Series comparison

-[PULL 00/46] tcg patch queue
+[PULL 00/20] tcg patch queue
-The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:
+TCG patch queue, plus one target/sh4 patch that
 Yoshinori Sato asked me to process.
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)
 r~
 The following changes since commit efbf38d73e5dcc4d5f8b98c6e7a12be1f3b91745:
   Merge tag 'for-upstream' of git://repo.or.cz/qemu/kevin into staging (2022-10-03 15:06:07 -0400)
 are available in the Git repository at:
-  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205
+  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221004
-for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:
+for you to fetch changes up to ab419fd8a035a65942de4e63effcd55ccbf1a9fe:
-  accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)
+  target/sh4: Fix TB_FLAG_UNALIGN (2022-10-04 12:33:05 -0700)
 ----------------------------------------------------------------
-TCGCPUOps cleanups (claudio)
+Cache CPUClass for use in hot code paths.
-tcg/s390 compare fix (phil)
+Add CPUTLBEntryFull, probe_access_full, tlb_set_page_full.
-tcg/aarch64 rotli_vec fix
+Add generic support for TARGET_TB_PCREL.
-tcg/tci cleanups and fixes
+tcg/ppc: Optimize 26-bit jumps using STQ for POWER 2.07
 target/sh4: Fix TB_FLAG_UNALIGN
 ----------------------------------------------------------------
-Claudio Fontana (13):
+Alex Bennée (3):
-      target/riscv: remove CONFIG_TCG, as it is always TCG
+      cpu: cache CPUClass in CPUState for hot code paths
-      accel/tcg: split TCG-only code from cpu_exec_realizefn
+      hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
-      target/arm: do not use cc->do_interrupt for KVM directly
+      cputlb: used cached CPUClass in our hot-paths
       cpu: move cc->do_interrupt to tcg_ops
       cpu: move cc->transaction_failed to tcg_ops
       cpu: move do_unaligned_access to tcg_ops
       physmem: make watchpoint checking code TCG-only
       cpu: move adjust_watchpoint_address to tcg_ops
       cpu: move debug_check_watchpoint to tcg_ops
       cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
       accel: extend AccelState and AccelClass to user-mode
       accel: replace struct CpusAccel with AccelOpsClass
       accel: introduce AccelCPUClass extending CPUClass
-Eduardo Habkost (5):
+Leandro Lupori (1):
-      cpu: Introduce TCGCpuOperations struct
+      tcg/ppc: Optimize 26-bit jumps
       cpu: Move synchronize_from_tb() to tcg_ops
       cpu: Move cpu_exec_* to tcg_ops
       cpu: Move tlb_fill to tcg_ops
       cpu: Move debug_excp_handler to tcg_ops
-Philippe Mathieu-Daudé (2):
+Richard Henderson (16):
-      tcg/s390: Fix compare instruction from extended-immediate facility
+      accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
-      exec/cpu-defs: Remove TCG backends dependency
+      accel/tcg: Drop addr member from SavedIOTLB
       accel/tcg: Suppress auto-invalidate in probe_access_internal
       accel/tcg: Introduce probe_access_full
       accel/tcg: Introduce tlb_set_page_full
       include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
       accel/tcg: Remove PageDesc code_bitmap
       accel/tcg: Use bool for page_find_alloc
       accel/tcg: Use DisasContextBase in plugin_gen_tb_start
       accel/tcg: Do not align tb->page_addr[0]
       accel/tcg: Inline tb_flush_jmp_cache
       include/hw/core: Create struct CPUJumpCache
       hw/core: Add CPUClass.get_pc
       accel/tcg: Introduce tb_pc and log_pc
       accel/tcg: Introduce TARGET_TB_PCREL
       target/sh4: Fix TB_FLAG_UNALIGN
-Richard Henderson (24):
+ accel/tcg/internal.h                    |  10 ++
-      tcg/aarch64: Do not convert TCGArg to temps that are not temps
+ accel/tcg/tb-hash.h                     |   1 +
-      configure: Fix --enable-tcg-interpreter
+ accel/tcg/tb-jmp-cache.h                |  65 ++++++++
-      tcg/tci: Make tci_tb_ptr thread-local
+ include/exec/cpu-common.h               |   1 +
-      tcg/tci: Inline tci_write_reg32s into the only caller
+ include/exec/cpu-defs.h                 |  48 ++++--
-      tcg/tci: Inline tci_write_reg8 into its callers
+ include/exec/exec-all.h                 |  75 ++++++++-
-      tcg/tci: Inline tci_write_reg16 into the only caller
+ include/exec/plugin-gen.h               |   7 +-
-      tcg/tci: Inline tci_write_reg32 into all callers
+ include/hw/core/cpu.h                   |  28 ++--
-      tcg/tci: Inline tci_write_reg64 into 64-bit callers
+ include/qemu/typedefs.h                 |   2 +
-      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+ include/tcg/tcg.h                       |   2 +-
-      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+ target/sh4/cpu.h                        |  56 ++++---
-      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+ accel/stubs/tcg-stub.c                  |   4 +
-      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+ accel/tcg/cpu-exec.c                    |  80 +++++-----
-      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+ accel/tcg/cputlb.c                      | 259 ++++++++++++++++++--------------
-      tcg/tci: Merge INDEX_op_st8_{i32,i64}
+ accel/tcg/plugin-gen.c                  |  22 +--
-      tcg/tci: Merge INDEX_op_st16_{i32,i64}
+ accel/tcg/translate-all.c               | 214 ++++++++++++--------------
-      tcg/tci: Move stack bounds check to compile-time
+ accel/tcg/translator.c                  |   2 +-
-      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+ cpu.c                                   |   9 +-
-      tcg/tci: Use g_assert_not_reached
+ hw/core/cpu-common.c                    |   3 +-
-      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+ hw/core/cpu-sysemu.c                    |   5 +-
-      tcg/tci: Implement 64-bit division
+ linux-user/sh4/signal.c                 |   6 +-
-      tcg/tci: Remove TODO as unused
+ plugins/core.c                          |   2 +-
-      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+ target/alpha/cpu.c                      |   9 ++
-      tcg/tci: Fix TCG_REG_R4 misusage
+ target/arm/cpu.c                        |  17 ++-
-      tcg/tci: Remove TCG_CONST
+ target/arm/mte_helper.c                 |  14 +-
  target/arm/sve_helper.c                 |   4 +-
  target/arm/translate-a64.c              |   2 +-
  target/avr/cpu.c                        |  10 +-
  target/cris/cpu.c                       |   8 +
  target/hexagon/cpu.c                    |  10 +-
  target/hppa/cpu.c                       |  12 +-
  target/i386/cpu.c                       |   9 ++
  target/i386/tcg/tcg-cpu.c               |   2 +-
  target/loongarch/cpu.c                  |  11 +-
  target/m68k/cpu.c                       |   8 +
  target/microblaze/cpu.c                 |  10 +-
  target/mips/cpu.c                       |   8 +
  target/mips/tcg/exception.c             |   2 +-
  target/mips/tcg/sysemu/special_helper.c |   2 +-
  target/nios2/cpu.c                      |   9 ++
  target/openrisc/cpu.c                   |  10 +-
  target/ppc/cpu_init.c                   |   8 +
  target/riscv/cpu.c                      |  17 ++-
  target/rx/cpu.c                         |  10 +-
  target/s390x/cpu.c                      |   8 +
  target/s390x/tcg/mem_helper.c           |   4 -
  target/sh4/cpu.c                        |  18 ++-
  target/sh4/helper.c                     |   6 +-
  target/sh4/translate.c                  |  90 +++++------
  target/sparc/cpu.c                      |  10 +-
  target/tricore/cpu.c                    |  11 +-
  target/xtensa/cpu.c                     |   8 +
  tcg/tcg.c                               |   8 +-
  trace/control-target.c                  |   2 +-
  tcg/ppc/tcg-target.c.inc                | 119 +++++++++++----
 files changed, 915 insertions(+), 462 deletions(-)
  create mode 100644 accel/tcg/tb-jmp-cache.h
-Stefan Weil (2):
-      tcg/tci: Implement INDEX_op_ld16s_i32
-      tcg/tci: Implement INDEX_op_ld8s_i64
- configure                                          |   5 +-
- accel/accel-softmmu.h                              |  15 +
- accel/kvm/kvm-cpus.h                               |   2 -
- .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
- accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
- accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
- accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
- include/exec/cpu-all.h                             |  11 +-
- include/exec/cpu-defs.h                            |   3 -
- include/exec/exec-all.h                            |   2 +-
- include/hw/boards.h                                |   2 +-
- include/hw/core/accel-cpu.h                        |  38 ++
- include/hw/core/cpu.h                              |  86 +---
- include/hw/core/tcg-cpu-ops.h                      |  97 +++++
- include/{sysemu => qemu}/accel.h                   |  16 +-
- include/sysemu/accel-ops.h                         |  45 ++
- include/sysemu/cpus.h                              |  26 +-
- include/sysemu/hvf.h                               |   2 +-
- include/sysemu/kvm.h                               |   2 +-
- include/sysemu/kvm_int.h                           |   2 +-
- target/arm/internals.h                             |   6 +
- target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
- target/i386/hax/hax-windows.h                      |   2 +-
- target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
- target/i386/hvf/hvf-i386.h                         |   2 +-
- target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
- tcg/tci/tcg-target-con-set.h                       |   6 +-
- tcg/tci/tcg-target.h                               |  37 +-
- accel/accel-common.c                               | 105 +++++
- accel/{accel.c => accel-softmmu.c}                 |  61 ++-
- accel/accel-user.c                                 |  24 ++
- accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
- accel/kvm/kvm-all.c                                |   2 -
- accel/qtest/qtest.c                                |  25 +-
- accel/tcg/cpu-exec.c                               |  53 ++-
- accel/tcg/cputlb.c                                 |  34 +-
- .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
- .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
- accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
- accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
- accel/tcg/tcg-all.c                                |  19 +-
- accel/tcg/user-exec.c                              |   8 +-
- accel/xen/xen-all.c                                |  26 +-
- bsd-user/main.c                                    |  11 +-
- cpu.c                                              |  66 +--
- hw/core/cpu.c                                      |  21 +-
- hw/mips/jazz.c                                     |  12 +-
- linux-user/main.c                                  |   7 +-
- softmmu/cpus.c                                     |  12 +-
- softmmu/memory.c                                   |   2 +-
- softmmu/physmem.c                                  | 149 ++++---
- softmmu/qtest.c                                    |   2 +-
- softmmu/vl.c                                       |   9 +-
- target/alpha/cpu.c                                 |  21 +-
- target/arm/cpu.c                                   |  45 +-
- target/arm/cpu64.c                                 |   4 +-
- target/arm/cpu_tcg.c                               |  32 +-
- target/arm/helper.c                                |   4 +
- target/arm/kvm64.c                                 |   6 +-
- target/avr/cpu.c                                   |  19 +-
- target/avr/helper.c                                |   5 +-
- target/cris/cpu.c                                  |  43 +-
- target/cris/helper.c                               |   5 +-
- target/hppa/cpu.c                                  |  24 +-
- target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
- target/i386/hax/hax-all.c                          |   7 +-
- target/i386/hax/hax-mem.c                          |   2 +-
- target/i386/hax/hax-posix.c                        |   2 +-
- target/i386/hax/hax-windows.c                      |   2 +-
- target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
- target/i386/hvf/hvf.c                              |   5 +-
- target/i386/hvf/x86_task.c                         |   2 +-
- target/i386/hvf/x86hvf.c                           |   2 +-
- target/i386/tcg/tcg-cpu.c                          |  26 +-
- target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
- target/i386/whpx/whpx-all.c                        |   9 +-
- target/lm32/cpu.c                                  |  19 +-
- target/m68k/cpu.c                                  |  19 +-
- target/microblaze/cpu.c                            |  25 +-
- target/mips/cpu.c                                  |  35 +-
- target/moxie/cpu.c                                 |  15 +-
- target/nios2/cpu.c                                 |  18 +-
- target/openrisc/cpu.c                              |  17 +-
- target/riscv/cpu.c                                 |  26 +-
- target/riscv/cpu_helper.c                          |   2 +-
- target/rx/cpu.c                                    |  20 +-
- target/s390x/cpu.c                                 |  33 +-
- target/s390x/excp_helper.c                         |   2 +-
- target/sh4/cpu.c                                   |  21 +-
- target/sparc/cpu.c                                 |  25 +-
- target/tilegx/cpu.c                                |  17 +-
- target/tricore/cpu.c                               |  12 +-
- target/unicore32/cpu.c                             |  17 +-
- target/xtensa/cpu.c                                |  23 +-
- target/xtensa/helper.c                             |   4 +-
- tcg/tcg-common.c                                   |   4 -
- tcg/tci.c                                          | 479 ++++++++-------------
- target/ppc/translate_init.c.inc                    |  39 +-
- tcg/aarch64/tcg-target.c.inc                       |   7 +-
- tcg/s390/tcg-target.c.inc                          |   2 +-
- tcg/tci/tcg-target.c.inc                           | 149 ++-----
- MAINTAINERS                                        |   7 +-
- accel/kvm/meson.build                              |   2 +-
- accel/meson.build                                  |   4 +-
- accel/tcg/meson.build                              |  10 +-
- target/i386/hax/meson.build                        |   2 +-
- target/i386/hvf/meson.build                        |   2 +-
- target/i386/whpx/meson.build                       |   2 +-
-files changed, 1565 insertions(+), 1065 deletions(-)
- create mode 100644 accel/accel-softmmu.h
- rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
- create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
- rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
- rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
- create mode 100644 include/hw/core/accel-cpu.h
- create mode 100644 include/hw/core/tcg-cpu-ops.h
- rename include/{sysemu => qemu}/accel.h (94%)
- create mode 100644 include/sysemu/accel-ops.h
- rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
- rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
- rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
- create mode 100644 accel/accel-common.c
- rename accel/{accel.c => accel-softmmu.c} (64%)
- create mode 100644 accel/accel-user.c
- rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
- rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
- rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
- rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
- rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
- rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
- rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
- rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

-[PULL 01/46] tcg/s390: Fix compare instruction from extended-immediate facility
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The code is currently comparing c2 to the type promotion of
-uint32_t and int32_t. That is, the conversion rules are as:
-  (common_type) c2 == (common_type) (uint32_t)
-                        (is_unsigned
-                        ? (uint32_t)c2
-                        : (uint32_t)(int32_t)c2)
-In the signed case we lose the desired sign extensions because
-of the argument promotion rules of the ternary operator.
-Solve the problem by doing the round-trip parsing through the
-intermediate type and back to the desired common type (all at
-one expression).
-Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
-Tested-by: Richard W.M. Jones <rjones@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reported-by: Richard W.M. Jones <rjones@redhat.com>
-Suggested-by: David Hildenbrand <david@redhat.com>
-Suggested-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/s390/tcg-target.c.inc | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/s390/tcg-target.c.inc
-+++ b/tcg/s390/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
-                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
-                 tcg_out_insn_RIL(s, op, r1, c2);
-                 goto exit;
--            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
-+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
-                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
-                 tcg_out_insn_RIL(s, op, r1, c2);
-                 goto exit;
---
-.25.1

