changed, 42 insertions(+), 62 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 #endif
 
-#if defined(CONFIG_USER_ONLY)
-void mmap_lock(void);
-void mmap_unlock(void);
-bool have_mmap_lock(void);
-
 /**
- * get_page_addr_code() - user-mode version
+ * get_page_addr_code_hostp()
  * @env: CPUArchState
  * @addr: guest virtual address of guest code
  *
- * Returns @addr.
+ * See get_page_addr_code() (full-system version) for documentation on the
+ * return value.
+ *
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ * to the host address where @addr's content is kept.
+ *
+ * Note: this function can trigger an exception.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp);
+
+/**
+ * get_page_addr_code()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * If we cannot translate and execute from the entire RAM page, or if
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+ * ram_addr_t corresponding to the guest code at @addr.
+ *
+ * Note: this function can trigger an exception.
  */
 static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
                                                 target_ulong addr)
 {
-    return addr;
+    return get_page_addr_code_hostp(env, addr, NULL);
 }
 
-/**
- * get_page_addr_code_hostp() - user-mode version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * Returns @addr.
- *
- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
- * is kept.
- */
-static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
-                                                      target_ulong addr,
-                                                      void **hostp)
-{
-    if (hostp) {
-        *hostp = g2h_untagged(addr);
-    }
-    return addr;
-}
+#if defined(CONFIG_USER_ONLY)
+void mmap_lock(void);
+void mmap_unlock(void);
+bool have_mmap_lock(void);
 
 /**
  * adjust_signal_pc:
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
 
-/**
- * get_page_addr_code() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * If we cannot translate and execute from the entire RAM page, or if
- * the region is not backed by RAM, returns -1. Otherwise, returns the
- * ram_addr_t corresponding to the guest code at @addr.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
-
-/**
- * get_page_addr_code_hostp() - full-system version
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * See get_page_addr_code() (full-system version) for documentation on the
- * return value.
- *
- * Sets *@hostp (when @hostp is non-NULL) as follows.
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
- * to the host address where @addr's content is kept.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp);
-
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
     return qemu_ram_addr_from_host_nofail(p);
 }
 
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
-{
-    return get_page_addr_code_hostp(env, addr, NULL);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    int flags;
+
+    flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
+    g_assert(flags == 0);
+
+    if (hostp) {
+        *hostp = g2h_untagged(addr);
+    }
+    return addr;
+}
+
 /* The softmmu versions of these helpers are in cputlb.c.  */
 
 /*
-- 
2.34.1

The mmap_lock is held around tb_gen_code.  While the comment
is correct that the lock is dropped when tb_gen_code runs out
of memory, the lock is *not* dropped when an exception is
raised reading code for translation.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c  | 12 ++++++------
 accel/tcg/user-exec.c |  3 ---
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
-        /*
-         * The mmap_lock is dropped by tb_gen_code if it runs out of
-         * memory.
-         */
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
 #ifndef CONFIG_SOFTMMU
         clear_helper_retaddr();
-        tcg_debug_assert(!have_mmap_lock());
+        if (have_mmap_lock()) {
+            mmap_unlock();
+        }
 #endif
         if (qemu_mutex_iothread_locked()) {
             qemu_mutex_unlock_iothread();
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
          * (and if the translator doesn't handle page boundaries correctly
          * there's little we can do about that here).  Therefore, do not
          * trigger the unwinder.
-         *
-         * Like tb_gen_code, release the memory lock before cpu_loop_exit.
          */
-        mmap_unlock();
         *pc = 0;
         return MMU_INST_FETCH;
     }
-- 
2.34.1

The function is not used outside of cpu-exec.c.  Move it and
its subroutines up in the file, before the first use.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h |   3 -
 accel/tcg/cpu-exec.c    | 122 ++++++++++++++++++++--------------------
 2 files changed, 61 insertions(+), 64 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif
 void tb_flush(CPUState *cpu);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
     return cflags;
 }
 
+struct tb_desc {
+    target_ulong pc;
+    target_ulong cs_base;
+    CPUArchState *env;
+    tb_page_addr_t phys_page1;
+    uint32_t flags;
+    uint32_t cflags;
+    uint32_t trace_vcpu_dstate;
+};
+
+static bool tb_lookup_cmp(const void *p, const void *d)
+{
+    const TranslationBlock *tb = p;
+    const struct tb_desc *desc = d;
+
+    if (tb->pc == desc->pc &&
+        tb->page_addr[0] == desc->phys_page1 &&
+        tb->cs_base == desc->cs_base &&
+        tb->flags == desc->flags &&
+        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
+        tb_cflags(tb) == desc->cflags) {
+        /* check next page if needed */
+        if (tb->page_addr[1] == -1) {
+            return true;
+        } else {
+            tb_page_addr_t phys_page2;
+            target_ulong virt_page2;
+
+            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            phys_page2 = get_page_addr_code(desc->env, virt_page2);
+            if (tb->page_addr[1] == phys_page2) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+                                          target_ulong cs_base, uint32_t flags,
+                                          uint32_t cflags)
+{
+    tb_page_addr_t phys_pc;
+    struct tb_desc desc;
+    uint32_t h;
+
+    desc.env = cpu->env_ptr;
+    desc.cs_base = cs_base;
+    desc.flags = flags;
+    desc.cflags = cflags;
+    desc.trace_vcpu_dstate = *cpu->trace_dstate;
+    desc.pc = pc;
+    phys_pc = get_page_addr_code(desc.env, pc);
+    if (phys_pc == -1) {
+        return NULL;
+    }
+    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
+}
+
 /* Might cause an exception, so have a longjmp destination ready */
 static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           target_ulong cs_base,
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
     end_exclusive();
 }
 