-[PULL 29/46] cpu: Introduce TCGCpuOperations struct
+[PULL 01/20] cpu: cache CPUClass in CPUState for hot code paths
-From: Eduardo Habkost <ehabkost@redhat.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-The TCG-specific CPU methods will be moved to a separate struct,
+The class cast checkers are quite expensive and always on (unlike the
-to make it easier to move accel-specific code outside generic CPU
+dynamic case who's checks are gated by CONFIG_QOM_CAST_DEBUG). To
-code in the future.  Start by moving tcg_initialize().
+avoid the overhead of repeatedly checking something which should never
 change we cache the CPUClass reference for use in the hot code paths.
-The new CPUClass.tcg_opts field may eventually become a pointer,
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-but keep it an embedded struct for now, to make code conversion
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-easier.
+Message-Id: <20220811151413.3350684-3-alex.bennee@linaro.org>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Message-Id: <20220923084803.498337-3-clg@kaod.org>
 [claudio: move TCGCpuOperations inside include/hw/core/cpu.h]
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-Id: <20210204163931.7358-2-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 16 +++++++++++++++-
+ include/hw/core/cpu.h | 9 +++++++++
- cpu.c                           |  6 +++++-
+ cpu.c                 | 9 ++++-----
- target/alpha/cpu.c              |  2 +-
+files changed, 13 insertions(+), 5 deletions(-)
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               | 12 ++++++------
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 48 insertions(+), 30 deletions(-)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
+@@ -XXX,XX +XXX,XX @@ typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
+  */
- struct TranslationBlock;
+ #define CPU(obj) ((CPUState *)(obj))
-+/**
++/*
-+ * struct TcgCpuOperations: TCG operations specific to a CPU class
++ * The class checkers bring in CPU_GET_CLASS() which is potentially
 + * expensive given the eventual call to
 + * object_class_dynamic_cast_assert(). Because of this the CPUState
 + * has a cached value for the class in cs->cc which is set up in
 + * cpu_exec_realizefn() for use in hot code paths.
 + */
-+typedef struct TcgCpuOperations {
+ typedef struct CPUClass CPUClass;
-+    /**
+ DECLARE_CLASS_CHECKERS(CPUClass, CPU,
-+     * @initialize: Initalize TCG state
+                        TYPE_CPU)
-+     *
+@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
-+     * Called when the first CPU is realized.
+ struct CPUState {
-+     */
+     /*< private >*/
-+    void (*initialize)(void);
+     DeviceState parent_obj;
-+
++    /* cache to avoid expensive CPU_GET_CLASS */
-+} TcgCpuOperations;
++    CPUClass *cc;
-+
+     /*< public >*/
- /**
-  * CPUClass:
+     int nr_cores;
   * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
      vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 -    void (*tcg_initialize)(void);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
      int gdb_num_core_regs;
      bool gdb_stop_before_watchpoint;
 +
 +    TcgCpuOperations tcg_ops;
  };
  /*
 diff --git a/cpu.c b/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/cpu.c
 +++ b/cpu.c
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
  void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+-#ifndef CONFIG_USER_ONLY
-+#ifdef CONFIG_TCG
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
-     static bool tcg_target_initialized;
+-#endif
-+#endif /* CONFIG_TCG */
++    /* cache the cpu class for the hotpath */
 +    cpu->cc = CPU_GET_CLASS(cpu);
      cpu_list_add(cpu);
+     if (!accel_cpu_realizefn(cpu, errp)) {
-+#ifdef CONFIG_TCG
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
-     if (tcg_enabled() && !tcg_target_initialized) {
+     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-         tcg_target_initialized = true;
+         vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 -        cc->tcg_initialize();
 +        cc->tcg_ops.initialize();
      }
-+#endif /* CONFIG_TCG */
+-    if (cc->sysemu_ops->legacy_vmsd != NULL) {
-     tlb_init(cpu);
+-        vmstate_register(NULL, cpu->cpu_index, cc->sysemu_ops->legacy_vmsd, cpu);
++    if (cpu->cc->sysemu_ops->legacy_vmsd != NULL) {
-     qemu_plugin_vcpu_init_hook(cpu);
++        vmstate_register(NULL, cpu->cpu_index, cpu->cc->sysemu_ops->legacy_vmsd, cpu);
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
+     }
-index XXXXXXX..XXXXXXX 100644
+ #endif /* CONFIG_USER_ONLY */
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
      cc->disas_set_info = alpha_cpu_disas_set_info;
 -    cc->tcg_initialize = alpha_translate_init;
 +    cc->tcg_ops.initialize = alpha_translate_init;
      cc->gdb_num_core_regs = 67;
  }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = arm_disas_set_info;
- #ifdef CONFIG_TCG
--    cc->tcg_initialize = arm_translate_init;
-+    cc->tcg_ops.initialize = arm_translate_init;
-     cc->tlb_fill = arm_cpu_tlb_fill;
-     cc->debug_excp_handler = arm_debug_excp_handler;
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tlb_fill = avr_cpu_tlb_fill;
-     cc->vmsd = &vms_avr_cpu;
-     cc->disas_set_info = avr_cpu_disas_set_info;
--    cc->tcg_initialize = avr_cpu_tcg_init;
-+    cc->tcg_ops.initialize = avr_cpu_tcg_init;
-     cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
-     cc->gdb_read_register = avr_cpu_gdb_read_register;
-     cc->gdb_write_register = avr_cpu_gdb_write_register;
-diff --git a/target/cris/cpu.c b/target/cris/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/cpu.c
-+++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
-     ccc->vr = 8;
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
- static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
-     ccc->vr = 9;
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
- static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
-     ccc->vr = 10;
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
- static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
-     ccc->vr = 11;
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
- static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
-     ccc->vr = 17;
-     cc->do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
--    cc->tcg_initialize = cris_initialize_crisv10_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
- static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = cris_disas_set_info;
--    cc->tcg_initialize = cris_initialize_tcg;
-+    cc->tcg_ops.initialize = cris_initialize_tcg;
- }
- #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/cpu.c
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
- #endif
-     cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
-     cc->disas_set_info = hppa_cpu_disas_set_info;
--    cc->tcg_initialize = hppa_translate_init;
-+    cc->tcg_ops.initialize = hppa_translate_init;
-     cc->gdb_num_core_regs = 128;
- }
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
-     cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
-     cc->cpu_exec_enter = x86_cpu_exec_enter;
-     cc->cpu_exec_exit = x86_cpu_exec_exit;
--    cc->tcg_initialize = tcg_x86_init;
-+    cc->tcg_ops.initialize = tcg_x86_init;
-     cc->tlb_fill = x86_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->debug_excp_handler = breakpoint_handler;
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->debug_excp_handler = lm32_debug_excp_handler;
-     cc->disas_set_info = lm32_cpu_disas_set_info;
--    cc->tcg_initialize = lm32_translate_init;
-+    cc->tcg_ops.initialize = lm32_translate_init;
- }
- #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     dc->vmsd = &vmstate_m68k_cpu;
- #endif
-     cc->disas_set_info = m68k_cpu_disas_set_info;
--    cc->tcg_initialize = m68k_tcg_init;
-+    cc->tcg_ops.initialize = m68k_tcg_init;
-     cc->gdb_num_core_regs = 18;
- }
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_num_core_regs = 32 + 27;
-     cc->disas_set_info = mb_disas_set_info;
--    cc->tcg_initialize = mb_tcg_init;
-+    cc->tcg_ops.initialize = mb_tcg_init;
- }
- static const TypeInfo mb_cpu_type_info = {
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
- #endif
-     cc->disas_set_info = mips_cpu_disas_set_info;
- #ifdef CONFIG_TCG
--    cc->tcg_initialize = mips_tcg_init;
-+    cc->tcg_ops.initialize = mips_tcg_init;
-     cc->tlb_fill = mips_cpu_tlb_fill;
- #endif
-diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/moxie/cpu.c
-+++ b/target/moxie/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
-     cc->vmsd = &vmstate_moxie_cpu;
- #endif
-     cc->disas_set_info = moxie_cpu_disas_set_info;
--    cc->tcg_initialize = moxie_translate_init;
-+    cc->tcg_ops.initialize = moxie_translate_init;
- }
- static void moxielite_initfn(Object *obj)
-diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/cpu.c
-+++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_read_register = nios2_cpu_gdb_read_register;
-     cc->gdb_write_register = nios2_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 49;
--    cc->tcg_initialize = nios2_tcg_init;
-+    cc->tcg_ops.initialize = nios2_tcg_init;
- }
- static const TypeInfo nios2_cpu_type_info = {
-diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/cpu.c
-+++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
-     dc->vmsd = &vmstate_openrisc_cpu;
- #endif
-     cc->gdb_num_core_regs = 32 + 3;
--    cc->tcg_initialize = openrisc_translate_init;
-+    cc->tcg_ops.initialize = openrisc_translate_init;
-     cc->disas_set_info = openrisc_disas_set_info;
- }
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_arch_name = riscv_gdb_arch_name;
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
- #ifdef CONFIG_TCG
--    cc->tcg_initialize = riscv_translate_init;
-+    cc->tcg_ops.initialize = riscv_translate_init;
-     cc->tlb_fill = riscv_cpu_tlb_fill;
- #endif
-     device_class_set_props(dc, riscv_cpu_properties);
-diff --git a/target/rx/cpu.c b/target/rx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/rx/cpu.c
-+++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-     cc->gdb_write_register = rx_cpu_gdb_write_register;
-     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
-     cc->disas_set_info = rx_cpu_disas_set_info;
--    cc->tcg_initialize = rx_translate_init;
-+    cc->tcg_ops.initialize = rx_translate_init;
-     cc->tlb_fill = rx_cpu_tlb_fill;
-     cc->gdb_num_core_regs = 26;
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/cpu.c
-+++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
- #endif
-     cc->disas_set_info = s390_cpu_disas_set_info;
- #ifdef CONFIG_TCG
--    cc->tcg_initialize = s390x_translate_init;
-+    cc->tcg_ops.initialize = s390x_translate_init;
-     cc->tlb_fill = s390_cpu_tlb_fill;
- #endif
-diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/cpu.c
-+++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
- #endif
-     cc->disas_set_info = superh_cpu_disas_set_info;
--    cc->tcg_initialize = sh4_translate_init;
-+    cc->tcg_ops.initialize = sh4_translate_init;
-     cc->gdb_num_core_regs = 59;
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->vmsd = &vmstate_sparc_cpu;
- #endif
-     cc->disas_set_info = cpu_sparc_disas_set_info;
--    cc->tcg_initialize = sparc_tcg_init;
-+    cc->tcg_ops.initialize = sparc_tcg_init;
- #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
-     cc->gdb_num_core_regs = 86;
-diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/cpu.c
-+++ b/target/tilegx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = tilegx_cpu_set_pc;
-     cc->tlb_fill = tilegx_cpu_tlb_fill;
-     cc->gdb_num_core_regs = 0;
--    cc->tcg_initialize = tilegx_tcg_init;
-+    cc->tcg_ops.initialize = tilegx_tcg_init;
- }
- static const TypeInfo tilegx_cpu_type_info = {
-diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/cpu.c
-+++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
-     cc->set_pc = tricore_cpu_set_pc;
-     cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
-     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
--    cc->tcg_initialize = tricore_tcg_init;
-+    cc->tcg_ops.initialize = tricore_tcg_init;
-     cc->tlb_fill = tricore_cpu_tlb_fill;
- }
-diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/unicore32/cpu.c
-+++ b/target/unicore32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = uc32_cpu_set_pc;
-     cc->tlb_fill = uc32_cpu_tlb_fill;
-     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
--    cc->tcg_initialize = uc32_translate_init;
-+    cc->tcg_ops.initialize = uc32_translate_init;
-     dc->vmsd = &vmstate_uc32_cpu;
- }
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
- #endif
-     cc->debug_excp_handler = xtensa_breakpoint_handler;
-     cc->disas_set_info = xtensa_cpu_disas_set_info;
--    cc->tcg_initialize = xtensa_translate_init;
-+    cc->tcg_ops.initialize = xtensa_translate_init;
-     dc->vmsd = &vmstate_xtensa_cpu;
- }
-diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate_init.c.inc
-+++ b/target/ppc/translate_init.c.inc
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
- #endif
- #ifdef CONFIG_TCG
--    cc->tcg_initialize = ppc_translate_init;
-+    cc->tcg_ops.initialize = ppc_translate_init;
-     cc->tlb_fill = ppc_cpu_tlb_fill;
- #endif
- #ifndef CONFIG_USER_ONLY
 --
-.25.1
+.34.1

-[PULL 37/46] cpu: move cc->do_interrupt to tcg_ops
+[PULL 02/20] hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
-From: Claudio Fontana <cfontana@suse.de>
+From: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+This is a heavily used function so lets avoid the cost of
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+CPU_GET_CLASS. On the romulus-bmc run it has a modest effect:
   Before: 36.812 s ±  0.506 s
   After:  35.912 s ±  0.168 s
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204163931.7358-10-cfontana@suse.de>
+Message-Id: <20220811151413.3350684-4-alex.bennee@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220923084803.498337-4-clg@kaod.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           |  4 ++--
+ hw/core/cpu-sysemu.c | 5 ++---
- accel/tcg/cpu-exec.c            |  4 ++--
+file changed, 2 insertions(+), 3 deletions(-)
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  4 ++--
  target/arm/cpu_tcg.c            |  9 ++++-----
  target/avr/cpu.c                |  2 +-
  target/avr/helper.c             |  4 ++--
  target/cris/cpu.c               | 12 ++++++------
  target/cris/helper.c            |  4 ++--
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  4 ++--
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 41 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/hw/core/cpu-sysemu.c b/hw/core/cpu-sysemu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/hw/core/cpu-sysemu.c
-+++ b/include/hw/core/cpu.h
++++ b/hw/core/cpu-sysemu.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_debug(CPUState *cpu, vaddr addr)
-     void (*cpu_exec_exit)(CPUState *cpu);
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+ int cpu_asidx_from_attrs(CPUState *cpu, MemTxAttrs attrs)
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+ {
-+    /** @do_interrupt: Callback for interrupt handling. */
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
-+    void (*do_interrupt)(CPUState *cpu);
+     int ret = 0;
-     /**
-      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+-    if (cc->sysemu_ops->asidx_from_attrs) {
-      *
+-        ret = cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
++    if (cpu->cc->sysemu_ops->asidx_from_attrs) {
-  * @parse_features: Callback to parse command line arguments.
++        ret = cpu->cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
+         assert(ret < cpu->num_ases && ret >= 0);
   * @has_work: Callback for checking if there is work to do.
 - * @do_interrupt: Callback for interrupt handling.
   * @do_unaligned_access: Callback for unaligned access handling, if
   * the target defines #TARGET_ALIGNED_ONLY.
   * @do_transaction_failed: Callback for handling failed memory transactions
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int reset_dump_flags;
      bool (*has_work)(CPUState *cpu);
 -    void (*do_interrupt)(CPUState *cpu);
      void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             loop */
  #if defined(TARGET_I386)
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        cc->do_interrupt(cpu);
 +        cc->tcg_ops.do_interrupt(cpu);
  #endif
          *ret = cpu->exception_index;
          cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
          if (replay_exception()) {
              CPUClass *cc = CPU_GET_CLASS(cpu);
              qemu_mutex_lock_iothread();
 -            cc->do_interrupt(cpu);
 +            cc->tcg_ops.do_interrupt(cpu);
              qemu_mutex_unlock_iothread();
              cpu->exception_index = -1;
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
 -    cc->do_interrupt = alpha_cpu_do_interrupt;
 +    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
      cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
   found:
      cs->exception_index = excp_idx;
      env->exception.target_el = target_el;
 -    cc->do_interrupt(cs);
 +    cc->tcg_ops.do_interrupt(cs);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_read_register = arm_cpu_gdb_read_register;
      cc->gdb_write_register = arm_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_interrupt = arm_cpu_do_interrupt;
      cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
      cc->asidx_from_attrs = arm_asidx_from_attrs;
      cc->vmsd = &vmstate_arm_cpu;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
  #if !defined(CONFIG_USER_ONLY)
      cc->do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
 +    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif
  }
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_HARD
          && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
          cs->exception_index = EXCP_IRQ;
 -        cc->do_interrupt(cs);
 +        cc->tcg_ops.do_interrupt(cs);
          ret = true;
      }
      return ret;
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
-     CPUClass *cc = CPU_CLASS(oc);
-     acc->info = data;
--#ifndef CONFIG_USER_ONLY
--    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
--#endif
--
- #ifdef CONFIG_TCG
-     cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-+#ifndef CONFIG_USER_ONLY
-+    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
-+#endif
- #endif /* CONFIG_TCG */
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = avr_cpu_class_by_name;
-     cc->has_work = avr_cpu_has_work;
--    cc->do_interrupt = avr_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
-     cc->dump_state = avr_cpu_dump_state;
-     cc->set_pc = avr_cpu_set_pc;
-diff --git a/target/avr/helper.c b/target/avr/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
-+++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
-         if (cpu_interrupts_enabled(env)) {
-             cs->exception_index = EXCP_RESET;
--            cc->do_interrupt(cs);
-+            cc->tcg_ops.do_interrupt(cs);
-             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
-             int index = ctz32(env->intsrc);
-             cs->exception_index = EXCP_INT(index);
--            cc->do_interrupt(cs);
-+            cc->tcg_ops.do_interrupt(cs);
-             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
-             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
-diff --git a/target/cris/cpu.c b/target/cris/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/cpu.c
-+++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
-     ccc->vr = 8;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
-@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
-     ccc->vr = 9;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
-@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
-     ccc->vr = 10;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
-@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
-     ccc->vr = 11;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
-@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
-     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
-     ccc->vr = 17;
--    cc->do_interrupt = crisv10_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
-     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
- }
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = cris_cpu_class_by_name;
-     cc->has_work = cris_cpu_has_work;
--    cc->do_interrupt = cris_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
-     cc->dump_state = cris_cpu_dump_state;
-     cc->set_pc = cris_cpu_set_pc;
-diff --git a/target/cris/helper.c b/target/cris/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/helper.c
-+++ b/target/cris/helper.c
-@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-         && (env->pregs[PR_CCS] & I_FLAG)
-         && !env->locked_irq) {
-         cs->exception_index = EXCP_IRQ;
--        cc->do_interrupt(cs);
-+        cc->tcg_ops.do_interrupt(cs);
-         ret = true;
-     }
-     if (interrupt_request & CPU_INTERRUPT_NMI) {
-@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-         }
-         if ((env->pregs[PR_CCS] & m_flag_archval)) {
-             cs->exception_index = EXCP_NMI;
--            cc->do_interrupt(cs);
-+            cc->tcg_ops.do_interrupt(cs);
-             ret = true;
-         }
-     }
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/cpu.c
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = hppa_cpu_class_by_name;
-     cc->has_work = hppa_cpu_has_work;
--    cc->do_interrupt = hppa_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
-     cc->dump_state = hppa_cpu_dump_state;
-     cc->set_pc = hppa_cpu_set_pc;
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
- void tcg_cpu_common_class_init(CPUClass *cc)
- {
--    cc->do_interrupt = x86_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = lm32_cpu_class_by_name;
-     cc->has_work = lm32_cpu_has_work;
--    cc->do_interrupt = lm32_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
-     cc->dump_state = lm32_cpu_dump_state;
-     cc->set_pc = lm32_cpu_set_pc;
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = m68k_cpu_class_by_name;
-     cc->has_work = m68k_cpu_has_work;
--    cc->do_interrupt = m68k_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
-     cc->dump_state = m68k_cpu_dump_state;
-     cc->set_pc = m68k_cpu_set_pc;
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = mb_cpu_class_by_name;
-     cc->has_work = mb_cpu_has_work;
--    cc->do_interrupt = mb_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
-     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
-     cc->dump_state = mb_cpu_dump_state;
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = mips_cpu_class_by_name;
-     cc->has_work = mips_cpu_has_work;
--    cc->do_interrupt = mips_cpu_do_interrupt;
-     cc->dump_state = mips_cpu_dump_state;
-     cc->set_pc = mips_cpu_set_pc;
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->disas_set_info = mips_cpu_disas_set_info;
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = mips_tcg_init;
-+    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
--#endif
-+#endif /* CONFIG_TCG */
-     cc->gdb_num_core_regs = 73;
-     cc->gdb_stop_before_watchpoint = true;
-diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/moxie/cpu.c
-+++ b/target/moxie/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = moxie_cpu_class_by_name;
-     cc->has_work = moxie_cpu_has_work;
--    cc->do_interrupt = moxie_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
-     cc->dump_state = moxie_cpu_dump_state;
-     cc->set_pc = moxie_cpu_set_pc;
-     cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
-diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/cpu.c
-+++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = nios2_cpu_class_by_name;
-     cc->has_work = nios2_cpu_has_work;
--    cc->do_interrupt = nios2_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
-     cc->dump_state = nios2_cpu_dump_state;
-     cc->set_pc = nios2_cpu_set_pc;
-diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/cpu.c
-+++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = openrisc_cpu_class_by_name;
-     cc->has_work = openrisc_cpu_has_work;
--    cc->do_interrupt = openrisc_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
-     cc->dump_state = openrisc_cpu_dump_state;
-     cc->set_pc = openrisc_cpu_set_pc;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = riscv_cpu_class_by_name;
-     cc->has_work = riscv_cpu_has_work;
--    cc->do_interrupt = riscv_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
-     cc->dump_state = riscv_cpu_dump_state;
-     cc->set_pc = riscv_cpu_set_pc;
-diff --git a/target/rx/cpu.c b/target/rx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/rx/cpu.c
-+++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-     cc->class_by_name = rx_cpu_class_by_name;
-     cc->has_work = rx_cpu_has_work;
--    cc->do_interrupt = rx_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
-     cc->dump_state = rx_cpu_dump_state;
-     cc->set_pc = rx_cpu_set_pc;
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/cpu.c
-+++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = s390_cpu_class_by_name,
-     cc->has_work = s390_cpu_has_work;
- #ifdef CONFIG_TCG
--    cc->do_interrupt = s390_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
- #endif
-     cc->dump_state = s390_cpu_dump_state;
-     cc->set_pc = s390_cpu_set_pc;
-diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/cpu.c
-+++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = superh_cpu_class_by_name;
-     cc->has_work = superh_cpu_has_work;
--    cc->do_interrupt = superh_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
-     cc->dump_state = superh_cpu_dump_state;
-     cc->set_pc = superh_cpu_set_pc;
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = sparc_cpu_class_by_name;
-     cc->parse_features = sparc_cpu_parse_features;
-     cc->has_work = sparc_cpu_has_work;
--    cc->do_interrupt = sparc_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
-     cc->dump_state = sparc_cpu_dump_state;
- #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
-diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/cpu.c
-+++ b/target/tilegx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = tilegx_cpu_class_by_name;
-     cc->has_work = tilegx_cpu_has_work;
--    cc->do_interrupt = tilegx_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
-     cc->dump_state = tilegx_cpu_dump_state;
-     cc->set_pc = tilegx_cpu_set_pc;
-diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/unicore32/cpu.c
-+++ b/target/unicore32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = uc32_cpu_class_by_name;
-     cc->has_work = uc32_cpu_has_work;
--    cc->do_interrupt = uc32_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
-     cc->dump_state = uc32_cpu_dump_state;
-     cc->set_pc = uc32_cpu_set_pc;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = xtensa_cpu_class_by_name;
-     cc->has_work = xtensa_cpu_has_work;
--    cc->do_interrupt = xtensa_cpu_do_interrupt;
-+    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
-     cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
-     cc->dump_state = xtensa_cpu_dump_state;
-     cc->set_pc = xtensa_cpu_set_pc;
-diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate_init.c.inc
-+++ b/target/ppc/translate_init.c.inc
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = ppc_cpu_class_by_name;
-     cc->has_work = ppc_cpu_has_work;
--    cc->do_interrupt = ppc_cpu_do_interrupt;
-     cc->dump_state = ppc_cpu_dump_state;
-     cc->dump_statistics = ppc_cpu_dump_statistics;
-     cc->set_pc = ppc_cpu_set_pc;
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = ppc_translate_init;
-     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-+    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
-     cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 --
-.25.1
+.34.1