-struct tb_desc {
-    target_ulong pc;
-    target_ulong cs_base;
-    CPUArchState *env;
-    tb_page_addr_t phys_page1;
-    uint32_t flags;
-    uint32_t cflags;
-    uint32_t trace_vcpu_dstate;
-};
-
-static bool tb_lookup_cmp(const void *p, const void *d)
-{
-    const TranslationBlock *tb = p;
-    const struct tb_desc *desc = d;
-
-    if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
-        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-        tb_cflags(tb) == desc->cflags) {
-        /* check next page if needed */
-        if (tb->page_addr[1] == -1) {
-            return true;
-        } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
-
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cflags)
-{
-    tb_page_addr_t phys_pc;
-    struct tb_desc desc;
-    uint32_t h;
-
-    desc.env = cpu->env_ptr;
-    desc.cs_base = cs_base;
-    desc.flags = flags;
-    desc.cflags = cflags;
-    desc.trace_vcpu_dstate = *cpu->trace_dstate;
-    desc.pc = pc;
-    phys_pc = get_page_addr_code(desc.env, pc);
-    if (phys_pc == -1) {
-        return NULL;
-    }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
-    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
-}
-
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
 {
     if (TCG_TARGET_HAS_direct_jump) {
-- 
2.34.1

The base qemu_ram_addr_from_host function is already in
softmmu/physmem.c; move the nofail version to be adjacent.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h |  1 +
 accel/tcg/cputlb.c        | 12 ------------
 softmmu/physmem.c         | 12 ++++++++++++
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
 ram_addr_t qemu_ram_addr_from_host(void *ptr);
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
 RAMBlock *qemu_ram_block_by_name(const char *name);
 RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
                                    ram_addr_t *offset);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                             prot, mmu_idx, size);
 }
 
-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-{
-    ram_addr_t ram_addr;
-
-    ram_addr = qemu_ram_addr_from_host(ptr);
-    if (ram_addr == RAM_ADDR_INVALID) {
-        error_report("Bad ram pointer %p", ptr);
-        abort();
-    }
-    return ram_addr;
-}
-
 /*
  * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+{
+    ram_addr_t ram_addr;
+
+    ram_addr = qemu_ram_addr_from_host(ptr);
+    if (ram_addr == RAM_ADDR_INVALID) {
+        error_report("Bad ram pointer %p", ptr);
+        abort();
+    }
+    return ram_addr;
+}
+
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.34.1

Simplify the implementation of get_page_addr_code_hostp
by reusing the existing probe_access infrastructure.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 50 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
   victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
                  (ADDR) & TARGET_PAGE_MASK)
 
-/*
- * Return a ram_addr_t for the virtual address for execution.
- *
- * Return -1 if we can't translate and execute from an entire page
- * of RAM.  This will force us to execute by loading and translating
- * one insn at a time, without caching.
- *
- * NOTE: This function will trigger an exception if the page is
- * not executable.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
-                                        void **hostp)
-{
-    uintptr_t mmu_idx = cpu_mmu_index(env, true);
-    uintptr_t index = tlb_index(env, mmu_idx, addr);
-    CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    void *p;
-
-    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
-        if (!VICTIM_TLB_HIT(addr_code, addr)) {
-            tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
-
-            if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
-                /*
-                 * The MMU protection covers a smaller range than a target
-                 * page, so we must redo the MMU check for every insn.
-                 */
-                return -1;
-            }
-        }
-        assert(tlb_hit(entry->addr_code, addr));
-    }
-
-    if (unlikely(entry->addr_code & TLB_MMIO)) {
-        /* The region is not backed by RAM.  */
-        if (hostp) {
-            *hostp = NULL;
-        }
-        return -1;
-    }
-
-    p = (void *)((uintptr_t)addr + entry->addend);
-    if (hostp) {
-        *hostp = p;
-    }
-    return qemu_ram_addr_from_host_nofail(p);
-}
-
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
                            CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 {
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
     return flags ? NULL : host;
 }
 