-[PULL 34/46] cpu: Move tlb_fill to tcg_ops
+[PULL 03/20] cputlb: used cached CPUClass in our hot-paths
-From: Eduardo Habkost <ehabkost@redhat.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-[claudio: wrapped target code in CONFIG_TCG]
+Before: 35.912 s ±  0.168 s
   After: 35.565 s ±  0.087 s
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204163931.7358-7-cfontana@suse.de>
+Message-Id: <20220811151413.3350684-5-alex.bennee@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220923084803.498337-5-clg@kaod.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 21 ++++++++++++---------
+ accel/tcg/cputlb.c | 15 ++++++---------
- accel/tcg/cputlb.c              |  7 ++++---
+file changed, 6 insertions(+), 9 deletions(-)
  accel/tcg/user-exec.c           |  6 +++---
  target/alpha/cpu.c              |  2 +-
  target/arm/cpu.c                |  2 +-
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  2 +-
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/moxie/cpu.c              |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/tricore/cpu.c            |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 42 insertions(+), 38 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-     void (*cpu_exec_exit)(CPUState *cpu);
-     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-+    /**
-+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-+     *
-+     * For system mode, if the access is valid, call tlb_set_page
-+     * and return true; if the access is invalid, and probe is
-+     * true, return false; otherwise raise an exception and do
-+     * not return.  For user-only mode, always raise an exception
-+     * and do not return.
-+     */
-+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-+                     MMUAccessType access_type, int mmu_idx,
-+                     bool probe, uintptr_t retaddr);
- } TcgCpuOperations;
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  *       If the target behaviour here is anything other than "set
-  *       the PC register to the value passed in" then the target must
-  *       also implement the synchronize_from_tb hook.
-- * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
-- *       address fault.  For system mode, if the access is valid, call
-- *       tlb_set_page and return true; if the access is invalid, and
-- *       probe is true, return false; otherwise raise an exception and
-- *       do not return.  For user-only mode, always raise an exception
-- *       and do not return.
-  * @get_phys_page_debug: Callback for obtaining a physical address.
-  * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
-  *       associated memory transaction attributes to use for the access.
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
-                                Error **errp);
-     void (*set_pc)(CPUState *cpu, vaddr value);
--    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
--                     MMUAccessType access_type, int mmu_idx,
--                     bool probe, uintptr_t retaddr);
-     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
-     hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
-                                         MemTxAttrs *attrs);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
  static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
                       MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
  {
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
      bool ok;
      /*
       * This is not a probe, so only valid return is success; failure
       * should result in exception + longjmp to the cpu loop.
       */
--    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
+-    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
-+    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
+-                               access_type, mmu_idx, false, retaddr);
-+                              access_type, mmu_idx, false, retaddr);
++    ok = cpu->cc->tcg_ops->tlb_fill(cpu, addr, size,
 +                                    access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
+@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
+                                         MMUAccessType access_type,
+                                         int mmu_idx, uintptr_t retaddr)
+ {
+-    CPUClass *cc = CPU_GET_CLASS(cpu);
+-
+-    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
++    cpu->cc->tcg_ops->do_unaligned_access(cpu, addr, access_type,
++                                          mmu_idx, retaddr);
+ }
+ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 @@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
+     if (!tlb_hit_page(tlb_addr, page_addr)) {
+         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
              CPUState *cs = env_cpu(env);
-             CPUClass *cc = CPU_GET_CLASS(cs);
+-            CPUClass *cc = CPU_GET_CLASS(cs);
--            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
+-            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
--                              mmu_idx, nonfault, retaddr)) {
+-                                       mmu_idx, nonfault, retaddr)) {
-+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
++            if (!cs->cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-+                                      mmu_idx, nonfault, retaddr)) {
++                                           mmu_idx, nonfault, retaddr)) {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
                  return TLB_INVALID_MASK;
-diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/user-exec.c
-+++ b/accel/tcg/user-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
-     clear_helper_retaddr();
-     cc = CPU_GET_CLASS(cpu);
--    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
-+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
-     g_assert_not_reached();
- }
-@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-         } else {
-             CPUState *cpu = env_cpu(env);
-             CPUClass *cc = CPU_GET_CLASS(cpu);
--            cc->tlb_fill(cpu, addr, fault_size, access_type,
--                         MMU_USER_IDX, false, ra);
-+            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
-+                                 MMU_USER_IDX, false, ra);
-             g_assert_not_reached();
-         }
-     }
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = alpha_cpu_set_pc;
-     cc->gdb_read_register = alpha_cpu_gdb_read_register;
-     cc->gdb_write_register = alpha_cpu_gdb_write_register;
--    cc->tlb_fill = alpha_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
-     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.initialize = arm_translate_init;
-     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
--    cc->tlb_fill = arm_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-     cc->debug_excp_handler = arm_debug_excp_handler;
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
-diff --git a/target/avr/cpu.c b/target/avr/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/cpu.c
-+++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = avr_cpu_set_pc;
-     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
-     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
--    cc->tlb_fill = avr_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
-     cc->vmsd = &vms_avr_cpu;
-     cc->disas_set_info = avr_cpu_disas_set_info;
-     cc->tcg_ops.initialize = avr_cpu_tcg_init;
-diff --git a/target/cris/cpu.c b/target/cris/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/cris/cpu.c
-+++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = cris_cpu_set_pc;
-     cc->gdb_read_register = cris_cpu_gdb_read_register;
-     cc->gdb_write_register = cris_cpu_gdb_write_register;
--    cc->tlb_fill = cris_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_cris_cpu;
-diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/hppa/cpu.c
-+++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
-     cc->gdb_read_register = hppa_cpu_gdb_read_register;
-     cc->gdb_write_register = hppa_cpu_gdb_write_register;
--    cc->tlb_fill = hppa_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_hppa_cpu;
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
-     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-     cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
-     cc->tcg_ops.initialize = tcg_x86_init;
--    cc->tlb_fill = x86_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->debug_excp_handler = breakpoint_handler;
- #endif
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/lm32/cpu.c
-+++ b/target/lm32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = lm32_cpu_set_pc;
-     cc->gdb_read_register = lm32_cpu_gdb_read_register;
-     cc->gdb_write_register = lm32_cpu_gdb_write_register;
--    cc->tlb_fill = lm32_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_lm32_cpu;
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->set_pc = m68k_cpu_set_pc;
-     cc->gdb_read_register = m68k_cpu_gdb_read_register;
-     cc->gdb_write_register = m68k_cpu_gdb_write_register;
--    cc->tlb_fill = m68k_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
- #if defined(CONFIG_SOFTMMU)
-     cc->do_transaction_failed = m68k_cpu_transaction_failed;
-     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
-     cc->gdb_read_register = mb_cpu_gdb_read_register;
-     cc->gdb_write_register = mb_cpu_gdb_write_register;
--    cc->tlb_fill = mb_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_transaction_failed = mb_cpu_transaction_failed;
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->tcg_ops.initialize = mips_tcg_init;
-     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
--    cc->tlb_fill = mips_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
- #endif
-     cc->gdb_num_core_regs = 73;
-diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/moxie/cpu.c
-+++ b/target/moxie/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
-     cc->do_interrupt = moxie_cpu_do_interrupt;
-     cc->dump_state = moxie_cpu_dump_state;
-     cc->set_pc = moxie_cpu_set_pc;
--    cc->tlb_fill = moxie_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_moxie_cpu;
-diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/cpu.c
-+++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-     cc->dump_state = nios2_cpu_dump_state;
-     cc->set_pc = nios2_cpu_set_pc;
-     cc->disas_set_info = nios2_cpu_disas_set_info;
--    cc->tlb_fill = nios2_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
-diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/cpu.c
-+++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->set_pc = openrisc_cpu_set_pc;
-     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
-     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
--    cc->tlb_fill = openrisc_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_openrisc_cpu;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_arch_name = riscv_gdb_arch_name;
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-     cc->tcg_ops.initialize = riscv_translate_init;
--    cc->tlb_fill = riscv_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
-     device_class_set_props(dc, riscv_cpu_properties);
- }
-diff --git a/target/rx/cpu.c b/target/rx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/rx/cpu.c
-+++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
-     cc->disas_set_info = rx_cpu_disas_set_info;
-     cc->tcg_ops.initialize = rx_translate_init;
--    cc->tlb_fill = rx_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
-     cc->gdb_num_core_regs = 26;
-     cc->gdb_core_xml_file = "rx-core.xml";
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/s390x/cpu.c
-+++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-     cc->disas_set_info = s390_cpu_disas_set_info;
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = s390x_translate_init;
--    cc->tlb_fill = s390_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
- #endif
-     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
-diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/cpu.c
-+++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
-     cc->gdb_read_register = superh_cpu_gdb_read_register;
-     cc->gdb_write_register = superh_cpu_gdb_write_register;
--    cc->tlb_fill = superh_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_unaligned_access = superh_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
-     cc->gdb_read_register = sparc_cpu_gdb_read_register;
-     cc->gdb_write_register = sparc_cpu_gdb_write_register;
--    cc->tlb_fill = sparc_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
-     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
-diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/cpu.c
-+++ b/target/tilegx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
-     cc->dump_state = tilegx_cpu_dump_state;
-     cc->set_pc = tilegx_cpu_set_pc;
--    cc->tlb_fill = tilegx_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
-     cc->gdb_num_core_regs = 0;
-     cc->tcg_ops.initialize = tilegx_tcg_init;
- }
-diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/tricore/cpu.c
-+++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
-     cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
-     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
-     cc->tcg_ops.initialize = tricore_tcg_init;
--    cc->tlb_fill = tricore_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
- }
- #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
-diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/unicore32/cpu.c
-+++ b/target/unicore32/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
-     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
-     cc->dump_state = uc32_cpu_dump_state;
-     cc->set_pc = uc32_cpu_set_pc;
--    cc->tlb_fill = uc32_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
-     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
-     cc->tcg_ops.initialize = uc32_translate_init;
-     dc->vmsd = &vmstate_uc32_cpu;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
-     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
-     cc->gdb_stop_before_watchpoint = true;
--    cc->tlb_fill = xtensa_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate_init.c.inc
-+++ b/target/ppc/translate_init.c.inc
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
- #ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = ppc_translate_init;
-     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
--    cc->tlb_fill = ppc_cpu_tlb_fill;
-+    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
-     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 --
-.25.1
+.34.1