+/*
+ * Return a ram_addr_t for the virtual address for execution.
+ *
+ * Return -1 if we can't translate and execute from an entire page
+ * of RAM.  This will force us to execute by loading and translating
+ * one insn at a time, without caching.
+ *
+ * NOTE: This function will trigger an exception if the page is
+ * not executable.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+                                        void **hostp)
+{
+    void *p;
+
+    (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
+                                cpu_mmu_index(env, true), false, &p, 0);
+    if (p == NULL) {
+        return -1;
+    }
+    if (hostp) {
+        *hostp = p;
+    }
+    return qemu_ram_addr_from_host_nofail(p);
+}
+
 #ifdef CONFIG_PLUGIN
 /*
  * Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
-- 
2.34.1

It was non-obvious to me why we can raise an exception in
the middle of a comparison function, but it works.
While nearby, use TARGET_PAGE_ALIGN instead of open-coding.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
             tb_page_addr_t phys_page2;
             target_ulong virt_page2;
 
-            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+            /*
+             * We know that the first page matched, and an otherwise valid TB
+             * encountered an incomplete instruction at the end of that page,
+             * therefore we know that generating a new TB from the current PC
+             * must also require reading from the next page -- even if the
+             * second pages do not match, and therefore the resulting insn
+             * is different for the new TB.  Therefore any exception raised
+             * here by the faulting lookup is not premature.
+             */
+            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
             phys_page2 = get_page_addr_code(desc->env, virt_page2);
             if (tb->page_addr[1] == phys_page2) {
                 return true;
-- 
2.34.1

The only user can easily use translator_lduw and
adjust the type to signed during the return.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h   | 1 -
 target/i386/tcg/translate.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
 
 #define FOR_EACH_TRANSLATOR_LD(F)                                       \
     F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16)                 \
     F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
     F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
     F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
 
 static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
 {
-    return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
+    return translator_lduw(env, &s->base, advance_pc(env, s, 2));
 }
 
 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
-- 
2.34.1

Pass these along to translator_loop -- pc may be used instead
of tb->pc, and host_pc is currently unused.  Adjust all targets
at one time.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h       |  1 -
 include/exec/translator.h     | 24 ++++++++++++++++++++----
 accel/tcg/translate-all.c     |  6 ++++--
 accel/tcg/translator.c        |  9 +++++----
 target/alpha/translate.c      |  5 +++--
 target/arm/translate.c        |  5 +++--
 target/avr/translate.c        |  5 +++--
 target/cris/translate.c       |  5 +++--
 target/hexagon/translate.c    |  6 ++++--
 target/hppa/translate.c       |  5 +++--
 target/i386/tcg/translate.c   |  5 +++--
 target/loongarch/translate.c  |  6 ++++--
 target/m68k/translate.c       |  5 +++--
 target/microblaze/translate.c |  5 +++--
 target/mips/tcg/translate.c   |  5 +++--
 target/nios2/translate.c      |  5 +++--
 target/openrisc/translate.c   |  6 ++++--
 target/ppc/translate.c        |  5 +++--
 target/riscv/translate.c      |  5 +++--
 target/rx/translate.c         |  5 +++--
 target/s390x/tcg/translate.c  |  5 +++--
 target/sh4/translate.c        |  5 +++--
 target/sparc/translate.c      |  5 +++--
 target/tricore/translate.c    |  6 ++++--
 target/xtensa/translate.c     |  6 ++++--
 25 files changed, 97 insertions(+), 53 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
 #define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
 #endif
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
 void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
                           target_ulong *data);
 
diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/translate-all.h"
 #include "tcg/tcg.h"
 
+/**
+ * gen_intermediate_code
+ * @cpu: cpu context
+ * @tb: translation block
+ * @max_insns: max number of instructions to translate
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ *
+ * This function must be provided by the target, which should create
+ * the target-specific DisasContext, and then invoke translator_loop.
+ */
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc);
 
 /**
  * DisasJumpType:
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
 
 /**
  * translator_loop:
- * @ops: Target-specific operations.
- * @db: Disassembly context.
  * @cpu: Target vCPU.
  * @tb: Translation block.
  * @max_insns: Maximum number of insns to translate.
+ * @pc: guest virtual program counter address
+ * @host_pc: host physical program counter address
+ * @ops: Target-specific operations.
+ * @db: Disassembly context.
  *
  * Generic translator loop.
  *
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
  * - When single-stepping is enabled (system-wide or on the current vCPU).
  * - When too many instructions have been translated.
  */
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns);
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db);
 
 void translator_loop_temp_check(DisasContextBase *db);
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 
 #include "exec/cputlb.h"
 #include "exec/translate-all.h"
+#include "exec/translator.h"
 #include "qemu/bitmap.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     TCGProfile *prof = &tcg_ctx->prof;
     int64_t ti;
 #endif
+    void *host_pc;
 
     assert_memory_lock();
     qemu_thread_jit_write();
 
-    phys_pc = get_page_addr_code(env, pc);
+    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
 
     if (phys_pc == -1) {
         /* Generate a one-shot TB with 1 insn in it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_func_start(tcg_ctx);
 
     tcg_ctx->cpu = env_cpu(env);
-    gen_intermediate_code(cpu, tb, max_insns);
+    gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
     assert(tb->size != 0);
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
 #endif
 }
 
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb, int max_insns)
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                     target_ulong pc, void *host_pc,
+                     const TranslatorOps *ops, DisasContextBase *db)
 {
     uint32_t cflags = tb_cflags(tb);
     bool plugin_enabled;
 
     /* Initialize DisasContext */
     db->tb = tb;
-    db->pc_first = tb->pc;
-    db->pc_next = db->pc_first;
+    db->pc_first = pc;
+    db->pc_next = pc;
     db->is_jmp = DISAS_NEXT;
     db->num_insns = 0;
     db->max_insns = max_insns;
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
     .disas_log          = alpha_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
     const TranslatorOps *ops = &arm_translator_ops;
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
     }
 #endif
 
-    translator_loop(ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
diff --git a/target/avr/translate.c b/target/avr/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
     .disas_log          = avr_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = { };
-    translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
diff --git a/target/cris/translate.c b/target/cris/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
     .disas_log          = cris_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
     .disas_log          = hexagon_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &hexagon_tr_ops, &ctx.base);
 }
 
 #define NAME_LEN               64
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
     .disas_log          = hppa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
 };
 
 /* generate intermediate code for basic block 'tb'.  */
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
     .disas_log          = loongarch_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &loongarch_tr_ops, &ctx.base);
 }
 
 void loongarch_translate_init(void)
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
     .disas_log          = m68k_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
 }
 
 static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
     .disas_log          = mb_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
 }
 
 void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
     .disas_log          = mips_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
 }
 
 void mips_tcg_init(void)
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
     .disas_log          = nios2_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
-    translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
 }
 
 void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
     .disas_log          = openrisc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &openrisc_tr_ops, &ctx.base);
 }
 
 void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
     .disas_log          = ppc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
     .disas_log          = riscv_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
 }
 
 void riscv_translate_init(void)
diff --git a/target/rx/translate.c b/target/rx/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
     .disas_log          = rx_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
     .disas_log          = s390x_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc;
 
-    translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
     .disas_log          = sh4_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
 
-    translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
     .disas_log          = sparc_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
 
-    translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
 }
 
 void sparc_tcg_init(void)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
 };
 
 
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext ctx;
-    translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
+    translator_loop(cs, tb, max_insns, pc, host_pc,
+                    &tricore_tr_ops, &ctx.base);
 }
 
 void
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
     .disas_log          = xtensa_tr_disas_log,
 };
 
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
+                           target_ulong pc, void *host_pc)
 {
     DisasContext dc = {};
-    translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
+    translator_loop(cpu, tb, max_insns, pc, host_pc,
+                    &xtensa_translator_ops, &dc.base);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-- 
2.34.1

Cache the translation from guest to host address, so we may
use direct loads when we hit on the primary translation page.

Look up the second translation page only once, during translation.
This obviates another lookup of the second page within tb_gen_code
after translation.

Fixes a bug in that plugin_insn_append should be passed the bytes
in the original memory order, not bswapped by pieces.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/translator.h |  63 +++++++++++--------
 accel/tcg/translate-all.c |  23 +++----
 accel/tcg/translator.c    | 126 +++++++++++++++++++++++++++++---------
 3 files changed, 141 insertions(+), 71 deletions(-)

diff --git a/include/exec/translator.h b/include/exec/translator.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
  * Architecture-agnostic disassembly context.
  */
 typedef struct DisasContextBase {
-    const TranslationBlock *tb;
+    TranslationBlock *tb;
     target_ulong pc_first;
     target_ulong pc_next;
     DisasJumpType is_jmp;
     int num_insns;
     int max_insns;
     bool singlestep_enabled;
-#ifdef CONFIG_USER_ONLY
-    /*
-     * Guest address of the last byte of the last protected page.
-     *
-     * Pages containing the translated instructions are made non-writable in
-     * order to achieve consistency in case another thread is modifying the
-     * code while translate_insn() fetches the instruction bytes piecemeal.
-     * Such writer threads are blocked on mmap_lock() in page_unprotect().
-     */
-    target_ulong page_protect_end;
-#endif
+    void *host_addr[2];
 } DisasContextBase;
 
 /**
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
  * the relevant information at translation time.
  */
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap);                   \
-    static inline type fullname(CPUArchState *env,                      \
-                                DisasContextBase *dcbase, abi_ptr pc)   \
-    {                                                                   \
-        return fullname ## _swap(env, dcbase, pc, false);               \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
+
+static inline uint16_t
+translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
+                     abi_ptr pc, bool do_swap)
+{
+    uint16_t ret = translator_lduw(env, db, pc);
+    if (do_swap) {
+        ret = bswap16(ret);
     }
+    return ret;
+}
 