-[PULL 26/46] tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
+[PULL 04/20] accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
-As noted in several comments, 8 regs is not enough for 32-bit
+This structure will shortly contain more than just
-to perform calls, as currently implemented.  Shortly, we will
+data for accessing MMIO.  Rename the 'addr' member
-rearrange the encoding which will make 32 regs impossible.
+to 'xlat_section' to more clearly indicate its purpose.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target.h     | 32 +++++---------------------------
+ include/exec/cpu-defs.h    |  22 ++++----
- tcg/tci/tcg-target.c.inc | 26 --------------------------
+ accel/tcg/cputlb.c         | 102 +++++++++++++++++++------------------
-files changed, 5 insertions(+), 53 deletions(-)
+ target/arm/mte_helper.c    |  14 ++---
  target/arm/sve_helper.c    |   4 +-
  target/arm/translate-a64.c |   2 +-
 files changed, 73 insertions(+), 71 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
+--- a/include/exec/cpu-defs.h
-+++ b/tcg/tci/tcg-target.h
++++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef uint64_t target_ulong;
- #define TCG_TARGET_HAS_mulu2_i32        1
+ #  endif
- #endif /* TCG_TARGET_REG_BITS == 64 */
+ # endif
--/* Number of registers available.
++/* Minimalized TLB entry for use by TCG fast path. */
--   For 32 bit hosts, we need more than 8 registers (call arguments). */
+ typedef struct CPUTLBEntry {
--/* #define TCG_TARGET_NB_REGS 8 */
+     /* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
-+/* Number of registers available. */
+        bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
- #define TCG_TARGET_NB_REGS 16
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
--/* #define TCG_TARGET_NB_REGS 32 */
+ QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
- /* List of registers which are used by TCG. */
- typedef enum {
+-/* The IOTLB is not accessed directly inline by generated TCG code,
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+- * so the CPUIOTLBEntry layout is not as critical as that of the
-     TCG_REG_R5,
+- * CPUTLBEntry. (This is also why we don't want to combine the two
-     TCG_REG_R6,
+- * structs into one.)
-     TCG_REG_R7,
++/*
--#if TCG_TARGET_NB_REGS >= 16
++ * The full TLB entry, which is not accessed by generated TCG code,
-     TCG_REG_R8,
++ * so the layout is not as critical as that of CPUTLBEntry. This is
-     TCG_REG_R9,
++ * also why we don't want to combine the two structs.
-     TCG_REG_R10,
+  */
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+-typedef struct CPUIOTLBEntry {
-     TCG_REG_R13,
++typedef struct CPUTLBEntryFull {
-     TCG_REG_R14,
+     /*
-     TCG_REG_R15,
+-     * @addr contains:
--#if TCG_TARGET_NB_REGS >= 32
++     * @xlat_section contains:
--    TCG_REG_R16,
+      *  - in the lower TARGET_PAGE_BITS, a physical section number
--    TCG_REG_R17,
+      *  - with the lower TARGET_PAGE_BITS masked off, an offset which
--    TCG_REG_R18,
+      *    must be added to the virtual address to obtain:
--    TCG_REG_R19,
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUIOTLBEntry {
--    TCG_REG_R20,
+      *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
--    TCG_REG_R21,
+      *     + the offset within the target MemoryRegion (otherwise)
--    TCG_REG_R22,
+      */
--    TCG_REG_R23,
+-    hwaddr addr;
--    TCG_REG_R24,
++    hwaddr xlat_section;
--    TCG_REG_R25,
+     MemTxAttrs attrs;
--    TCG_REG_R26,
+-} CPUIOTLBEntry;
--    TCG_REG_R27,
++} CPUTLBEntryFull;
--    TCG_REG_R28,
--    TCG_REG_R29,
+ /*
--    TCG_REG_R30,
+  * Data elements that are per MMU mode, minus the bits accessed by
--    TCG_REG_R31,
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBDesc {
--#endif
+     size_t vindex;
--#endif
+     /* The tlb victim table, in two parts.  */
-+
+     CPUTLBEntry vtable[CPU_VTLB_SIZE];
-+    TCG_AREG0 = TCG_REG_R14,
+-    CPUIOTLBEntry viotlb[CPU_VTLB_SIZE];
-+    TCG_REG_CALL_STACK = TCG_REG_R15,
+-    /* The iotlb.  */
-+
+-    CPUIOTLBEntry *iotlb;
-     /* Special value UINT8_MAX is used by TCI to encode constant values. */
++    CPUTLBEntryFull vfulltlb[CPU_VTLB_SIZE];
-     TCG_CONST = UINT8_MAX
++    CPUTLBEntryFull *fulltlb;
- } TCGReg;
+ } CPUTLBDesc;
--#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
+ /*
--
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
  /* Used for function call generation. */
 -#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
  #define TCG_TARGET_CALL_STACK_OFFSET    0
  #define TCG_TARGET_STACK_ALIGN          16
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
+--- a/accel/tcg/cputlb.c
-+++ b/tcg/tci/tcg-target.c.inc
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
-     TCG_REG_R5,
+     }
-     TCG_REG_R6,
-     TCG_REG_R7,
+     g_free(fast->table);
--#if TCG_TARGET_NB_REGS >= 16
+-    g_free(desc->iotlb);
-     TCG_REG_R8,
++    g_free(desc->fulltlb);
-     TCG_REG_R9,
-     TCG_REG_R10,
+     tlb_window_reset(desc, now, 0);
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
+     /* desc->n_used_entries is cleared by the caller */
-     TCG_REG_R13,
+     fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-     TCG_REG_R14,
+     fast->table = g_try_new(CPUTLBEntry, new_size);
-     TCG_REG_R15,
+-    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
--#endif
++    desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
- };
+     /*
- #if MAX_OPC_PARAM_IARGS != 6
+      * If the allocations fail, try smaller sizes. We just freed some
-@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
- #if TCG_TARGET_REG_BITS == 32
+      * allocations to fail though, so we progressively reduce the allocation
-     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+      * size, aborting if we cannot even allocate the smallest TLB we support.
-     TCG_REG_R7,
+      */
--#if TCG_TARGET_NB_REGS >= 16
+-    while (fast->table == NULL || desc->iotlb == NULL) {
-     TCG_REG_R8,
++    while (fast->table == NULL || desc->fulltlb == NULL) {
-     TCG_REG_R9,
+         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
-     TCG_REG_R10,
+             error_report("%s: %s", __func__, strerror(errno));
-     TCG_REG_R11,
+             abort();
-     TCG_REG_R12,
+@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
--#else
+         fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
--# error Too few input registers available
--#endif
+         g_free(fast->table);
 -        g_free(desc->iotlb);
 +        g_free(desc->fulltlb);
          fast->table = g_try_new(CPUTLBEntry, new_size);
 -        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
 +        desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
      desc->n_used_entries = 0;
      fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
      fast->table = g_new(CPUTLBEntry, n_entries);
 -    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
 +    desc->fulltlb = g_new(CPUTLBEntryFull, n_entries);
      tlb_mmu_flush_locked(desc, fast);
  }
@@ -XXX,XX +XXX,XX @@ void tlb_destroy(CPUState *cpu)
          CPUTLBDescFast *fast = &env_tlb(env)->f[i];
          g_free(fast->table);
 -        g_free(desc->iotlb);
 +        g_free(desc->fulltlb);
      }
  }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
          /* Evict the old entry into the victim tlb.  */
          copy_tlb_helper_locked(tv, te);
 -        desc->viotlb[vidx] = desc->iotlb[index];
 +        desc->vfulltlb[vidx] = desc->fulltlb[index];
          tlb_n_used_entries_dec(env, mmu_idx);
      }
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
       * subtract here is that of the page base, and not the same as the
       * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
       */
 -    desc->iotlb[index].addr = iotlb - vaddr_page;
 -    desc->iotlb[index].attrs = attrs;
 +    desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
 +    desc->fulltlb[index].attrs = attrs;
      /* Now calculate the new entry */
      tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
      }
  }
 -static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
 +static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
                           int mmu_idx, target_ulong addr, uintptr_t retaddr,
                           MMUAccessType access_type, MemOp op)
  {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      bool locked = false;
      MemTxResult r;
 -    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
 +    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
      mr = section->mr;
 -    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 +    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
      cpu->mem_io_pc = retaddr;
      if (!cpu->can_do_io) {
          cpu_io_recompile(cpu, retaddr);
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
          qemu_mutex_lock_iothread();
          locked = true;
      }
 -    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
 +    r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs);
      if (r != MEMTX_OK) {
          hwaddr physaddr = mr_offset +
              section->offset_within_address_space -
              section->offset_within_region;
          cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
 -                               mmu_idx, iotlbentry->attrs, r, retaddr);
 +                               mmu_idx, full->attrs, r, retaddr);
      }
      if (locked) {
          qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
  }
  /*
 - * Save a potentially trashed IOTLB entry for later lookup by plugin.
 - * This is read by tlb_plugin_lookup if the iotlb entry doesn't match
 + * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
 + * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
   * because of the side effect of io_writex changing memory layout.
   */
  static void save_iotlb_data(CPUState *cs, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static void save_iotlb_data(CPUState *cs, hwaddr addr,
  #endif
- };
+ }
-@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+-static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-     "r05",
++static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
-     "r06",
+                       int mmu_idx, uint64_t val, target_ulong addr,
-     "r07",
+                       uintptr_t retaddr, MemOp op)
--#if TCG_TARGET_NB_REGS >= 16
+ {
-     "r08",
+@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-     "r09",
+     bool locked = false;
-     "r10",
+     MemTxResult r;
-@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
-     "r13",
+-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-     "r14",
++    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
-     "r15",
+     mr = section->mr;
--#if TCG_TARGET_NB_REGS >= 32
+-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
--    "r16",
++    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
--    "r17",
+     if (!cpu->can_do_io) {
--    "r18",
+         cpu_io_recompile(cpu, retaddr);
--    "r19",
+     }
--    "r20",
+@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
--    "r21",
+      * The memory_region_dispatch may trigger a flush/resize
--    "r22",
+      * so for plugins we save the iotlb_data just in case.
--    "r23",
+      */
--    "r24",
+-    save_iotlb_data(cpu, iotlbentry->addr, section, mr_offset);
--    "r25",
++    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
--    "r26",
--    "r27",
+     if (!qemu_mutex_iothread_locked()) {
--    "r28",
+         qemu_mutex_lock_iothread();
--    "r29",
+         locked = true;
--    "r30",
+     }
--    "r31"
+-    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
--#endif
++    r = memory_region_dispatch_write(mr, mr_offset, val, op, full->attrs);
--#endif
+     if (r != MEMTX_OK) {
- };
+         hwaddr physaddr = mr_offset +
              section->offset_within_address_space -
              section->offset_within_region;
          cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
 -                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
 +                               MMU_DATA_STORE, mmu_idx, full->attrs, r,
                                 retaddr);
      }
      if (locked) {
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
              copy_tlb_helper_locked(vtlb, &tmptlb);
              qemu_spin_unlock(&env_tlb(env)->c.lock);
 -            CPUIOTLBEntry tmpio, *io = &env_tlb(env)->d[mmu_idx].iotlb[index];
 -            CPUIOTLBEntry *vio = &env_tlb(env)->d[mmu_idx].viotlb[vidx];
 -            tmpio = *io; *io = *vio; *vio = tmpio;
 +            CPUTLBEntryFull *f1 = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 +            CPUTLBEntryFull *f2 = &env_tlb(env)->d[mmu_idx].vfulltlb[vidx];
 +            CPUTLBEntryFull tmpf;
 +            tmpf = *f1; *f1 = *f2; *f2 = tmpf;
              return true;
          }
      }
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
                   (ADDR) & TARGET_PAGE_MASK)
  static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
 -                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
 +                           CPUTLBEntryFull *full, uintptr_t retaddr)
  {
 -    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
 +    ram_addr_t ram_addr = mem_vaddr + full->xlat_section;
      trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
      /* Handle clean RAM pages.  */
      if (unlikely(flags & TLB_NOTDIRTY)) {
          uintptr_t index = tlb_index(env, mmu_idx, addr);
 -        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 +        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 -        notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
 +        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
          flags &= ~TLB_NOTDIRTY;
      }
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
          uintptr_t index = tlb_index(env, mmu_idx, addr);
 -        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 +        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
          /* Handle watchpoints.  */
          if (flags & TLB_WATCHPOINT) {
              int wp_access = (access_type == MMU_DATA_STORE
                               ? BP_MEM_WRITE : BP_MEM_READ);
              cpu_check_watchpoint(env_cpu(env), addr, size,
 -                                 iotlbentry->attrs, wp_access, retaddr);
 +                                 full->attrs, wp_access, retaddr);
          }
          /* Handle clean RAM pages.  */
          if (flags & TLB_NOTDIRTY) {
 -            notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
 +            notdirty_write(env_cpu(env), addr, 1, full, retaddr);
          }
      }
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
   * should have just filled the TLB. The one corner case is io_writex
   * which can cause TLB flushes and potential resizing of the TLBs
   * losing the information we need. In those cases we need to recover
 - * data from a copy of the iotlbentry. As long as this always occurs
 + * data from a copy of the CPUTLBEntryFull. As long as this always occurs
   * from the same thread (which a mem callback will be) this is safe.
   */
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
      if (likely(tlb_hit(tlb_addr, addr))) {
          /* We must have an iotlb entry for MMIO */
          if (tlb_addr & TLB_MMIO) {
 -            CPUIOTLBEntry *iotlbentry;
 -            iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 +            CPUTLBEntryFull *full;
 +            full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
              data->is_io = true;
 -            data->v.io.section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
 -            data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
 +            data->v.io.section =
 +                iotlb_to_section(cpu, full->xlat_section, full->attrs);
 +            data->v.io.offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
          } else {
              data->is_io = false;
              data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
      if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
          notdirty_write(env_cpu(env), addr, size,
 -                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
 +                       &env_tlb(env)->d[mmu_idx].fulltlb[index], retaddr);
      }
      return hostaddr;
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
 -        CPUIOTLBEntry *iotlbentry;
 +        CPUTLBEntryFull *full;
          bool need_swap;
          /* For anything that is unaligned, recurse through full_load.  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
              goto do_unaligned_access;
          }
 -        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 +        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
          /* Handle watchpoints.  */
          if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
 -                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
 +                                 full->attrs, BP_MEM_READ, retaddr);
          }
          need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
          /* Handle I/O access.  */
          if (likely(tlb_addr & TLB_MMIO)) {
 -            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
 +            return io_readx(env, full, mmu_idx, addr, retaddr,
                              access_type, op ^ (need_swap * MO_BSWAP));
          }
@@ -XXX,XX +XXX,XX @@ store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
       */
      if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
          cpu_check_watchpoint(env_cpu(env), addr, size - size2,
 -                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
 +                             env_tlb(env)->d[mmu_idx].fulltlb[index].attrs,
                               BP_MEM_WRITE, retaddr);
      }
      if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
          cpu_check_watchpoint(env_cpu(env), page2, size2,
 -                             env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
 +                             env_tlb(env)->d[mmu_idx].fulltlb[index2].attrs,
                               BP_MEM_WRITE, retaddr);
      }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
      /* Handle anything that isn't just a straight memory access.  */
      if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
 -        CPUIOTLBEntry *iotlbentry;
 +        CPUTLBEntryFull *full;
          bool need_swap;
          /* For anything that is unaligned, recurse through byte stores.  */
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              goto do_unaligned_access;
          }
 -        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 +        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
          /* Handle watchpoints.  */
          if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
              /* On watchpoint hit, this will longjmp out.  */
              cpu_check_watchpoint(env_cpu(env), addr, size,
 -                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
 +                                 full->attrs, BP_MEM_WRITE, retaddr);
          }
          need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
          /* Handle I/O access.  */
          if (tlb_addr & TLB_MMIO) {
 -            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
 +            io_writex(env, full, mmu_idx, val, addr, retaddr,
                        op ^ (need_swap * MO_BSWAP));
              return;
          }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
          /* Handle clean RAM pages.  */
          if (tlb_addr & TLB_NOTDIRTY) {
 -            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
 +            notdirty_write(env_cpu(env), addr, size, full, retaddr);
          }
          haddr = (void *)((uintptr_t)addr + entry->addend);
 diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mte_helper.c
 +++ b/target/arm/mte_helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
      return tags + index;
  #else
      uintptr_t index;
 -    CPUIOTLBEntry *iotlbentry;
 +    CPUTLBEntryFull *full;
      int in_page, flags;
      ram_addr_t ptr_ra;
      hwaddr ptr_paddr, tag_paddr, xlat;
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
      assert(!(flags & TLB_INVALID_MASK));
      /*
 -     * Find the iotlbentry for ptr.  This *must* be present in the TLB
 +     * Find the CPUTLBEntryFull for ptr.  This *must* be present in the TLB
       * because we just found the mapping.
       * TODO: Perhaps there should be a cputlb helper that returns a
       * matching tlb entry + iotlb entry.
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
          g_assert(tlb_hit(comparator, ptr));
      }
  # endif
 -    iotlbentry = &env_tlb(env)->d[ptr_mmu_idx].iotlb[index];
 +    full = &env_tlb(env)->d[ptr_mmu_idx].fulltlb[index];
      /* If the virtual page MemAttr != Tagged, access unchecked. */
 -    if (!arm_tlb_mte_tagged(&iotlbentry->attrs)) {
 +    if (!arm_tlb_mte_tagged(&full->attrs)) {
          return NULL;
      }
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
          int wp = ptr_access == MMU_DATA_LOAD ? BP_MEM_READ : BP_MEM_WRITE;
          assert(ra != 0);
          cpu_check_watchpoint(env_cpu(env), ptr, ptr_size,
 -                             iotlbentry->attrs, wp, ra);
 +                             full->attrs, wp, ra);
      }
      /*
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
      tag_paddr = ptr_paddr >> (LOG2_TAG_GRANULE + 1);
      /* Look up the address in tag space. */
 -    tag_asi = iotlbentry->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
 +    tag_asi = full->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
      tag_as = cpu_get_address_space(env_cpu(env), tag_asi);
      mr = address_space_translate(tag_as, tag_paddr, &xlat, NULL,
                                   tag_access == MMU_DATA_STORE,
 -                                 iotlbentry->attrs);
 +                                 full->attrs);
      /*
       * Note that @mr will never be NULL.  If there is nothing in the address
 diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/sve_helper.c
 +++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
          g_assert(tlb_hit(comparator, addr));
  # endif
 -        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
 -        info->attrs = iotlbentry->attrs;
 +        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 +        info->attrs = full->attrs;
      }
  #endif
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool is_guarded_page(CPUARMState *env, DisasContext *s)
+      * table entry even for that case.
+      */
+     return (tlb_hit(entry->addr_code, addr) &&
+-            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].iotlb[index].attrs));
++            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].fulltlb[index].attrs));
+ #endif
+ }
 --
-.25.1
+.34.1

-[PULL 42/46] cpu: move debug_check_watchpoint to tcg_ops
+[PULL 05/20] accel/tcg: Drop addr member from SavedIOTLB
-From: Claudio Fontana <cfontana@suse.de>
+This field is only written, not read; remove it.
-commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
-commit 3826121d9298 ("target-arm: Implement checking of fired")
-introduced an ARM-specific hack for cpu_check_watchpoint.
-Make debug_check_watchpoint optional, and move it to tcg_ops.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20210204163931.7358-15-cfontana@suse.de>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 9 ++++++---
+ include/hw/core/cpu.h | 1 -
- accel/tcg/user-exec.c | 3 ++-
+ accel/tcg/cputlb.c    | 7 +++----
- hw/core/cpu.c         | 9 ---------
+files changed, 3 insertions(+), 5 deletions(-)
  softmmu/physmem.c     | 4 ++--
  target/arm/cpu.c      | 4 ++--
 files changed, 12 insertions(+), 17 deletions(-)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ struct CPUWatchpoint {
   * the memory regions get moved around  by io_writex.
   */
  typedef struct SavedIOTLB {
 -    hwaddr addr;
      MemoryRegionSection *section;
      hwaddr mr_offset;
  } SavedIOTLB;
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
   * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
   * because of the side effect of io_writex changing memory layout.
   */
 -static void save_iotlb_data(CPUState *cs, hwaddr addr,
 -                            MemoryRegionSection *section, hwaddr mr_offset)
 +static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
 +                            hwaddr mr_offset)
  {
  #ifdef CONFIG_PLUGIN
      SavedIOTLB *saved = &cs->saved_iotlb;
 -    saved->addr = addr;
      saved->section = section;
      saved->mr_offset = mr_offset;
  #endif
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
       * The memory_region_dispatch may trigger a flush/resize
       * so for plugins we save the iotlb_data just in case.
       */
-     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+-    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
++    save_iotlb_data(cpu, section, mr_offset);
-+    /**
-+     * @debug_check_watchpoint: return true if the architectural
+     if (!qemu_mutex_iothread_locked()) {
-+     * watchpoint whose address has matched should really fire, used by ARM
+         qemu_mutex_lock_iothread();
 +     */
 +    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 +
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
   *       a memory access with the specified memory transaction attributes.
   * @gdb_read_register: Callback for letting GDB read a register.
   * @gdb_write_register: Callback for letting GDB write a register.
 - * @debug_check_watchpoint: Callback: return true if the architectural
 - *       watchpoint whose address has matched should really fire.
   * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
   * 64-bit VM coredump.
   * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
      int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
      int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
 -    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
      int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                              int cpuid, void *opaque);
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
      clear_helper_retaddr();
      cc = CPU_GET_CLASS(cpu);
 -    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
 +    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
 +                         MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
      return 0;
  }
 -static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
 -{
 -    /* If no extra check is required, QEMU watchpoint match can be considered
 -     * as an architectural match.
 -     */
 -    return true;
 -}
 -
  static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
  {
      return target_words_bigendian();
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
      k->gdb_read_register = cpu_common_gdb_read_register;
      k->gdb_write_register = cpu_common_gdb_write_register;
      k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
 -    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
      set_bit(DEVICE_CATEGORY_CPU, dc->categories);
      dc->realize = cpu_common_realizefn;
      dc->unrealize = cpu_common_unrealizefn;
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
              wp->hitaddr = MAX(addr, wp->vaddr);
              wp->hitattrs = attrs;
              if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU &&
 -                    !cc->debug_check_watchpoint(cpu, wp)) {
 +                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
 +                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                      wp->flags &= ~BP_WATCHPOINT_HIT;
                      continue;
                  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
 -    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
  #if !defined(CONFIG_USER_ONLY)
 +    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
      cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
 -    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 +    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
  }
 --
-.25.1
+.34.1

-[PULL 27/46] tcg/tci: Fix TCG_REG_R4 misusage
+[PULL 06/20] accel/tcg: Suppress auto-invalidate in probe_access_internal
-This was removed from tcg_target_reg_alloc_order and
+When PAGE_WRITE_INV is set when calling tlb_set_page,
-tcg_target_call_iarg_regs on the assumption that it
+we immediately set TLB_INVALID_MASK in order to force
-was the stack.  This was incorrectly copied from i386.
+tlb_fill to be called on the next lookup.  Here in
-For tci, the stack is R15.
+probe_access_internal, we have just called tlb_fill
 and eliminated true misses, thus the lookup must be valid.
-By adding R4 back to tcg_target_call_iarg_regs, adjust the other
+This allows us to remove a warning comment from s390x.
-entries so that 6 (or 12) entries are still present in the array,
+There doesn't seem to be a reason to change the code though.
 and adjust the numbers in the interpreter.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                | 8 ++++----
+ accel/tcg/cputlb.c            | 10 +++++++++-
- tcg/tci/tcg-target.c.inc | 7 +------
+ target/s390x/tcg/mem_helper.c |  4 ----
-files changed, 5 insertions(+), 10 deletions(-)
+files changed, 9 insertions(+), 5 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/accel/tcg/cputlb.c
-+++ b/tcg/tci.c
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-                                           tci_read_reg(regs, TCG_REG_R1),
+     }
-                                           tci_read_reg(regs, TCG_REG_R2),
+     tlb_addr = tlb_read_ofs(entry, elt_ofs);
-                                           tci_read_reg(regs, TCG_REG_R3),
-+                                          tci_read_reg(regs, TCG_REG_R4),
++    flags = TLB_FLAGS_MASK;
-                                           tci_read_reg(regs, TCG_REG_R5),
+     page_addr = addr & TARGET_PAGE_MASK;
-                                           tci_read_reg(regs, TCG_REG_R6),
+     if (!tlb_hit_page(tlb_addr, page_addr)) {
-                                           tci_read_reg(regs, TCG_REG_R7),
+         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
-                                           tci_read_reg(regs, TCG_REG_R8),
+@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
-                                           tci_read_reg(regs, TCG_REG_R9),
-                                           tci_read_reg(regs, TCG_REG_R10),
+             /* TLB resize via tlb_fill may have moved the entry.  */
--                                          tci_read_reg(regs, TCG_REG_R11),
+             entry = tlb_entry(env, mmu_idx, addr);
--                                          tci_read_reg(regs, TCG_REG_R12));
++
-+                                          tci_read_reg(regs, TCG_REG_R11));
++            /*
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
++             * With PAGE_WRITE_INV, we set TLB_INVALID_MASK immediately,
-             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
++             * to force the next access through tlb_fill.  We've just
 +             * called tlb_fill, so we know that this entry *is* valid.
 +             */
 +            flags &= ~TLB_INVALID_MASK;
          }
          tlb_addr = tlb_read_ofs(entry, elt_ofs);
      }
 -    flags = tlb_addr & TLB_FLAGS_MASK;
 +    flags &= tlb_addr;
      /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
      if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
 diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/tcg/mem_helper.c
 +++ b/target/s390x/tcg/mem_helper.c
@@ -XXX,XX +XXX,XX @@ static int s390_probe_access(CPUArchState *env, target_ulong addr, int size,
  #else
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     int flags;
-                                           tci_read_reg(regs, TCG_REG_R1),
-                                           tci_read_reg(regs, TCG_REG_R2),
+-    /*
-                                           tci_read_reg(regs, TCG_REG_R3),
+-     * For !CONFIG_USER_ONLY, we cannot rely on TLB_INVALID_MASK or haddr==NULL
--                                          tci_read_reg(regs, TCG_REG_R5),
+-     * to detect if there was an exception during tlb_fill().
--                                          tci_read_reg(regs, TCG_REG_R6));
+-     */
-+                                          tci_read_reg(regs, TCG_REG_R4),
+     env->tlb_fill_exc = 0;
-+                                          tci_read_reg(regs, TCG_REG_R5));
+     flags = probe_access_flags(env, addr, access_type, mmu_idx, nonfault, phost,
-             tci_write_reg(regs, TCG_REG_R0, tmp64);
+                                ra);
  #endif
              break;
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
      TCG_REG_R1,
      TCG_REG_R2,
      TCG_REG_R3,
 -#if 0 /* used for TCG_REG_CALL_STACK */
      TCG_REG_R4,
 -#endif
      TCG_REG_R5,
      TCG_REG_R6,
      TCG_REG_R7,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
      TCG_REG_R1,
      TCG_REG_R2,
      TCG_REG_R3,
 -#if 0 /* used for TCG_REG_CALL_STACK */
      TCG_REG_R4,
 -#endif
      TCG_REG_R5,
 -    TCG_REG_R6,
  #if TCG_TARGET_REG_BITS == 32
      /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
 +    TCG_REG_R6,
      TCG_REG_R7,
      TCG_REG_R8,
      TCG_REG_R9,
      TCG_REG_R10,
      TCG_REG_R11,
 -    TCG_REG_R12,
  #endif
  };
 --
-.25.1
+.34.1

-[PULL 05/46] tcg/tci: Make tci_tb_ptr thread-local
+[PULL 07/20] accel/tcg: Introduce probe_access_full
-Each thread must have its own pc, even under TCI.
+Add an interface to return the CPUTLBEntryFull struct
+that goes with the lookup.  The result is not intended
-Remove the GETPC ifdef, because GETPC is always available for
+to be valid across multiple lookups, so the user must
-helpers, and thus is always required.  Move the assignment
+use the results immediately.
 under INDEX_op_call, because the value is only visible when
 we make a call to a helper function.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
 ---
- include/exec/exec-all.h | 2 +-
+ include/exec/exec-all.h | 15 +++++++++++++
- tcg/tcg-common.c        | 4 ----
+ include/qemu/typedefs.h |  1 +
- tcg/tci.c               | 7 +++----
+ accel/tcg/cputlb.c      | 47 +++++++++++++++++++++++++----------------
-files changed, 4 insertions(+), 9 deletions(-)
+files changed, 45 insertions(+), 18 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
+                        MMUAccessType access_type, int mmu_idx,
- /* GETPC is the true target of the return instruction that we'll execute.  */
+                        bool nonfault, void **phost, uintptr_t retaddr);
- #if defined(CONFIG_TCG_INTERPRETER)
--extern uintptr_t tci_tb_ptr;
++#ifndef CONFIG_USER_ONLY
-+extern __thread uintptr_t tci_tb_ptr;
++/**
- # define GETPC() tci_tb_ptr
++ * probe_access_full:
- #else
++ * Like probe_access_flags, except also return into @pfull.
- # define GETPC() \
++ *
-diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
++ * The CPUTLBEntryFull structure returned via @pfull is transient
 + * and must be consumed or copied immediately, before any further
 + * access or changes to TLB @mmu_idx.
 + */
 +int probe_access_full(CPUArchState *env, target_ulong addr,
 +                      MMUAccessType access_type, int mmu_idx,
 +                      bool nonfault, void **phost,
 +                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
 +#endif
 +
  #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
  /* Estimated block size for TB allocation.  */
 diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-common.c
+--- a/include/qemu/typedefs.h
-+++ b/tcg/tcg-common.c
++++ b/include/qemu/typedefs.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
- #include "qemu/osdep.h"
+ typedef struct CPUAddressSpace CPUAddressSpace;
- #include "tcg/tcg.h"
+ typedef struct CPUArchState CPUArchState;
+ typedef struct CPUState CPUState;
--#if defined(CONFIG_TCG_INTERPRETER)
++typedef struct CPUTLBEntryFull CPUTLBEntryFull;
--uintptr_t tci_tb_ptr;
+ typedef struct DeviceListener DeviceListener;
--#endif
+ typedef struct DeviceState DeviceState;
  typedef struct DirtyBitmapSnapshot DirtyBitmapSnapshot;
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
  static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                   int fault_size, MMUAccessType access_type,
                                   int mmu_idx, bool nonfault,
 -                                 void **phost, uintptr_t retaddr)
 +                                 void **phost, CPUTLBEntryFull **pfull,
 +                                 uintptr_t retaddr)
  {
      uintptr_t index = tlb_index(env, mmu_idx, addr);
      CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                             mmu_idx, nonfault, retaddr)) {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
 +                *pfull = NULL;
                  return TLB_INVALID_MASK;
              }
              /* TLB resize via tlb_fill may have moved the entry.  */
 +            index = tlb_index(env, mmu_idx, addr);
              entry = tlb_entry(env, mmu_idx, addr);
              /*
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
      }
      flags &= tlb_addr;
 +    *pfull = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 +
      /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
      if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
          *phost = NULL;
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
      return flags;
  }
 -int probe_access_flags(CPUArchState *env, target_ulong addr,
 -                       MMUAccessType access_type, int mmu_idx,
 -                       bool nonfault, void **phost, uintptr_t retaddr)
 +int probe_access_full(CPUArchState *env, target_ulong addr,
 +                      MMUAccessType access_type, int mmu_idx,
 +                      bool nonfault, void **phost, CPUTLBEntryFull **pfull,
 +                      uintptr_t retaddr)
  {
 -    int flags;
 -
- TCGOpDef tcg_op_defs[] = {
+-    flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
- #define DEF(s, oargs, iargs, cargs, flags) \
+-                                  nonfault, phost, retaddr);
-          { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
++    int flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
-diff --git a/tcg/tci.c b/tcg/tci.c
++                                      nonfault, phost, pfull, retaddr);
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+     /* Handle clean RAM pages.  */
-+++ b/tcg/tci.c
+     if (unlikely(flags & TLB_NOTDIRTY)) {
-@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
+-        uintptr_t index = tlb_index(env, mmu_idx, addr);
-                                     tcg_target_ulong, tcg_target_ulong);
+-        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
- #endif
+-
+-        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
-+__thread uintptr_t tci_tb_ptr;
++        notdirty_write(env_cpu(env), addr, 1, *pfull, retaddr);
          flags &= ~TLB_NOTDIRTY;
      }
      return flags;
  }
 +int probe_access_flags(CPUArchState *env, target_ulong addr,
 +                       MMUAccessType access_type, int mmu_idx,
 +                       bool nonfault, void **phost, uintptr_t retaddr)
 +{
 +    CPUTLBEntryFull *full;
 +
- static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
++    return probe_access_full(env, addr, access_type, mmu_idx,
 +                             nonfault, phost, &full, retaddr);
 +}
 +
  void *probe_access(CPUArchState *env, target_ulong addr, int size,
                     MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
  {
-     tci_assert(index < TCG_TARGET_NB_REGS);
++    CPUTLBEntryFull *full;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+     void *host;
- #endif
+     int flags;
-         TCGMemOpIdx oi;
+     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
--#if defined(GETPC)
--        tci_tb_ptr = (uintptr_t)tb_ptr;
+     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
--#endif
+-                                  false, &host, retaddr);
 +                                  false, &host, &full, retaddr);
      /* Per the interface, size == 0 merely faults the access. */
      if (size == 0) {
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
      }
      if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
 -        uintptr_t index = tlb_index(env, mmu_idx, addr);
 -        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 -
-         /* Skip opcode and size entry. */
+         /* Handle watchpoints.  */
-         tb_ptr += 2;
+         if (flags & TLB_WATCHPOINT) {
+             int wp_access = (access_type == MMU_DATA_STORE
-         switch (opc) {
+@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
-         case INDEX_op_call:
+ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
-             t0 = tci_read_ri(regs, &tb_ptr);
+                         MMUAccessType access_type, int mmu_idx)
-+            tci_tb_ptr = (uintptr_t)tb_ptr;
+ {
- #if TCG_TARGET_REG_BITS == 32
++    CPUTLBEntryFull *full;
-             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
+     void *host;
-                                           tci_read_reg(regs, TCG_REG_R1),
+     int flags;
      flags = probe_access_internal(env, addr, 0, access_type,
 -                                  mmu_idx, true, &host, 0);
 +                                  mmu_idx, true, &host, &full, 0);
      /* No combination of flags are expected by the caller. */
      return flags ? NULL : host;
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
  tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
                                          void **hostp)
  {
 +    CPUTLBEntryFull *full;
      void *p;
      (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
 -                                cpu_mmu_index(env, true), false, &p, 0);
 +                                cpu_mmu_index(env, true), false, &p, &full, 0);
      if (p == NULL) {
          return -1;
      }
 --
-.25.1
+.34.1

-[PULL 20/46] tcg/tci: Move stack bounds check to compile-time
+[PULL 08/20] accel/tcg: Introduce tlb_set_page_full
-The existing check was incomplete:
+Now that we have collected all of the page data into
-(1) Only applied to two of the 7 stores, and not to the loads at all.
+CPUTLBEntryFull, provide an interface to record that
-(2) Only checked the upper, but not the lower bound of the stack.
+all in one go, instead of using 4 arguments.  This interface
 allows CPUTLBEntryFull to be extended without having to
 change the number of arguments.
-Doing this at compile time means that we don't need to do it
-at runtime as well.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- tcg/tci.c                |  2 --
+ include/exec/cpu-defs.h | 14 +++++++++++
- tcg/tci/tcg-target.c.inc | 13 +++++++++++++
+ include/exec/exec-all.h | 22 ++++++++++++++++++
-files changed, 13 insertions(+), 2 deletions(-)
+ accel/tcg/cputlb.c      | 51 ++++++++++++++++++++++++++---------------
 files changed, 69 insertions(+), 18 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
+diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
+--- a/include/exec/cpu-defs.h
-+++ b/tcg/tci.c
++++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
-             t0 = tci_read_r32(regs, &tb_ptr);
+      *     + the offset within the target MemoryRegion (otherwise)
-             t1 = tci_read_r(regs, &tb_ptr);
+      */
-             t2 = tci_read_s32(&tb_ptr);
+     hwaddr xlat_section;
--            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
++
-             *(uint32_t *)(t1 + t2) = t0;
++    /*
-             break;
++     * @phys_addr contains the physical address in the address space
++     * given by cpu_asidx_from_attrs(cpu, @attrs).
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
++     */
-             t0 = tci_read_r64(regs, &tb_ptr);
++    hwaddr phys_addr;
-             t1 = tci_read_r(regs, &tb_ptr);
++
-             t2 = tci_read_s32(&tb_ptr);
++    /* @attrs contains the memory transaction attributes for the page. */
--            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
+     MemTxAttrs attrs;
-             *(uint64_t *)(t1 + t2) = t0;
++
-             break;
++    /* @prot contains the complete protections for the page. */
++    uint8_t prot;
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
++
 +    /* @lg_page_size contains the log2 of the page size. */
 +    uint8_t lg_page_size;
  } CPUTLBEntryFull;
  /*
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
+--- a/include/exec/exec-all.h
-+++ b/tcg/tci/tcg-target.c.inc
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
+@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                 uint16_t idxmap,
                                                 unsigned bits);
 +/**
 + * tlb_set_page_full:
 + * @cpu: CPU context
 + * @mmu_idx: mmu index of the tlb to modify
 + * @vaddr: virtual address of the entry to add
 + * @full: the details of the tlb entry
 + *
 + * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
 + * @full must be filled, except for xlat_section, and constitute
 + * the complete description of the translated page.
 + *
 + * This is generally called by the target tlb_fill function after
 + * having performed a successful page table walk to find the physical
 + * address and attributes for the translation.
 + *
 + * At most one entry for a given virtual address is permitted. Only a
 + * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
 + * used by tlb_flush_page.
 + */
 +void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
 +                       CPUTLBEntryFull *full);
 +
  /**
   * tlb_set_page_with_attrs:
   * @cpu: CPU to add this TLB entry for
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
      env_tlb(env)->d[mmu_idx].large_page_mask = lp_mask;
  }
 -/* Add a new TLB entry. At most one entry for a given virtual address
 +/*
 + * Add a new TLB entry. At most one entry for a given virtual address
   * is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
   * supplied size is only used by tlb_flush_page.
   *
   * Called from TCG-generated code, which is under an RCU read-side
   * critical section.
   */
 -void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 -                             hwaddr paddr, MemTxAttrs attrs, int prot,
 -                             int mmu_idx, target_ulong size)
 +void tlb_set_page_full(CPUState *cpu, int mmu_idx,
 +                       target_ulong vaddr, CPUTLBEntryFull *full)
  {
      CPUArchState *env = cpu->env_ptr;
      CPUTLB *tlb = env_tlb(env);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      CPUTLBEntry *te, tn;
      hwaddr iotlb, xlat, sz, paddr_page;
      target_ulong vaddr_page;
 -    int asidx = cpu_asidx_from_attrs(cpu, attrs);
 -    int wp_flags;
 +    int asidx, wp_flags, prot;
      bool is_ram, is_romd;
      assert_cpu_is_self(cpu);
 -    if (size <= TARGET_PAGE_SIZE) {
 +    if (full->lg_page_size <= TARGET_PAGE_BITS) {
          sz = TARGET_PAGE_SIZE;
      } else {
 -        tlb_add_large_page(env, mmu_idx, vaddr, size);
 -        sz = size;
 +        sz = (hwaddr)1 << full->lg_page_size;
 +        tlb_add_large_page(env, mmu_idx, vaddr, sz);
      }
+     vaddr_page = vaddr & TARGET_PAGE_MASK;
+-    paddr_page = paddr & TARGET_PAGE_MASK;
++    paddr_page = full->phys_addr & TARGET_PAGE_MASK;
++    prot = full->prot;
++    asidx = cpu_asidx_from_attrs(cpu, full->attrs);
+     section = address_space_translate_for_iotlb(cpu, asidx, paddr_page,
+-                                                &xlat, &sz, attrs, &prot);
++                                                &xlat, &sz, full->attrs, &prot);
+     assert(sz >= TARGET_PAGE_SIZE);
+     tlb_debug("vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
+               " prot=%x idx=%d\n",
+-              vaddr, paddr, prot, mmu_idx);
++              vaddr, full->phys_addr, prot, mmu_idx);
+     address = vaddr_page;
+-    if (size < TARGET_PAGE_SIZE) {
++    if (full->lg_page_size < TARGET_PAGE_BITS) {
+         /* Repeat the MMU check and TLB fill on every access.  */
+         address |= TLB_INVALID_MASK;
+     }
+-    if (attrs.byte_swap) {
++    if (full->attrs.byte_swap) {
+         address |= TLB_BSWAP;
+     }
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+      * subtract here is that of the page base, and not the same as the
+      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
+      */
++    desc->fulltlb[index] = *full;
+     desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
+-    desc->fulltlb[index].attrs = attrs;
++    desc->fulltlb[index].phys_addr = paddr_page;
++    desc->fulltlb[index].prot = prot;
+     /* Now calculate the new entry */
+     tn.addend = addend - vaddr_page;
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+     qemu_spin_unlock(&tlb->c.lock);
  }
-+static void stack_bounds_check(TCGReg base, target_long offset)
+-/* Add a new TLB entry, but without specifying the memory
 - * transaction attributes to be used.
 - */
 +void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 +                             hwaddr paddr, MemTxAttrs attrs, int prot,
 +                             int mmu_idx, target_ulong size)
 +{
-+    if (base == TCG_REG_CALL_STACK) {
++    CPUTLBEntryFull full = {
-+        tcg_debug_assert(offset < 0);
++        .phys_addr = paddr,
-+        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
++        .attrs = attrs,
-+    }
++        .prot = prot,
 +        .lg_page_size = ctz64(size)
 +    };
 +
 +    assert(is_power_of_2(size));
 +    tlb_set_page_full(cpu, mmu_idx, vaddr, &full);
 +}
 +
- static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
+ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
-                        intptr_t arg2)
+                   hwaddr paddr, int prot,
- {
+                   int mmu_idx, target_ulong size)
      uint8_t *old_code_ptr = s->code_ptr;
 +
 +    stack_bounds_check(arg1, arg2);
      if (type == TCG_TYPE_I32) {
          tcg_out_op_t(s, INDEX_op_ld_i32);
          tcg_out_r(s, ret);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_st16_i64:
      case INDEX_op_st32_i64:
      case INDEX_op_st_i64:
 +        stack_bounds_check(args[1], args[2]);
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
          tcg_debug_assert(args[2] == (int32_t)args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                         intptr_t arg2)
  {
      uint8_t *old_code_ptr = s->code_ptr;
 +
 +    stack_bounds_check(arg1, arg2);
      if (type == TCG_TYPE_I32) {
          tcg_out_op_t(s, INDEX_op_st_i32);
          tcg_out_r(s, arg);
 --
-.25.1
+.34.1

-[PULL 02/46] exec/cpu-defs: Remove TCG backends dependency
+[PULL 09/20] include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Allow the target to cache items from the guest page tables.
-"exec/cpu-defs.h" contains generic CPU definitions for the
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-TCG frontends (mostly related to TLB). TCG backends definitions
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-aren't relevant here.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 See tcg/README description:
 ) Backend
   tcg-target.h contains the target specific definitions. tcg-target.c.inc
   contains the target specific code; it is #included by tcg/tcg.c, rather
   than being a standalone C file.
 So far only "tcg/tcg.h" requires these headers.
 Remove the "target-tcg.h" header dependency on TCG frontends, so we
 don't have to rebuild all frontends when hacking a single backend.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-defs.h | 3 ---
+ include/exec/cpu-defs.h | 9 +++++++++
-file changed, 3 deletions(-)
+file changed, 9 insertions(+)
 diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/cpu-defs.h
 +++ b/include/exec/cpu-defs.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
- #include "qemu/host-utils.h"
+     /* @lg_page_size contains the log2 of the page size. */
- #include "qemu/thread.h"
+     uint8_t lg_page_size;
--#ifdef CONFIG_TCG
++
--#include "tcg-target.h"
++    /*
--#endif
++     * Allow target-specific additions to this structure.
- #ifndef CONFIG_USER_ONLY
++     * This may be used to cache items from the guest cpu
- #include "exec/hwaddr.h"
++     * page tables for later use by the implementation.
- #endif
++     */
 +#ifdef TARGET_PAGE_ENTRY_EXTRA
 +    TARGET_PAGE_ENTRY_EXTRA
 +#endif
  } CPUTLBEntryFull;
  /*
 --
-.25.1
+.34.1

-[PULL 03/46] tcg/aarch64: Do not convert TCGArg to temps that are not temps
+Deleted patch
-Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
-argument is an integer, not a temporary, which now tickles
-an assert added in e89b28a6350.
-Previously, the value computed into v2 would be garbage for
-rotli_vec, but as the value was unused it caused no harm.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/aarch64/tcg-target.c.inc | 7 ++++---
-file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/aarch64/tcg-target.c.inc
-+++ b/tcg/aarch64/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
-     v0 = temp_tcgv_vec(arg_temp(a0));
-     v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
-     a2 = va_arg(va, TCGArg);
--    v2 = temp_tcgv_vec(arg_temp(a2));
-+    va_end(va);
-     switch (opc) {
-     case INDEX_op_rotli_vec:
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
-     case INDEX_op_shrv_vec:
-     case INDEX_op_sarv_vec:
-         /* Right shifts are negative left shifts for AArch64.  */
-+        v2 = temp_tcgv_vec(arg_temp(a2));
-         t1 = tcg_temp_new_vec(type);
-         tcg_gen_neg_vec(vece, t1, v2);
-         opc = (opc == INDEX_op_shrv_vec
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
-         break;
-     case INDEX_op_rotlv_vec:
-+        v2 = temp_tcgv_vec(arg_temp(a2));
-         t1 = tcg_temp_new_vec(type);
-         c1 = tcg_constant_vec(type, vece, 8 << vece);
-         tcg_gen_sub_vec(vece, t1, v2, c1);
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
-         break;
-     case INDEX_op_rotrv_vec:
-+        v2 = temp_tcgv_vec(arg_temp(a2));
-         t1 = tcg_temp_new_vec(type);
-         t2 = tcg_temp_new_vec(type);
-         c1 = tcg_constant_vec(type, vece, 8 << vece);
-@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
-     default:
-         g_assert_not_reached();
-     }
--
--    va_end(va);
- }
- static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
---
-.25.1

-[PULL 04/46] configure: Fix --enable-tcg-interpreter
+Deleted patch
-The configure option was backward, and we failed to
-pass the value on to meson.
-Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
-Tested-by: Stefan Weil <sw@weilnetz.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- configure | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ for opt do
-   ;;
-   --enable-whpx) whpx="enabled"
-   ;;
--  --disable-tcg-interpreter) tcg_interpreter="true"
-+  --disable-tcg-interpreter) tcg_interpreter="false"
-   ;;
--  --enable-tcg-interpreter) tcg_interpreter="false"
-+  --enable-tcg-interpreter) tcg_interpreter="true"
-   ;;
-   --disable-cap-ng)  cap_ng="disabled"
-   ;;
-@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
-         -Dvhost_user_blk_server=$vhost_user_blk_server \
-         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
-         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
-+    -Dtcg_interpreter=$tcg_interpreter \
-         $cross_arg \
-         "$PWD" "$source_path"
---
-.25.1

-[PULL 06/46] tcg/tci: Implement INDEX_op_ld16s_i32
+Deleted patch
-From: Stefan Weil <sw@weilnetz.de>
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
-    qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reported-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 ++++-
-file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             TODO();
-             break;
-         case INDEX_op_ld16s_i32:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld_i32:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 07/46] tcg/tci: Implement INDEX_op_ld8s_i64
+Deleted patch
-From: Stefan Weil <sw@weilnetz.de>
-That TCG opcode is used by debian-buster (arm64) running ffmpeg:
-    qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reported-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 ++++-
-file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i64:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16u_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 08/46] tcg/tci: Inline tci_write_reg32s into the only caller
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 10 +---------
-file changed, 1 insertion(+), 9 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--#if TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg32s(tcg_target_ulong *regs, TCGReg index, int32_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--#endif
--
- static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
- {
-     tci_write_reg(regs, index, value);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg32s(regs, t0, *(int32_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(int32_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 09/46] tcg/tci: Inline tci_write_reg8 into its callers
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 9 ++-------
-file changed, 2 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--static void tci_write_reg8(tcg_target_ulong *regs, TCGReg index, uint8_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--
- #if TCG_TARGET_REG_BITS == 64
- static void
- tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i32:
-             TODO();
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld8s_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 10/46] tcg/tci: Inline tci_write_reg16 into the only caller
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 10 +---------
-file changed, 1 insertion(+), 9 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--#if TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg16(tcg_target_ulong *regs, TCGReg index, uint16_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--#endif
--
- static void
- tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
- {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg16(regs, t0, *(uint16_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16s_i64:
-             TODO();
---
-.25.1