-#define FOR_EACH_TRANSLATOR_LD(F)                                       \
-    F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */)           \
-    F(translator_lduw, uint16_t, cpu_lduw_code, bswap16)                \
-    F(translator_ldl, uint32_t, cpu_ldl_code, bswap32)                  \
-    F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
+static inline uint32_t
+translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint32_t ret = translator_ldl(env, db, pc);
+    if (do_swap) {
+        ret = bswap32(ret);
+    }
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
-
-#undef GEN_TRANSLATOR_LD
+static inline uint64_t
+translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
+                    abi_ptr pc, bool do_swap)
+{
+    uint64_t ret = translator_ldq_swap(env, db, pc, false);
+    if (do_swap) {
+        ret = bswap64(ret);
+    }
+    return ret;
+}
 
 /*
  * Return whether addr is on the same page as where disassembly started.
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb, *existing_tb;
-    tb_page_addr_t phys_pc, phys_page2;
-    target_ulong virt_page2;
+    tb_page_addr_t phys_pc;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
 #ifdef CONFIG_PROFILER
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->flags = flags;
     tb->cflags = cflags;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+    tb->page_addr[0] = phys_pc;
+    tb->page_addr[1] = -1;
     tcg_ctx->tb_cflags = cflags;
  tb_overflow:
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     }
 
     /*
-     * If the TB is not associated with a physical RAM page then
-     * it must be a temporary one-insn TB, and we have nothing to do
-     * except fill in the page_addr[] fields. Return early before
-     * attempting to link to other TBs or add to the lookup table.
+     * If the TB is not associated with a physical RAM page then it must be
+     * a temporary one-insn TB, and we have nothing left to do. Return early
+     * before attempting to link to other TBs or add to the lookup table.
      */
-    if (phys_pc == -1) {
-        tb->page_addr[0] = tb->page_addr[1] = -1;
+    if (tb->page_addr[0] == -1) {
         return tb;
     }
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      */
     tcg_tb_insert(tb);
 
-    /* check next page if needed */
-    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
-    phys_page2 = -1;
-    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
-        phys_page2 = get_page_addr_code(env, virt_page2);
-    }
     /*
      * No explicit memory barrier is required -- tb_link_page() makes the
      * TB visible in a consistent state.
      */
-    existing_tb = tb_link_page(tb, phys_pc, phys_page2);
+    existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
     /* if the TB already exists, discard what we just translated */
     if (unlikely(existing_tb != tb)) {
         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
     return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
 }
 
-static inline void translator_page_protect(DisasContextBase *dcbase,
-                                           target_ulong pc)
-{
-#ifdef CONFIG_USER_ONLY
-    dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
-    page_protect(pc);
-#endif
-}
-
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
                      target_ulong pc, void *host_pc,
                      const TranslatorOps *ops, DisasContextBase *db)
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     db->num_insns = 0;
     db->max_insns = max_insns;
     db->singlestep_enabled = cflags & CF_SINGLE_STEP;
-    translator_page_protect(db, db->pc_next);
+    db->host_addr[0] = host_pc;
+    db->host_addr[1] = NULL;
+
+#ifdef CONFIG_USER_ONLY
+    page_protect(pc);
+#endif
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
 #endif
 }
 
-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
-                                                 target_ulong pc, size_t len)
+static void *translator_access(CPUArchState *env, DisasContextBase *db,
+                               target_ulong pc, size_t len)
 {
-#ifdef CONFIG_USER_ONLY
-    target_ulong end = pc + len - 1;
+    void *host;
+    target_ulong base, end;
+    TranslationBlock *tb;
 
-    if (end > dcbase->page_protect_end) {
-        translator_page_protect(dcbase, end);
+    tb = db->tb;
+
+    /* Use slow path if first page is MMIO. */
+    if (unlikely(tb->page_addr[0] == -1)) {
+        return NULL;
     }
+
+    end = pc + len - 1;
+    if (likely(is_same_page(db, end))) {
+        host = db->host_addr[0];
+        base = db->pc_first;
+    } else {
+        host = db->host_addr[1];
+        base = TARGET_PAGE_ALIGN(db->pc_first);
+        if (host == NULL) {
+            tb->page_addr[1] =
+                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+#ifdef CONFIG_USER_ONLY
+            page_protect(end);
 #endif
+            /* We cannot handle MMIO as second page. */
+            assert(tb->page_addr[1] != -1);
+            host = db->host_addr[1];
+        }
+
+        /* Use slow path when crossing pages. */
+        if (is_same_page(db, pc)) {
+            return NULL;
+        }
+    }
+
+    tcg_debug_assert(pc >= base);
+    return host + (pc - base);
 }
 
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn)             \
-    type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
-                           abi_ptr pc, bool do_swap)                    \
-    {                                                                   \
-        translator_maybe_page_protect(dcbase, pc, sizeof(type));        \
-        type ret = load_fn(env, pc);                                    \
-        if (do_swap) {                                                  \
-            ret = swap_fn(ret);                                         \
-        }                                                               \
-        plugin_insn_append(pc, &ret, sizeof(ret));                      \
-        return ret;                                                     \
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint8_t ret;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldub_p(p);
     }
+    ret = cpu_ldub_code(env, pc);
+    plugin_insn_append(pc, &ret, sizeof(ret));
+    return ret;
+}
 
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint16_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
 