-[PULL 11/46] tcg/tci: Inline tci_write_reg32 into all callers
+Deleted patch
-For a 64-bit TCI, the upper bits of a 32-bit operation are
-undefined (much like a native ppc64 32-bit operation).  It
-simplifies everything if we don't force-extend the result.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
-file changed, 30 insertions(+), 36 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
-     regs[index] = value;
- }
--static void
--tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
--{
--    tci_write_reg(regs, index, value);
--}
--
- #if TCG_TARGET_REG_BITS == 32
- static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
-                             uint32_t low_index, uint64_t value)
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t1 = tci_read_r32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
-+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
-             break;
- #if TCG_TARGET_REG_BITS == 32
-         case INDEX_op_setcond2_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp64 = tci_read_r64(regs, &tb_ptr);
-             v64 = tci_read_ri64(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
-+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
-             break;
- #elif TCG_TARGET_REG_BITS == 64
-         case INDEX_op_setcond_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_mov_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-         case INDEX_op_tci_movi_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_i32(&tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-             /* Load/store operations (32 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
-         case INDEX_op_st8_i32:
-             t0 = tci_read_r8(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 + t2);
-+            tci_write_reg(regs, t0, t1 + t2);
-             break;
-         case INDEX_op_sub_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 - t2);
-+            tci_write_reg(regs, t0, t1 - t2);
-             break;
-         case INDEX_op_mul_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 * t2);
-+            tci_write_reg(regs, t0, t1 * t2);
-             break;
- #if TCG_TARGET_HAS_div_i32
-         case INDEX_op_div_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
-+            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
-             break;
-         case INDEX_op_divu_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 / t2);
-+            tci_write_reg(regs, t0, t1 / t2);
-             break;
-         case INDEX_op_rem_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
-+            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
-             break;
-         case INDEX_op_remu_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 % t2);
-+            tci_write_reg(regs, t0, t1 % t2);
-             break;
- #elif TCG_TARGET_HAS_div2_i32
-         case INDEX_op_div2_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 & t2);
-+            tci_write_reg(regs, t0, t1 & t2);
-             break;
-         case INDEX_op_or_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 | t2);
-+            tci_write_reg(regs, t0, t1 | t2);
-             break;
-         case INDEX_op_xor_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 ^ t2);
-+            tci_write_reg(regs, t0, t1 ^ t2);
-             break;
-             /* Shift/rotate operations (32 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 << (t2 & 31));
-+            tci_write_reg(regs, t0, t1 << (t2 & 31));
-             break;
-         case INDEX_op_shr_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
-+            tci_write_reg(regs, t0, t1 >> (t2 & 31));
-             break;
-         case INDEX_op_sar_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
-+            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
-             break;
- #if TCG_TARGET_HAS_rot_i32
-         case INDEX_op_rotl_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
-+            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
-             break;
-         case INDEX_op_rotr_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-             t2 = tci_read_ri32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
-+            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
-             break;
- #endif
- #if TCG_TARGET_HAS_deposit_i32
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp16 = *tb_ptr++;
-             tmp8 = *tb_ptr++;
-             tmp32 = (((1 << tmp8) - 1) << tmp16);
--            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
-+            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
-             break;
- #endif
-         case INDEX_op_brcond_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext8s_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8s(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16s_i32
-         case INDEX_op_ext16s_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16s(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext8u_i32
-         case INDEX_op_ext8u_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16u_i32
-         case INDEX_op_ext16u_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap16_i32
-         case INDEX_op_bswap16_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, bswap16(t1));
-+            tci_write_reg(regs, t0, bswap16(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap32_i32
-         case INDEX_op_bswap32_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, bswap32(t1));
-+            tci_write_reg(regs, t0, bswap32(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_not_i32
-         case INDEX_op_not_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, ~t1);
-+            tci_write_reg(regs, t0, ~t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_neg_i32
-         case INDEX_op_neg_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg32(regs, t0, -t1);
-+            tci_write_reg(regs, t0, -t1);
-             break;
- #endif
- #if TCG_TARGET_REG_BITS == 64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld32s_i64:
-             t0 = *tb_ptr++;
---
-.25.1

-[PULL 12/46] tcg/tci: Inline tci_write_reg64 into 64-bit callers
+Deleted patch
-Note that we had two functions of the same name: a 32-bit version
-which took two register numbers and a 64-bit version which was a
-no-op wrapper for tcg_write_reg.  After this, we are left with
-only the 32-bit version.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
-file changed, 27 insertions(+), 33 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
-     tci_write_reg(regs, low_index, value);
-     tci_write_reg(regs, high_index, value >> 32);
- }
--#elif TCG_TARGET_REG_BITS == 64
--static void
--tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
--{
--    tci_write_reg(regs, index, value);
--}
- #endif
- #if TCG_TARGET_REG_BITS == 32
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t1 = tci_read_r64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
-             condition = *tb_ptr++;
--            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
-+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
-             break;
- #endif
-         case INDEX_op_mov_i32:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_mov_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-         case INDEX_op_tci_movi_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_i64(&tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
-             /* Load/store operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
-+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
-         case INDEX_op_st8_i64:
-             t0 = tci_read_r8(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 + t2);
-+            tci_write_reg(regs, t0, t1 + t2);
-             break;
-         case INDEX_op_sub_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 - t2);
-+            tci_write_reg(regs, t0, t1 - t2);
-             break;
-         case INDEX_op_mul_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 * t2);
-+            tci_write_reg(regs, t0, t1 * t2);
-             break;
- #if TCG_TARGET_HAS_div_i64
-         case INDEX_op_div_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 & t2);
-+            tci_write_reg(regs, t0, t1 & t2);
-             break;
-         case INDEX_op_or_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 | t2);
-+            tci_write_reg(regs, t0, t1 | t2);
-             break;
-         case INDEX_op_xor_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 ^ t2);
-+            tci_write_reg(regs, t0, t1 ^ t2);
-             break;
-             /* Shift/rotate operations (64 bit). */
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 << (t2 & 63));
-+            tci_write_reg(regs, t0, t1 << (t2 & 63));
-             break;
-         case INDEX_op_shr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
-+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
-             break;
-         case INDEX_op_sar_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
-             break;
- #if TCG_TARGET_HAS_rot_i64
-         case INDEX_op_rotl_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
-             break;
-         case INDEX_op_rotr_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-             t2 = tci_read_ri64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
-+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
-             break;
- #endif
- #if TCG_TARGET_HAS_deposit_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tmp16 = *tb_ptr++;
-             tmp8 = *tb_ptr++;
-             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
--            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
-             break;
- #endif
-         case INDEX_op_brcond_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext8u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext8s_i64
-         case INDEX_op_ext8s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r8s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16s_i64
-         case INDEX_op_ext16s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext16u_i64
-         case INDEX_op_ext16u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_ext32s_i64
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_ext_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32s(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_ext32u_i64
-         case INDEX_op_ext32u_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_extu_i32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, t1);
-+            tci_write_reg(regs, t0, t1);
-             break;
- #if TCG_TARGET_HAS_bswap16_i64
-         case INDEX_op_bswap16_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r16(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap16(t1));
-+            tci_write_reg(regs, t0, bswap16(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap32_i64
-         case INDEX_op_bswap32_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r32(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap32(t1));
-+            tci_write_reg(regs, t0, bswap32(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_bswap64_i64
-         case INDEX_op_bswap64_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, bswap64(t1));
-+            tci_write_reg(regs, t0, bswap64(t1));
-             break;
- #endif
- #if TCG_TARGET_HAS_not_i64
-         case INDEX_op_not_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, ~t1);
-+            tci_write_reg(regs, t0, ~t1);
-             break;
- #endif
- #if TCG_TARGET_HAS_neg_i64
-         case INDEX_op_neg_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r64(regs, &tb_ptr);
--            tci_write_reg64(regs, t0, -t1);
-+            tci_write_reg(regs, t0, -t1);
-             break;
- #endif
- #endif /* TCG_TARGET_REG_BITS == 64 */
---
-.25.1

-[PULL 13/46] tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 20 +++++++++++++-------
-file changed, 13 insertions(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
- # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
- #endif
-+#if TCG_TARGET_REG_BITS == 64
-+# define CASE_32_64(x) \
-+        case glue(glue(INDEX_op_, x), _i64): \
-+        case glue(glue(INDEX_op_, x), _i32):
-+# define CASE_64(x) \
-+        case glue(glue(INDEX_op_, x), _i64):
-+#else
-+# define CASE_32_64(x) \
-+        case glue(glue(INDEX_op_, x), _i32):
-+# define CASE_64(x)
-+#endif
-+
- /* Interpret pseudo code in tb. */
- /*
-  * Disable CFI checks.
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (32 bit). */
--        case INDEX_op_ld8u_i32:
-+        CASE_32_64(ld8u)
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld8u_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld8s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 14/46] tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld8s_i32.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 13 +++++--------
-file changed, 5 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld8s_i32:
--            TODO();
-+        CASE_32_64(ld8s)
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16u_i32:
-             TODO();
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld8s_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld16u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 15/46] tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld16u_i32.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 13 +++++--------
-file changed, 5 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld16u_i32:
--            TODO();
-+        CASE_32_64(ld16u)
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_r(regs, &tb_ptr);
-+            t2 = tci_read_s32(&tb_ptr);
-+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld16s_i32:
-             t0 = *tb_ptr++;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld16u_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld16s_i64:
-             TODO();
-             break;
---
-.25.1

-[PULL 16/46] tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
+Deleted patch
-Eliminating a TODO for ld16s_i64.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-             break;
--        case INDEX_op_ld16s_i32:
-+        CASE_32_64(ld16s)
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld16s_i64:
--            TODO();
--            break;
-         case INDEX_op_ld32u_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 17/46] tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
-             break;
-         case INDEX_op_ld_i32:
-+        CASE_64(ld32u)
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             /* Load/store operations (64 bit). */
--        case INDEX_op_ld32u_i64:
--            t0 = *tb_ptr++;
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
--            break;
-         case INDEX_op_ld32s_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 18/46] tcg/tci: Merge INDEX_op_st8_{i32,i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 +-------
-file changed, 1 insertion(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-             break;
--        case INDEX_op_st8_i32:
-+        CASE_32_64(st8)
-             t0 = tci_read_r8(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st8_i64:
--            t0 = tci_read_r8(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint8_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st16_i64:
-             t0 = tci_read_r16(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 19/46] tcg/tci: Merge INDEX_op_st16_{i32,i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 +-------
-file changed, 1 insertion(+), 7 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             *(uint8_t *)(t1 + t2) = t0;
-             break;
--        case INDEX_op_st16_i32:
-+        CASE_32_64(st16)
-             t0 = tci_read_r16(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st16_i64:
--            t0 = tci_read_r16(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint16_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st32_i64:
-             t0 = tci_read_r32(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 21/46] tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             *(uint16_t *)(t1 + t2) = t0;
-             break;
-         case INDEX_op_st_i32:
-+        CASE_64(st32)
-             t0 = tci_read_r32(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
-             t2 = tci_read_s32(&tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_s32(&tb_ptr);
-             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
-             break;
--        case INDEX_op_st32_i64:
--            t0 = tci_read_r32(regs, &tb_ptr);
--            t1 = tci_read_r(regs, &tb_ptr);
--            t2 = tci_read_s32(&tb_ptr);
--            *(uint32_t *)(t1 + t2) = t0;
--            break;
-         case INDEX_op_st_i64:
-             t0 = tci_read_r64(regs, &tb_ptr);
-             t1 = tci_read_r(regs, &tb_ptr);
---
-.25.1

-[PULL 22/46] tcg/tci: Use g_assert_not_reached
+Deleted patch
-Three TODO instances are never happen cases.
-Other uses of tcg_abort are also indicating unreachable cases.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Stefan Weil <sw@weilnetz.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 15 +++++++--------
-file changed, 7 insertions(+), 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
-         result = (u0 > u1);
-         break;
-     default:
--        TODO();
-+        g_assert_not_reached();
-     }
-     return result;
- }
-@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
-         result = (u0 > u1);
-         break;
-     default:
--        TODO();
-+        g_assert_not_reached();
-     }
-     return result;
- }
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 tmp32 = qemu_ld_beul;
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             tci_write_reg(regs, t0, tmp32);
-             break;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 tmp64 = qemu_ld_beq;
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             tci_write_reg(regs, t0, tmp64);
-             if (TCG_TARGET_REG_BITS == 32) {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 qemu_st_bel(t0);
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             break;
-         case INDEX_op_qemu_st_i64:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-                 qemu_st_beq(tmp64);
-                 break;
-             default:
--                tcg_abort();
-+                g_assert_not_reached();
-             }
-             break;
-         case INDEX_op_mb:
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             smp_mb();
-             break;
-         default:
--            TODO();
--            break;
-+            g_assert_not_reached();
-         }
-         tci_assert(tb_ptr == old_code_ptr + op_size);
-     }
---
-.25.1

-[PULL 23/46] tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
+Deleted patch
-We do not simultaneously support div and div2 -- it's one
-or the other.  TCI is already using div, so remove div2.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c                | 12 ------------
- tcg/tci/tcg-target.c.inc |  8 --------
-files changed, 20 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 * t2);
-             break;
--#if TCG_TARGET_HAS_div_i32
-         case INDEX_op_div_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri32(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 % t2);
-             break;
--#elif TCG_TARGET_HAS_div2_i32
--        case INDEX_op_div2_i32:
--        case INDEX_op_divu2_i32:
--            TODO();
--            break;
--#endif
-         case INDEX_op_and_i32:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri32(regs, &tb_ptr);
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-         case INDEX_op_remu_i64:
-             TODO();
-             break;
--#elif TCG_TARGET_HAS_div2_i64
--        case INDEX_op_div2_i64:
--        case INDEX_op_divu2_i64:
--            TODO();
--            break;
- #endif
-         case INDEX_op_and_i64:
-             t0 = *tb_ptr++;
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-         TODO();
-         break;
--    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
--    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
--        TODO();
--        break;
-     case INDEX_op_brcond_i64:
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-         tcg_out_ri32(s, const_args[1], args[1]);
-         tcg_out_ri32(s, const_args[2], args[2]);
-         break;
--    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
--    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
--        TODO();
--        break;
- #if TCG_TARGET_REG_BITS == 32
-     case INDEX_op_add2_i32:
-     case INDEX_op_sub2_i32:
---
-.25.1

-[PULL 24/46] tcg/tci: Implement 64-bit division
+Deleted patch
-Trivially implemented like other arithmetic.
-Tested via check-tcg and the ppc64 target.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci/tcg-target.h     |  4 ++--
- tcg/tci.c                | 28 ++++++++++++++++++++++------
- tcg/tci/tcg-target.c.inc | 10 ++++------
-files changed, 28 insertions(+), 14 deletions(-)
-diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.h
-+++ b/tcg/tci/tcg-target.h
-@@ -XXX,XX +XXX,XX @@
- #define TCG_TARGET_HAS_extract_i64      0
- #define TCG_TARGET_HAS_sextract_i64     0
- #define TCG_TARGET_HAS_extract2_i64     0
--#define TCG_TARGET_HAS_div_i64          0
--#define TCG_TARGET_HAS_rem_i64          0
-+#define TCG_TARGET_HAS_div_i64          1
-+#define TCG_TARGET_HAS_rem_i64          1
- #define TCG_TARGET_HAS_ext8s_i64        1
- #define TCG_TARGET_HAS_ext16s_i64       1
- #define TCG_TARGET_HAS_ext32s_i64       1
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
-             t2 = tci_read_ri64(regs, &tb_ptr);
-             tci_write_reg(regs, t0, t1 * t2);
-             break;
--#if TCG_TARGET_HAS_div_i64
-         case INDEX_op_div_i64:
--        case INDEX_op_divu_i64:
--        case INDEX_op_rem_i64:
--        case INDEX_op_remu_i64:
--            TODO();
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
-+            break;
-+        case INDEX_op_divu_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
-+            break;
-+        case INDEX_op_rem_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
-+            break;
-+        case INDEX_op_remu_i64:
-+            t0 = *tb_ptr++;
-+            t1 = tci_read_ri64(regs, &tb_ptr);
-+            t2 = tci_read_ri64(regs, &tb_ptr);
-+            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
-             break;
--#endif
-         case INDEX_op_and_i64:
-             t0 = *tb_ptr++;
-             t1 = tci_read_ri64(regs, &tb_ptr);
-diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target.c.inc
-+++ b/tcg/tci/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-     case INDEX_op_sar_i64:
-     case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
-     case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
-+    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-+    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
-         tcg_out_ri64(s, const_args[2], args[2]);
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
-         tcg_debug_assert(args[4] <= UINT8_MAX);
-         tcg_out8(s, args[4]);
-         break;
--    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
--    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
--        TODO();
--        break;
-     case INDEX_op_brcond_i64:
-         tcg_out_r(s, args[0]);
-         tcg_out_ri64(s, const_args[1], args[1]);
---
-.25.1

-[PULL 25/46] tcg/tci: Remove TODO as unused
+Deleted patch
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- tcg/tci.c | 8 --------
-file changed, 8 deletions(-)
-diff --git a/tcg/tci.c b/tcg/tci.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci.c
-+++ b/tcg/tci.c
-@@ -XXX,XX +XXX,XX @@
- #include "tcg/tcg-op.h"
- #include "qemu/compiler.h"
--/* Marker for missing code. */
--#define TODO() \
--    do { \
--        fprintf(stderr, "TODO %s:%u: %s()\n", \
--                __FILE__, __LINE__, __func__); \
--        tcg_abort(); \
--    } while (0)
--
- #if MAX_OPC_PARAM_IARGS != 6
- # error Fix needed, number of supported input arguments changed!
- #endif
---
-.25.1

-[PULL 28/46] tcg/tci: Remove TCG_CONST
+[PULL 10/20] accel/tcg: Remove PageDesc code_bitmap
-Restrict all operands to registers.  All constants will be forced
+This bitmap is created and discarded immediately.
-into registers by the middle-end.  Removing the difference in how
+We gain nothing by its existence.
 immediate integers were encoded will allow more code to be shared
 between 32-bit and 64-bit operations.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20220822232338.1727934-2-richard.henderson@linaro.org>
 ---
- tcg/tci/tcg-target-con-set.h |   6 +-
+ accel/tcg/translate-all.c | 78 ++-------------------------------------
- tcg/tci/tcg-target.h         |   3 -
+file changed, 4 insertions(+), 74 deletions(-)
  tcg/tci.c                    | 189 +++++++++++++----------------------
  tcg/tci/tcg-target.c.inc     |  85 ++++------------
 files changed, 89 insertions(+), 194 deletions(-)
-diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/tci/tcg-target-con-set.h
+--- a/accel/tcg/translate-all.c
-+++ b/tcg/tci/tcg-target-con-set.h
++++ b/accel/tcg/translate-all.c
 @@ -XXX,XX +XXX,XX @@
-  * tcg-target-con-str.h; the constraint combination is inclusive or.
+ #define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
-  */
+ #endif
- C_O0_I2(r, r)
--C_O0_I2(r, ri)
+-#define SMC_BITMAP_USE_THRESHOLD 10
  C_O0_I3(r, r, r)
 -C_O0_I4(r, r, ri, ri)
  C_O0_I4(r, r, r, r)
  C_O1_I1(r, r)
  C_O1_I2(r, 0, r)
 -C_O1_I2(r, ri, ri)
  C_O1_I2(r, r, r)
 -C_O1_I2(r, r, ri)
 -C_O1_I4(r, r, r, ri, ri)
 +C_O1_I4(r, r, r, r, r)
  C_O2_I1(r, r, r)
  C_O2_I2(r, r, r, r)
  C_O2_I4(r, r, r, r, r, r)
 diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.h
 +++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TCG_AREG0 = TCG_REG_R14,
      TCG_REG_CALL_STACK = TCG_REG_R15,
 -
--    /* Special value UINT8_MAX is used by TCI to encode constant values. */
+ typedef struct PageDesc {
--    TCG_CONST = UINT8_MAX
+     /* list of TBs intersecting this ram page */
- } TCGReg;
+     uintptr_t first_tb;
+-#ifdef CONFIG_SOFTMMU
- /* Used for function call generation. */
+-    /* in order to optimize self modifying code, we count the number
-diff --git a/tcg/tci.c b/tcg/tci.c
+-       of lookups we do to a given page to use a bitmap */
-index XXXXXXX..XXXXXXX 100644
+-    unsigned long *code_bitmap;
---- a/tcg/tci.c
+-    unsigned int code_write_count;
-+++ b/tcg/tci.c
+-#else
-@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
++#ifdef CONFIG_USER_ONLY
-     return taddr;
+     unsigned long flags;
      void *target_data;
  #endif
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_SOFTMMU
      QemuSpin lock;
  #endif
  } PageDesc;
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void)
      qht_init(&tb_ctx.htable, tb_cmp, CODE_GEN_HTABLE_SIZE, mode);
  }
--/* Read indexed register or constant (native size) from bytecode. */
+-/* call with @p->lock held */
--static tcg_target_ulong
+-static inline void invalidate_page_bitmap(PageDesc *p)
 -tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
 -{
--    tcg_target_ulong value;
+-    assert_page_locked(p);
--    TCGReg r = **tb_ptr;
+-#ifdef CONFIG_SOFTMMU
--    *tb_ptr += 1;
+-    g_free(p->code_bitmap);
--    if (r == TCG_CONST) {
+-    p->code_bitmap = NULL;
--        value = tci_read_i(tb_ptr);
+-    p->code_write_count = 0;
--    } else {
+-#endif
 -        value = tci_read_reg(regs, r);
 -    }
 -    return value;
 -}
 -
--/* Read indexed register or constant (32 bit) from bytecode. */
+ /* Set to NULL all the 'first_tb' fields in all PageDescs. */
--static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
+ static void page_flush_tb_1(int level, void **lp)
--                              const uint8_t **tb_ptr)
+ {
@@ -XXX,XX +XXX,XX @@ static void page_flush_tb_1(int level, void **lp)
          for (i = 0; i < V_L2_SIZE; ++i) {
              page_lock(&pd[i]);
              pd[i].first_tb = (uintptr_t)NULL;
 -            invalidate_page_bitmap(pd + i);
              page_unlock(&pd[i]);
          }
      } else {
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      if (rm_from_page_list) {
          p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
          tb_page_remove(p, tb);
 -        invalidate_page_bitmap(p);
          if (tb->page_addr[1] != -1) {
              p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
              tb_page_remove(p, tb);
 -            invalidate_page_bitmap(p);
          }
      }
@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
      }
  }
 -#ifdef CONFIG_SOFTMMU
 -/* call with @p->lock held */
 -static void build_page_bitmap(PageDesc *p)
 -{
--    uint32_t value;
+-    int n, tb_start, tb_end;
--    TCGReg r = **tb_ptr;
+-    TranslationBlock *tb;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i32(tb_ptr);
 -    } else {
 -        value = tci_read_reg32(regs, r);
 -    }
 -    return value;
 -}
 -
--#if TCG_TARGET_REG_BITS == 32
+-    assert_page_locked(p);
--/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
+-    p->code_bitmap = bitmap_new(TARGET_PAGE_SIZE);
 -static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
 -                              const uint8_t **tb_ptr)
 -{
 -    uint32_t low = tci_read_ri32(regs, tb_ptr);
 -    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
 -}
 -#elif TCG_TARGET_REG_BITS == 64
 -/* Read indexed register or constant (64 bit) from bytecode. */
 -static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
 -                              const uint8_t **tb_ptr)
 -{
 -    uint64_t value;
 -    TCGReg r = **tb_ptr;
 -    *tb_ptr += 1;
 -    if (r == TCG_CONST) {
 -        value = tci_read_i64(tb_ptr);
 -    } else {
 -        value = tci_read_reg64(regs, r);
 -    }
 -    return value;
 -}
 -#endif
 -
- static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
+-    PAGE_FOR_EACH_TB(p, tb, n) {
- {
+-        /* NOTE: this is subtle as a TB may span two physical pages */
-     tcg_target_ulong label = tci_read_i(tb_ptr);
+-        if (n == 0) {
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-            /* NOTE: tb_end may be after the end of the page, but
+-               it is not a problem */
-         switch (opc) {
+-            tb_start = tb->pc & ~TARGET_PAGE_MASK;
-         case INDEX_op_call:
+-            tb_end = tb_start + tb->size;
--            t0 = tci_read_ri(regs, &tb_ptr);
+-            if (tb_end > TARGET_PAGE_SIZE) {
-+            t0 = tci_read_i(&tb_ptr);
+-                tb_end = TARGET_PAGE_SIZE;
-             tci_tb_ptr = (uintptr_t)tb_ptr;
+-             }
- #if TCG_TARGET_REG_BITS == 32
+-        } else {
-             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
+-            tb_start = 0;
-@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
+-            tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
-         case INDEX_op_setcond_i32:
+-        }
-             t0 = *tb_ptr++;
+-        bitmap_set(p->code_bitmap, tb_start, tb_end - tb_start);
              t1 = tci_read_r32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond2_i32:
              t0 = *tb_ptr++;
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_setcond_i64:
              t0 = *tb_ptr++;
              t1 = tci_read_r64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
              break;
          case INDEX_op_divu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 / t2);
              break;
          case INDEX_op_rem_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
              break;
          case INDEX_op_remu_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 % t2);
              break;
          case INDEX_op_and_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 31));
              break;
          case INDEX_op_shr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 31));
              break;
          case INDEX_op_sar_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
              break;
  #if TCG_TARGET_HAS_rot_i32
          case INDEX_op_rotl_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol32(t1, t2 & 31));
              break;
          case INDEX_op_rotr_i32:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 -            t2 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
 +            t2 = tci_read_r32(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror32(t1, t2 & 31));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i32:
              t0 = tci_read_r32(regs, &tb_ptr);
 -            t1 = tci_read_ri32(regs, &tb_ptr);
 +            t1 = tci_read_r32(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
              break;
          case INDEX_op_brcond2_i32:
              tmp64 = tci_read_r64(regs, &tb_ptr);
 -            v64 = tci_read_ri64(regs, &tb_ptr);
 +            v64 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_add_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 + t2);
              break;
          case INDEX_op_sub_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 - t2);
              break;
          case INDEX_op_mul_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 * t2);
              break;
          case INDEX_op_div_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
              break;
          case INDEX_op_divu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
              break;
          case INDEX_op_rem_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
              break;
          case INDEX_op_remu_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
              break;
          case INDEX_op_and_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 & t2);
              break;
          case INDEX_op_or_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 | t2);
              break;
          case INDEX_op_xor_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 ^ t2);
              break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
          case INDEX_op_shl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 << (t2 & 63));
              break;
          case INDEX_op_shr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, t1 >> (t2 & 63));
              break;
          case INDEX_op_sar_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
              break;
  #if TCG_TARGET_HAS_rot_i64
          case INDEX_op_rotl_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, rol64(t1, t2 & 63));
              break;
          case INDEX_op_rotr_i64:
              t0 = *tb_ptr++;
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 -            t2 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
 +            t2 = tci_read_r64(regs, &tb_ptr);
              tci_write_reg(regs, t0, ror64(t1, t2 & 63));
              break;
  #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
  #endif
          case INDEX_op_brcond_i64:
              t0 = tci_read_r64(regs, &tb_ptr);
 -            t1 = tci_read_ri64(regs, &tb_ptr);
 +            t1 = tci_read_r64(regs, &tb_ptr);
              condition = *tb_ptr++;
              label = tci_read_label(&tb_ptr);
              if (tci_compare64(t0, t1, condition)) {
 diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tci/tcg-target.c.inc
 +++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rem_i64:
      case INDEX_op_remu_i32:
      case INDEX_op_remu_i64:
 -        return C_O1_I2(r, r, r);
 -
      case INDEX_op_add_i32:
      case INDEX_op_add_i64:
      case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_rotl_i64:
      case INDEX_op_rotr_i32:
      case INDEX_op_rotr_i64:
 -        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
 -        return C_O1_I2(r, ri, ri);
 +    case INDEX_op_setcond_i32:
 +    case INDEX_op_setcond_i64:
 +        return C_O1_I2(r, r, r);
      case INDEX_op_deposit_i32:
      case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_brcond_i32:
      case INDEX_op_brcond_i64:
 -        return C_O0_I2(r, ri);
 -
 -    case INDEX_op_setcond_i32:
 -    case INDEX_op_setcond_i64:
 -        return C_O1_I2(r, r, ri);
 +        return C_O0_I2(r, r);
  #if TCG_TARGET_REG_BITS == 32
      /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
      case INDEX_op_sub2_i32:
          return C_O2_I4(r, r, r, r, r, r);
      case INDEX_op_brcond2_i32:
 -        return C_O0_I4(r, r, ri, ri);
 +        return C_O0_I4(r, r, r, r);
      case INDEX_op_mulu2_i32:
          return C_O2_I2(r, r, r, r);
      case INDEX_op_setcond2_i32:
 -        return C_O1_I4(r, r, r, ri, ri);
 +        return C_O1_I4(r, r, r, r, r);
  #endif
      case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
      tcg_out8(s, t0);
  }
 -/* Write register or constant (native size). */
 -static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out_i(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -
 -/* Write register or constant (32 bit). */
 -static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out32(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -
 -#if TCG_TARGET_REG_BITS == 64
 -/* Write register or constant (64 bit). */
 -static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
 -{
 -    if (const_arg) {
 -        tcg_debug_assert(const_arg == 1);
 -        tcg_out8(s, TCG_CONST);
 -        tcg_out64(s, arg);
 -    } else {
 -        tcg_out_r(s, arg);
 -    }
 -}
 -#endif
 -
- /* Write label. */
+ /* add the tb in the target page and protect it if necessary
- static void tci_out_label(TCGContext *s, TCGLabel *label)
+  *
- {
+  * Called with mmap_lock held for user-mode emulation.
-@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
+@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
- {
+     page_already_protected = p->first_tb != (uintptr_t)NULL;
-     uint8_t *old_code_ptr = s->code_ptr;
+ #endif
-     tcg_out_op_t(s, INDEX_op_call);
+     p->first_tb = (uintptr_t)tb | n;
--    tcg_out_ri(s, 1, (uintptr_t)arg);
+-    invalidate_page_bitmap(p);
-+    tcg_out_i(s, (uintptr_t)arg);
-     old_code_ptr[1] = s->code_ptr - old_code_ptr;
+ #if defined(CONFIG_USER_ONLY)
      /* translator_loop() must have made all TB pages non-writable */
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      /* remove TB from the page(s) if we couldn't insert it */
      if (unlikely(existing_tb)) {
          tb_page_remove(p, tb);
 -        invalidate_page_bitmap(p);
          if (p2) {
              tb_page_remove(p2, tb);
 -            invalidate_page_bitmap(p2);
          }
          tb = existing_tb;
      }
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
  #if !defined(CONFIG_USER_ONLY)
      /* if no code remaining, no need to continue to use slow writes */
      if (!p->first_tb) {
 -        invalidate_page_bitmap(p);
          tlb_unprotect_code(start);
      }
  #endif
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
      }
      assert_page_locked(p);
 -    if (!p->code_bitmap &&
 -        ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD) {
 -        build_page_bitmap(p);
 -    }
 -    if (p->code_bitmap) {
 -        unsigned int nr;
 -        unsigned long b;
 -
 -        nr = start & ~TARGET_PAGE_MASK;
 -        b = p->code_bitmap[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG - 1));
 -        if (b & ((1 << len) - 1)) {
 -            goto do_invalidate;
 -        }
 -    } else {
 -    do_invalidate:
 -        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
 -                                              retaddr);
 -    }
 +    tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
 +                                          retaddr);
  }
+ #else
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
+ /* Called with mmap_lock held. If pc is not 0 then it indicates the
      case INDEX_op_setcond_i32:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[2]);
          tcg_out8(s, args[3]);   /* condition */
          break;
  #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
          tcg_out_r(s, args[2]);
 -        tcg_out_ri32(s, const_args[3], args[3]);
 -        tcg_out_ri32(s, const_args[4], args[4]);
 +        tcg_out_r(s, args[3]);
 +        tcg_out_r(s, args[4]);
          tcg_out8(s, args[5]);   /* condition */
          break;
  #elif TCG_TARGET_REG_BITS == 64
      case INDEX_op_setcond_i64:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri64(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[2]);
          tcg_out8(s, args[3]);   /* condition */
          break;
  #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
      case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
      case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 -        tcg_out_ri64(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
      case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
          tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
          break;
      case INDEX_op_brcond_i64:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri64(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
      case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 +        tcg_out_r(s, args[1]);
 +        tcg_out_r(s, args[2]);
          break;
  #if TCG_TARGET_REG_BITS == 32
      case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
      case INDEX_op_brcond2_i32:
          tcg_out_r(s, args[0]);
          tcg_out_r(s, args[1]);
 -        tcg_out_ri32(s, const_args[2], args[2]);
 -        tcg_out_ri32(s, const_args[3], args[3]);
 +        tcg_out_r(s, args[2]);
 +        tcg_out_r(s, args[3]);
          tcg_out8(s, args[4]);           /* condition */
          tci_out_label(s, arg_label(args[5]));
          break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
  #endif
      case INDEX_op_brcond_i32:
          tcg_out_r(s, args[0]);
 -        tcg_out_ri32(s, const_args[1], args[1]);
 +        tcg_out_r(s, args[1]);
          tcg_out8(s, args[2]);           /* condition */
          tci_out_label(s, arg_label(args[3]));
          break;
 --
-.25.1
+.34.1

-[PULL 30/46] target/riscv: remove CONFIG_TCG, as it is always TCG
+Deleted patch
-From: Claudio Fontana <cfontana@suse.de>
-for now only TCG is allowed as an accelerator for riscv,
-so remove the CONFIG_TCG use.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20210204163931.7358-3-cfontana@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/riscv/cpu.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
- #endif
-     cc->gdb_arch_name = riscv_gdb_arch_name;
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
--#ifdef CONFIG_TCG
-     cc->tcg_ops.initialize = riscv_translate_init;
-     cc->tlb_fill = riscv_cpu_tlb_fill;
--#endif
-+
-     device_class_set_props(dc, riscv_cpu_properties);
- }
---
-.25.1

-[PULL 31/46] accel/tcg: split TCG-only code from cpu_exec_realizefn
+[PULL 11/20] accel/tcg: Use bool for page_find_alloc
-From: Claudio Fontana <cfontana@suse.de>
+Bool is more appropriate type for the alloc parameter.
 move away TCG-only code, make it compile only on TCG.
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 [claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-4-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/exec/cpu-all.h | 11 +++++--
+ accel/tcg/translate-all.c | 14 +++++++-------
- include/hw/core/cpu.h  |  2 ++
+file changed, 7 insertions(+), 7 deletions(-)
  accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
  cpu.c                  | 70 ++++++++++++++++++++----------------------
  hw/core/cpu.c          |  6 +++-
 files changed, 77 insertions(+), 40 deletions(-)
-diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-all.h
+--- a/accel/tcg/translate-all.c
-+++ b/include/exec/cpu-all.h
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ void page_init(void)
  }
  #ifdef CONFIG_TCG
 +/* accel/tcg/cpu-exec.c */
  void dump_drift_info(void);
 +/* accel/tcg/translate-all.c */
  void dump_exec_info(void);
  void dump_opcount_info(void);
  #endif /* CONFIG_TCG */
  #endif /* !CONFIG_USER_ONLY */
 +#ifdef CONFIG_TCG
 +/* accel/tcg/cpu-exec.c */
 +int cpu_exec(CPUState *cpu);
 +void tcg_exec_realizefn(CPUState *cpu, Error **errp);
 +void tcg_exec_unrealizefn(CPUState *cpu);
 +#endif /* CONFIG_TCG */
 +
  /* Returns: 0 on success, -1 on error */
  int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                          void *ptr, target_ulong len, bool is_write);
 -int cpu_exec(CPUState *cpu);
 -
  /**
   * cpu_set_cpustate_pointers(cpu)
   * @cpu: The cpu object
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
  void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
      GCC_FMT_ATTR(2, 3);
 +
 +/* $(top_srcdir)/cpu.c */
  void cpu_exec_initfn(CPUState *cpu);
  void cpu_exec_realizefn(CPUState *cpu, Error **errp);
  void cpu_exec_unrealizefn(CPUState *cpu);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
      return ret;
  }
 +void tcg_exec_realizefn(CPUState *cpu, Error **errp)
 +{
 +    static bool tcg_target_initialized;
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
 +    if (!tcg_target_initialized) {
 +        cc->tcg_ops.initialize();
 +        tcg_target_initialized = true;
 +    }
 +    tlb_init(cpu);
 +    qemu_plugin_vcpu_init_hook(cpu);
 +
 +#ifndef CONFIG_USER_ONLY
 +    tcg_iommu_init_notifier_list(cpu);
 +#endif /* !CONFIG_USER_ONLY */
 +}
 +
 +/* undo the initializations in reverse order */
 +void tcg_exec_unrealizefn(CPUState *cpu)
 +{
 +#ifndef CONFIG_USER_ONLY
 +    tcg_iommu_free_notifier_list(cpu);
 +#endif /* !CONFIG_USER_ONLY */
 +
 +    qemu_plugin_vcpu_exit_hook(cpu);
 +    tlb_destroy(cpu);
 +}
 +
  #ifndef CONFIG_USER_ONLY
  void dump_drift_info(void)
 diff --git a/cpu.c b/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/cpu.c
 +++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
  };
  #endif
 -void cpu_exec_unrealizefn(CPUState *cpu)
 +void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    tlb_destroy(cpu);
 -    cpu_list_remove(cpu);
 +    cpu_list_add(cpu);
 +
 +#ifdef CONFIG_TCG
 +    /* NB: errp parameter is unused currently */
 +    if (tcg_enabled()) {
 +        tcg_exec_realizefn(cpu, errp);
 +    }
 +#endif /* CONFIG_TCG */
 +
 +#ifdef CONFIG_USER_ONLY
 +    assert(cc->vmsd == NULL);
 +#else
 +    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 +    }
 +    if (cc->vmsd != NULL) {
 +        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 +    }
 +#endif /* CONFIG_USER_ONLY */
 +}
 +
 +void cpu_exec_unrealizefn(CPUState *cpu)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
  #ifdef CONFIG_USER_ONLY
      assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
      if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
          vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
      }
 -    tcg_iommu_free_notifier_list(cpu);
  #endif
 +#ifdef CONFIG_TCG
 +    /* NB: errp parameter is unused currently */
 +    if (tcg_enabled()) {
 +        tcg_exec_unrealizefn(cpu);
 +    }
 +#endif /* CONFIG_TCG */
 +
 +    cpu_list_remove(cpu);
  }
  void cpu_exec_initfn(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
  #endif
  }
--void cpu_exec_realizefn(CPUState *cpu, Error **errp)
+-static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
--{
++static PageDesc *page_find_alloc(tb_page_addr_t index, bool alloc)
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -#ifdef CONFIG_TCG
 -    static bool tcg_target_initialized;
 -#endif /* CONFIG_TCG */
 -
 -    cpu_list_add(cpu);
 -
 -#ifdef CONFIG_TCG
 -    if (tcg_enabled() && !tcg_target_initialized) {
 -        tcg_target_initialized = true;
 -        cc->tcg_ops.initialize();
 -    }
 -#endif /* CONFIG_TCG */
 -    tlb_init(cpu);
 -
 -    qemu_plugin_vcpu_init_hook(cpu);
 -
 -#ifdef CONFIG_USER_ONLY
 -    assert(cc->vmsd == NULL);
 -#else /* !CONFIG_USER_ONLY */
 -    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 -    }
 -    if (cc->vmsd != NULL) {
 -        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 -    }
 -
 -    tcg_iommu_init_notifier_list(cpu);
 -#endif
 -}
 -
  const char *parse_cpu_option(const char *cpu_option)
  {
-     ObjectClass *oc;
+     PageDesc *pd;
-diff --git a/hw/core/cpu.c b/hw/core/cpu.c
+     void **lp;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
---- a/hw/core/cpu.c
-+++ b/hw/core/cpu.c
+ static inline PageDesc *page_find(tb_page_addr_t index)
-@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
+ {
-     return target_words_bigendian();
+-    return page_find_alloc(index, 0);
 +    return page_find_alloc(index, false);
  }
-+/*
+ static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-+ * XXX the following #if is always true because this is a common_ss
+-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc);
-+ * module, so target CONFIG_* is never defined.
++                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc);
-+ */
- #if !defined(CONFIG_USER_ONLY)
+ /* In user-mode page locks aren't used; mmap_lock is enough */
- GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
+ #ifdef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static inline void page_unlock(PageDesc *pd)
  /* lock the page(s) of a TB in the correct acquisition order */
  static inline void page_lock_tb(const TranslationBlock *tb)
  {
-@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
+-    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], 0);
- static void cpu_common_unrealizefn(DeviceState *dev)
++    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], false);
  }
  static inline void page_unlock_tb(const TranslationBlock *tb)
@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
  #endif /* !CONFIG_USER_ONLY */
  static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
 -                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc)
 +                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
  {
-     CPUState *cpu = CPU(dev);
+     PageDesc *p1, *p2;
-+
+     tb_page_addr_t page1;
-     /* NOTE: latest generic point before the cpu is fully unrealized */
+@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
-     trace_fini_vcpu(cpu);
+      * Note that inserting into the hash table first isn't an option, since
--    qemu_plugin_vcpu_exit_hook(cpu);
+      * we can only insert TBs that are fully initialized.
-     cpu_exec_unrealizefn(cpu);
+      */
- }
+-    page_lock_pair(&p, phys_pc, &p2, phys_page2, 1);
++    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
      tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
      if (p2) {
          tb_page_add(p2, tb, 1, phys_page2);
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
      for (addr = start, len = end - start;
           len != 0;
           len -= TARGET_PAGE_SIZE, addr += TARGET_PAGE_SIZE) {
 -        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
 +        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, true);
          /* If the write protection bit is set, then we invalidate
             the code inside.  */
 --
-.25.1
+.34.1