-#undef GEN_TRANSLATOR_LD
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return lduw_p(p);
+    }
+    ret = cpu_lduw_code(env, pc);
+    plug = tswap16(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint32_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldl_p(p);
+    }
+    ret = cpu_ldl_code(env, pc);
+    plug = tswap32(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
+
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
+{
+    uint64_t ret, plug;
+    void *p = translator_access(env, db, pc, sizeof(ret));
+
+    if (p) {
+        plugin_insn_append(pc, p, sizeof(ret));
+        return ldq_p(p);
+    }
+    ret = cpu_ldq_code(env, pc);
+    plug = tswap64(ret);
+    plugin_insn_append(pc, &plug, sizeof(ret));
+    return ret;
+}
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c     |  15 +++-
 tests/tcg/s390x/noexec.c         | 106 +++++++++++++++++++++++
 tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
 tests/tcg/s390x/Makefile.target  |   1 +
 4 files changed, 257 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/s390x/noexec.c
 create mode 100644 tests/tcg/multiarch/noexec.c.inc

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
     dc->insn_start = tcg_last_op();
 }
 
+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
+                                uint64_t pc)
+{
+    uint64_t insn = ld_code2(env, s, pc);
+
+    return pc + get_ilen((insn >> 8) & 0xff);
+}
+
 static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 {
     CPUS390XState *env = cs->env_ptr;
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 
     dc->base.is_jmp = translate_one(env, dc);
     if (dc->base.is_jmp == DISAS_NEXT) {
-        uint64_t page_start;
-
-        page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-        if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
+        if (!is_same_page(dcbase, dc->base.pc_next) ||
+            !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
+            dc->ex_value) {
             dc->base.is_jmp = DISAS_TOO_MANY;
         }
     }
diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/s390x/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->psw.addr;
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[2];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "   lgfi %r2,1\n"       /* %r2 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   lgfi %r2,2\n"       /* %r2 is 0/1; set 2. */
+    "   br %r14\n"          /* return */
+    "noexec_end:");
+
+extern char exrl_1[];
+extern char exrl_2[];
+extern char exrl_end[];
+
+asm("exrl_1:\n"
+    "   exrl %r0, exrl_2\n"
+    "   br %r14\n"
+    "exrl_2:\n"
+    "   lgfi %r2,2\n"
+    "exrl_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2,
+            .entry_ofs = exrl_1 - exrl_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+        {
+            .name = "exrl [cross]",
+            .test_code = exrl_1,
+            .test_len = exrl_end - exrl_1,
+            .page_ofs = exrl_1 - exrl_2 - 2,
+            .entry_ofs = exrl_1 - exrl_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = exrl_1 - exrl_2 - 2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/multiarch/noexec.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * Common code for arch-specific MMU_INST_FETCH fault testing.
+ */
+
+#define _GNU_SOURCE
+
+#include <assert.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <sys/ucontext.h>
+
+/* Forward declarations. */
+
+static void *arch_mcontext_pc(const mcontext_t *ctx);
+static int arch_mcontext_arg(const mcontext_t *ctx);
+static void arch_flush(void *p, int len);
+
+/* Testing infrastructure. */
+
+struct noexec_test {
+    const char *name;
+    const char *test_code;
+    int test_len;
+    int page_ofs;
+    int entry_ofs;
+    int expected_si_ofs;
+    int expected_pc_ofs;
+    int expected_arg;
+};
+
+static void *page_base;
+static int page_size;
+static const struct noexec_test *current_noexec_test;
+
+static void handle_err(const char *syscall)
+{
+    printf("[  FAILED  ] %s: %s\n", syscall, strerror(errno));
+    exit(EXIT_FAILURE);
+}
+
+static void handle_segv(int sig, siginfo_t *info, void *ucontext)
+{
+    const struct noexec_test *test = current_noexec_test;
+    const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
+    void *expected_si;
+    void *expected_pc;
+    void *pc;
+    int arg;
+
+    if (test == NULL) {
+        printf("[  FAILED  ] unexpected SEGV\n");
+        exit(EXIT_FAILURE);
+    }
+    current_noexec_test = NULL;
+
+    expected_si = page_base + test->expected_si_ofs;
+    if (info->si_addr != expected_si) {
+        printf("[  FAILED  ] wrong si_addr (%p != %p)\n",
+               info->si_addr, expected_si);
+        exit(EXIT_FAILURE);
+    }
+
+    pc = arch_mcontext_pc(mc);
+    expected_pc = page_base + test->expected_pc_ofs;
+    if (pc != expected_pc) {
+        printf("[  FAILED  ] wrong pc (%p != %p)\n", pc, expected_pc);
+        exit(EXIT_FAILURE);
+    }
+
+    arg = arch_mcontext_arg(mc);
+    if (arg != test->expected_arg) {
+        printf("[  FAILED  ] wrong arg (%d != %d)\n", arg, test->expected_arg);
+        exit(EXIT_FAILURE);
+    }
+
+    if (mprotect(page_base, page_size,
+                 PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
+        handle_err("mprotect");
+    }
+}
+
+static void test_noexec_1(const struct noexec_test *test)
+{
+    void *start = page_base + test->page_ofs;
+    void (*fn)(int arg) = page_base + test->entry_ofs;
+
+    memcpy(start, test->test_code, test->test_len);
+    arch_flush(start, test->test_len);
+
+    /* Trigger TB creation in order to test invalidation. */
+    fn(0);
+
+    if (mprotect(page_base, page_size, PROT_NONE) < 0) {
+        handle_err("mprotect");
+    }
+
+    /* Trigger SEGV and check that handle_segv() ran. */
+    current_noexec_test = test;
+    fn(0);
+    assert(current_noexec_test == NULL);
+}
+
+static int test_noexec(struct noexec_test *tests, size_t n_tests)
+{
+    struct sigaction act;
+    size_t i;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = handle_segv;
+    act.sa_flags = SA_SIGINFO;
+    if (sigaction(SIGSEGV, &act, NULL) < 0) {
+        handle_err("sigaction");
+    }
+
+    page_size = getpagesize();
+    page_base = mmap(NULL, 2 * page_size,
+                     PROT_READ | PROT_WRITE | PROT_EXEC,
+                     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+    if (page_base == MAP_FAILED) {
+        handle_err("mmap");
+    }
+    page_base += page_size;
+
+    for (i = 0; i < n_tests; i++) {
+        struct noexec_test *test = &tests[i];
+
+        printf("[ RUN      ] %s\n", test->name);
+        test_noexec_1(test);
+        printf("[       OK ]\n");
+    }
+
+    printf("[  PASSED  ]\n");
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
 TESTS+=trap
 TESTS+=signals-s390x
 TESTS+=branch-relative-long
+TESTS+=noexec
 
 Z14_TESTS=vfminmax
 vfminmax: LDFLAGS+=-lm
-- 
2.34.1

From: Ilya Leoshkevich <iii@linux.ibm.com>

Right now translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

An implementation, like the one arm and s390x have, would require an
i386 length disassembler, which is burdensome to maintain. Another
alternative would be to single-step at the end of a guest page, but
this may come with a performance impact.

Fix by snapshotting disassembly state and restoring it after we figure
out we crossed a page boundary. This includes rolling back cc_op
updates and emitted ops.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
[rth: Simplify end-of-insn cross-page checks.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c      | 64 ++++++++++++++++-----------
 tests/tcg/x86_64/noexec.c        | 75 ++++++++++++++++++++++++++++++++
 tests/tcg/x86_64/Makefile.target |  3 +-
 3 files changed, 116 insertions(+), 26 deletions(-)
 create mode 100644 tests/tcg/x86_64/noexec.c

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv_i64 tmp1_i64;
 
     sigjmp_buf jmpbuf;
+    TCGOp *prev_insn_end;
 } DisasContext;
 
 /* The environment in which user-only runs is constrained. */
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
 {
     uint64_t pc = s->pc;
 
+    /* This is a subsequent insn that crosses a page boundary.  */
+    if (s->base.num_insns > 1 &&
+        !is_same_page(&s->base, s->pc + num_bytes - 1)) {
+        siglongjmp(s->jmpbuf, 2);
+    }
+
     s->pc += num_bytes;
     if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
         /* If the instruction's 16th byte is on a different page than the 1st, a
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     int modrm, reg, rm, mod, op, opreg, val;
     target_ulong next_eip, tval;
     target_ulong pc_start = s->base.pc_next;
+    bool orig_cc_op_dirty = s->cc_op_dirty;
+    CCOp orig_cc_op = s->cc_op;
 
     s->pc_start = s->pc = pc_start;
     s->override = -1;
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
     s->rip_offset = 0; /* for relative ip address */
     s->vex_l = 0;
     s->vex_v = 0;
-    if (sigsetjmp(s->jmpbuf, 0) != 0) {
+    switch (sigsetjmp(s->jmpbuf, 0)) {
+    case 0:
+        break;
+    case 1:
         gen_exception_gpf(s);
         return s->pc;
+    case 2:
+        /* Restore state that may affect the next instruction. */
+        s->cc_op_dirty = orig_cc_op_dirty;
+        s->cc_op = orig_cc_op;
+        s->base.num_insns--;
+        tcg_remove_ops_after(s->prev_insn_end);
+        s->base.is_jmp = DISAS_TOO_MANY;
+        return pc_start;
+    default:
+        g_assert_not_reached();
     }
 
     prefixes = 0;
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
+    dc->prev_insn_end = tcg_last_op();
     tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
 }
 
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 #endif
 
     pc_next = disas_insn(dc, cpu);
-
-    if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
-        /* if single step mode, we generate only one instruction and
-           generate an exception */
-        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
-           the flag and abort the translation to give the irqs a
-           chance to happen */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
-               && ((pc_next & TARGET_PAGE_MASK)
-                   != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
-                       & TARGET_PAGE_MASK)
-                   || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
-        /* Do not cross the boundary of the pages in icount mode,
-           it can cause an exception. Do it only when boundary is
-           crossed by the first instruction in the block.
-           If current instruction already crossed the bound - it's ok,
-           because an exception hasn't stopped this code.
-         */
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
-        dc->base.is_jmp = DISAS_TOO_MANY;
-    }
-
     dc->base.pc_next = pc_next;
+
+    if (dc->base.is_jmp == DISAS_NEXT) {
+        if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
+            /*
+             * If single step mode, we generate only one instruction and
+             * generate an exception.
+             * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
+             * the flag and abort the translation to give the irqs a
+             * chance to happen.
+             */
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        } else if (!is_same_page(&dc->base, pc_next)) {
+            dc->base.is_jmp = DISAS_TOO_MANY;
+        }
+    }
 }
 
 static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/x86_64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->gregs[REG_RIP];
+}
+
+int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->gregs[REG_RDI];
+}
+
+static void arch_flush(void *p, int len)
+{
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm("noexec_1:\n"
+    "    movq $1,%rdi\n"    /* %rdi is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "    movq $2,%rdi\n"    /* %rdi is 0/1; set 2. */
+    "    ret\n"
+    "noexec_end:");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/x86_64/Makefile.target
+++ b/tests/tcg/x86_64/Makefile.target
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
 
 ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
 X86_64_TESTS += vsyscall
+X86_64_TESTS += noexec
 TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
 else
 TESTS=$(MULTIARCH_TESTS)
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
 test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
+%: $(SRC_PATH)/tests/tcg/x86_64/%.c
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-- 
2.34.1

These will be useful in properly ending the TB.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 /* Include decoders for factored-out extensions */
 #include "decode-XVentanaCondOps.c.inc"
 
+/* The specification allows for longer insns, but not supported by qemu. */
+#define MAX_INSN_LEN  4
+
+static inline int insn_len(uint16_t first_word)
+{
+    return (first_word & 3) == 3 ? 4 : 2;
+}
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     };
 
     /* Check for compressed insn */
-    if (extract16(opcode, 0, 2) != 3) {
+    if (insn_len(opcode) == 2) {
         if (!has_ext(ctx, RVC)) {
             gen_exception_illegal(ctx);
         } else {
-- 
2.34.1

Right now the translator stops right *after* the end of a page, which
breaks reporting of fault locations when the last instruction of a
multi-insn translation block crosses a page boundary.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/translate.c          | 17 +++++--
 tests/tcg/riscv64/noexec.c        | 79 +++++++++++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target |  1 +
 3 files changed, 93 insertions(+), 4 deletions(-)
 create mode 100644 tests/tcg/riscv64/noexec.c

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     ctx->nftemp = 0;
 
+    /* Only the first insn within a TB is allowed to cross a page boundary. */
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        target_ulong page_start;
-
-        page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
-        if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
+        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
+        } else {
+            unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
+
+            if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
+                uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
+                int len = insn_len(next_insn);
+
+                if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
+                    ctx->base.is_jmp = DISAS_TOO_MANY;
+                }
+            }
         }
     }
 }
diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/noexec.c
@@ -XXX,XX +XXX,XX @@
+#include "../multiarch/noexec.c.inc"
+
+static void *arch_mcontext_pc(const mcontext_t *ctx)
+{
+    return (void *)ctx->__gregs[REG_PC];
+}
+
+static int arch_mcontext_arg(const mcontext_t *ctx)
+{
+    return ctx->__gregs[REG_A0];
+}
+
+static void arch_flush(void *p, int len)
+{
+    __builtin___clear_cache(p, p + len);
+}
+
+extern char noexec_1[];
+extern char noexec_2[];
+extern char noexec_end[];
+
+asm(".option push\n"
+    ".option norvc\n"
+    "noexec_1:\n"
+    "   li a0,1\n"       /* a0 is 0 on entry, set 1. */
+    "noexec_2:\n"
+    "   li a0,2\n"      /* a0 is 0/1; set 2. */
+    "   ret\n"
+    "noexec_end:\n"
+    ".option pop");
+
+int main(void)
+{
+    struct noexec_test noexec_tests[] = {
+        {
+            .name = "fallthrough",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = noexec_1 - noexec_2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2,
+            .entry_ofs = 0,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = 0,
+            .expected_arg = 0,
+        },
+        {
+            .name = "fallthrough [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = noexec_1 - noexec_2 - 2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 1,
+        },
+        {
+            .name = "jump [cross]",
+            .test_code = noexec_1,
+            .test_len = noexec_end - noexec_1,
+            .page_ofs = noexec_1 - noexec_2 - 2,
+            .entry_ofs = -2,
+            .expected_si_ofs = 0,
+            .expected_pc_ofs = -2,
+            .expected_arg = 0,
+        },
+    };
+
+    return test_noexec(noexec_tests,
+                       sizeof(noexec_tests) / sizeof(noexec_tests[0]));
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
 
 VPATH += $(SRC_PATH)/tests/tcg/riscv64
 TESTS += test-div
+TESTS += noexec
-- 
2.34.1