-[PULL 39/46] cpu: move do_unaligned_access to tcg_ops
+[PULL 12/20] accel/tcg: Use DisasContextBase in plugin_gen_tb_start
-From: Claudio Fontana <cfontana@suse.de>
+Use the pc coming from db->pc_first rather than the TB.
-make it consistently SOFTMMU-only.
+Use the cached host_addr rather than re-computing for the
 first page.  We still need a separate lookup for the second
 page because it won't be computed for DisasContextBase until
 the translator actually performs a read from the page.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
-Message-Id: <20210204163931.7358-12-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 13 +++++++------
+ include/exec/plugin-gen.h |  7 ++++---
- target/alpha/cpu.c              |  2 +-
+ accel/tcg/plugin-gen.c    | 22 +++++++++++-----------
- target/arm/cpu.c                |  2 +-
+ accel/tcg/translator.c    |  2 +-
- target/hppa/cpu.c               |  4 +++-
+files changed, 16 insertions(+), 15 deletions(-)
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  3 ++-
  target/nios2/cpu.c              |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/s390x/excp_helper.c      |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc |  2 +-
 files changed, 23 insertions(+), 19 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/include/exec/plugin-gen.h
-+++ b/include/hw/core/cpu.h
++++ b/include/exec/plugin-gen.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ struct DisasContextBase;
-                                   unsigned size, MMUAccessType access_type,
-                                   int mmu_idx, MemTxAttrs attrs,
+ #ifdef CONFIG_PLUGIN
-                                   MemTxResult response, uintptr_t retaddr);
-+    /**
+-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress);
-+     * @do_unaligned_access: Callback for unaligned access handling
++bool plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db,
-+     */
++                         bool supress);
-+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+ void plugin_gen_tb_end(CPUState *cpu);
-+                                MMUAccessType access_type,
+ void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
-+                                int mmu_idx, uintptr_t retaddr);
+ void plugin_gen_insn_end(void);
- } TcgCpuOperations;
+@@ -XXX,XX +XXX,XX @@ static inline void plugin_insn_append(abi_ptr pc, const void *from, size_t size)
- /**
+ #else /* !CONFIG_PLUGIN */
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  * @parse_features: Callback to parse command line arguments.
+-static inline
-  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
+-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress)
-  * @has_work: Callback for checking if there is work to do.
++static inline bool
-- * @do_unaligned_access: Callback for unaligned access handling, if
++plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db, bool sup)
 - * the target defines #TARGET_ALIGNED_ONLY.
   * @virtio_is_big_endian: Callback to return %true if a CPU which supports
   * runtime configurable endianness is currently big-endian. Non-configurable
   * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      int reset_dump_flags;
      bool (*has_work)(CPUState *cpu);
 -    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 -                                MMUAccessType access_type,
 -                                int mmu_idx, uintptr_t retaddr);
      bool (*virtio_is_big_endian)(CPUState *cpu);
      int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                             uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
  {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+     return false;
 -    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 +    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
  }
+diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
  static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
+--- a/accel/tcg/plugin-gen.c
-+++ b/target/alpha/cpu.c
++++ b/accel/tcg/plugin-gen.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
-     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
+     pr_ops();
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
      cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
      cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 -    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
  #if !defined(CONFIG_USER_ONLY)
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
      cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
      cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
      info->print_insn = print_insn_hppa;
  }
-+#ifndef CONFIG_USER_ONLY
+-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_only)
- static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
++bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
-                                          MMUAccessType access_type,
++                         bool mem_only)
                                           int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
      cpu_loop_exit_restore(cs, retaddr);
  }
 +#endif /* CONFIG_USER_ONLY */
  static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
  {
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+     bool ret = false;
-     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_onl
-     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
-+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
+         ret = true;
-     dc->vmsd = &vmstate_hppa_cpu;
- #endif
+-        ptb->vaddr = tb->pc;
--    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
++        ptb->vaddr = db->pc_first;
-     cc->disas_set_info = hppa_cpu_disas_set_info;
+         ptb->vaddr2 = -1;
-     cc->tcg_ops.initialize = hppa_translate_init;
+-        get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
++        ptb->haddr1 = db->host_addr[0];
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+         ptb->haddr2 = NULL;
-index XXXXXXX..XXXXXXX 100644
+         ptb->mem_only = mem_only;
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
+@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+      * Note that we skip this when haddr1 == NULL, e.g. when we're
-     cc->class_by_name = mb_cpu_class_by_name;
+      * fetching instructions from a region not backed by RAM.
-     cc->has_work = mb_cpu_has_work;
+      */
-     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
+-    if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
--    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
+-        unlikely((db->pc_next & TARGET_PAGE_MASK) !=
-     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
+-                 (db->pc_first & TARGET_PAGE_MASK))) {
-     cc->dump_state = mb_cpu_dump_state;
+-        get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
-     cc->set_pc = mb_cpu_set_pc;
+-                                 &ptb->haddr2);
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+-        ptb->vaddr2 = db->pc_next;
-     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
+-    }
- #ifndef CONFIG_USER_ONLY
+-    if (likely(ptb->vaddr2 == -1)) {
-     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
++    if (ptb->haddr1 == NULL) {
-+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
++        pinsn->haddr = NULL;
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
++    } else if (is_same_page(db, db->pc_next)) {
-     dc->vmsd = &vmstate_mb_cpu;
+         pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
- #endif
+     } else {
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
++        if (ptb->vaddr2 == -1) {
-index XXXXXXX..XXXXXXX 100644
++            ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
---- a/target/mips/cpu.c
++            get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2);
-+++ b/target/mips/cpu.c
++        }
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
+         pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
      cc->gdb_write_register = mips_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
      cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_mips_cpu;
  #endif
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 +    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
 +
  #endif /* CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = nios2_cpu_disas_set_info;
      cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
  #endif
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
      cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
      /* For now, mark unmigratable: */
      cc->vmsd = &vmstate_riscv_cpu;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
  #ifdef CONFIG_TCG
      cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
      cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/excp_helper.c
 +++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
      }
  }
+diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
 -#endif /* CONFIG_USER_ONLY */
 +#endif /* !CONFIG_USER_ONLY */
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/sh4/cpu.c
+--- a/accel/tcg/translator.c
-+++ b/target/sh4/cpu.c
++++ b/accel/tcg/translator.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
-     cc->gdb_write_register = superh_cpu_gdb_write_register;
+     ops->tb_start(db, cpu);
-     cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
+     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
- #ifndef CONFIG_USER_ONLY
--    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
+-    plugin_enabled = plugin_gen_tb_start(cpu, tb, cflags & CF_MEMI_ONLY);
-+    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
++    plugin_enabled = plugin_gen_tb_start(cpu, db, cflags & CF_MEMI_ONLY);
-     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
- #endif
+     while (true) {
-     cc->disas_set_info = superh_cpu_disas_set_info;
+         db->num_insns++;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
      cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_stop_before_watchpoint = true;
      cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 -    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
 +    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->set_pc = ppc_cpu_set_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
      cc->gdb_write_register = ppc_cpu_gdb_write_register;
 -    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #ifndef CONFIG_USER_ONLY
      cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
      cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 +    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
  #endif /* !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 --
-.25.1
+.34.1

-[PULL 35/46] cpu: Move debug_excp_handler to tcg_ops
+[PULL 13/20] accel/tcg: Do not align tb->page_addr[0]
-From: Eduardo Habkost <ehabkost@redhat.com>
+Let tb->page_addr[0] contain the address of the first byte of the
 translated block, rather than the address of the page containing the
 start of the translated block.  We need to recover this value anyway
 at various points, and it is easier to discard a page offset when it
 is not needed, which happens naturally via the existing find_page shift.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204163931.7358-8-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 4 ++--
+ accel/tcg/cpu-exec.c      | 16 ++++++++--------
- accel/tcg/cpu-exec.c      | 4 ++--
+ accel/tcg/cputlb.c        |  3 ++-
- target/arm/cpu.c          | 2 +-
+ accel/tcg/translate-all.c |  9 +++++----
- target/i386/tcg/tcg-cpu.c | 2 +-
+files changed, 15 insertions(+), 13 deletions(-)
  target/lm32/cpu.c         | 2 +-
  target/s390x/cpu.c        | 2 +-
  target/xtensa/cpu.c       | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                      MMUAccessType access_type, int mmu_idx,
-                      bool probe, uintptr_t retaddr);
-+    /** @debug_excp_handler: Callback for handling debug exceptions */
-+    void (*debug_excp_handler)(CPUState *cpu);
- } TcgCpuOperations;
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  * @gdb_write_register: Callback for letting GDB write a register.
-  * @debug_check_watchpoint: Callback: return true if the architectural
-  *       watchpoint whose address has matched should really fire.
-- * @debug_excp_handler: Callback for handling debug exceptions.
-  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
-  * 64-bit VM coredump.
-  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
-     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
-     bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
--    void (*debug_excp_handler)(CPUState *cpu);
-     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
-                             int cpuid, void *opaque);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ struct tb_desc {
      target_ulong pc;
      target_ulong cs_base;
      CPUArchState *env;
 -    tb_page_addr_t phys_page1;
 +    tb_page_addr_t page_addr0;
      uint32_t flags;
      uint32_t cflags;
      uint32_t trace_vcpu_dstate;
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
      const struct tb_desc *desc = d;
      if (tb->pc == desc->pc &&
 -        tb->page_addr[0] == desc->phys_page1 &&
 +        tb->page_addr[0] == desc->page_addr0 &&
          tb->cs_base == desc->cs_base &&
          tb->flags == desc->flags &&
          tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
          if (tb->page_addr[1] == -1) {
              return true;
          } else {
 -            tb_page_addr_t phys_page2;
 -            target_ulong virt_page2;
 +            tb_page_addr_t phys_page1;
 +            target_ulong virt_page1;
              /*
               * We know that the first page matched, and an otherwise valid TB
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
               * is different for the new TB.  Therefore any exception raised
               * here by the faulting lookup is not premature.
               */
 -            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
 -            phys_page2 = get_page_addr_code(desc->env, virt_page2);
 -            if (tb->page_addr[1] == phys_page2) {
 +            virt_page1 = TARGET_PAGE_ALIGN(desc->pc);
 +            phys_page1 = get_page_addr_code(desc->env, virt_page1);
 +            if (tb->page_addr[1] == phys_page1) {
                  return true;
              }
          }
+@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
+     if (phys_pc == -1) {
+         return NULL;
      }
+-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
--    if (cc->debug_excp_handler) {
++    desc.page_addr0 = phys_pc;
--        cc->debug_excp_handler(cpu);
+     h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
-+    if (cc->tcg_ops.debug_excp_handler) {
+     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 +        cc->tcg_ops.debug_excp_handler(cpu);
      }
  }
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/accel/tcg/cputlb.c
-+++ b/target/arm/cpu.c
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
-     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
+    can be detected */
-     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
+ void tlb_protect_code(ram_addr_t ram_addr)
-     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
+ {
--    cc->debug_excp_handler = arm_debug_excp_handler;
+-    cpu_physical_memory_test_and_clear_dirty(ram_addr, TARGET_PAGE_SIZE,
-+    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
++    cpu_physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
++                                             TARGET_PAGE_SIZE,
-     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
+                                              DIRTY_MEMORY_CODE);
- #if !defined(CONFIG_USER_ONLY)
+ }
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/tcg-cpu.c
+--- a/accel/tcg/translate-all.c
-+++ b/target/i386/tcg/tcg-cpu.c
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
+@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
-     cc->tcg_ops.initialize = tcg_x86_init;
+     qemu_spin_unlock(&tb->jmp_lock);
-     cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
+     /* remove the TB from the hash list */
--    cc->debug_excp_handler = breakpoint_handler;
+-    phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
-+    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
++    phys_pc = tb->page_addr[0];
- #endif
+     h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
- }
+                      tb->trace_vcpu_dstate);
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
+     if (!qht_remove(&tb_ctx.htable, tb, h)) {
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
---- a/target/lm32/cpu.c
+      * we can only insert TBs that are fully initialized.
-+++ b/target/lm32/cpu.c
+      */
-@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
+     page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
- #endif
+-    tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
-     cc->gdb_num_core_regs = 32 + 7;
++    tb_page_add(p, tb, 0, phys_pc);
-     cc->gdb_stop_before_watchpoint = true;
+     if (p2) {
--    cc->debug_excp_handler = lm32_debug_excp_handler;
+         tb_page_add(p2, tb, 1, phys_page2);
-+    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
+     } else {
-     cc->disas_set_info = lm32_cpu_disas_set_info;
+@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
-     cc->tcg_ops.initialize = lm32_translate_init;
+         if (n == 0) {
- }
+             /* NOTE: tb_end may be after the end of the page, but
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+                it is not a problem */
-index XXXXXXX..XXXXXXX 100644
+-            tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
---- a/target/s390x/cpu.c
++            tb_start = tb->page_addr[0];
-+++ b/target/s390x/cpu.c
+             tb_end = tb_start + tb->size;
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+         } else {
-     cc->write_elf64_note = s390_cpu_write_elf64_note;
+             tb_start = tb->page_addr[1];
- #ifdef CONFIG_TCG
+-            tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
-     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
++            tb_end = tb_start + ((tb->page_addr[0] + tb->size)
--    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
++                                 & ~TARGET_PAGE_MASK);
-+    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
+         }
-     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
+         if (!(tb_end <= start || tb_start >= end)) {
- #endif
+ #ifdef TARGET_HAS_PRECISE_SMC
  #endif
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
      cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
  #endif
 -    cc->debug_excp_handler = xtensa_breakpoint_handler;
 +    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
      cc->disas_set_info = xtensa_cpu_disas_set_info;
      cc->tcg_ops.initialize = xtensa_translate_init;
      dc->vmsd = &vmstate_xtensa_cpu;
 --
-.25.1
+.34.1

-[PULL 41/46] cpu: move adjust_watchpoint_address to tcg_ops
+[PULL 14/20] accel/tcg: Inline tb_flush_jmp_cache
-From: Claudio Fontana <cfontana@suse.de>
+This function has two users, who use it incompatibly.
 In tlb_flush_page_by_mmuidx_async_0, when flushing a
 single page, we need to flush exactly two pages.
 In tlb_flush_range_by_mmuidx_async_0, when flushing a
 range of pages, we need to flush N+1 pages.
-commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")
+This avoids double-flushing of jmp cache pages in a range.
-introduced this ARM-specific, TCG-specific hack to adjust the address,
-before checking it with cpu_check_watchpoint.
-Make adjust_watchpoint_address optional and move it to tcg_ops.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20210204163931.7358-14-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h | 6 +++++-
+ accel/tcg/cputlb.c | 25 ++++++++++++++-----------
- hw/core/cpu.c         | 6 ------
+file changed, 14 insertions(+), 11 deletions(-)
  softmmu/physmem.c     | 5 ++++-
  target/arm/cpu.c      | 2 +-
 files changed, 10 insertions(+), 9 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/accel/tcg/cputlb.c
-+++ b/include/hw/core/cpu.h
++++ b/accel/tcg/cputlb.c
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
-     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+     }
                                  MMUAccessType access_type,
                                  int mmu_idx, uintptr_t retaddr);
 +    /**
 +     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 +     */
 +    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 +
  } TcgCpuOperations;
  /**
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
      const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
      void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
 -    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
      const char *deprecation_note;
      /* Keep non-pointer data at the end to minimize holes.  */
 diff --git a/hw/core/cpu.c b/hw/core/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/cpu.c
 +++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
      return cpu->cpu_index;
  }
--static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
+-static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
 -{
--    return addr;
+-    /* Discard jump cache entries for any tb which might potentially
 -       overlap the flushed page.  */
 -    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
 -    tb_jmp_cache_clear_page(cpu, addr);
 -}
 -
- static Property cpu_common_props[] = {
+ /**
- #ifndef CONFIG_USER_ONLY
+  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
-     /* Create a memory property for softmmu CPU object,
+  * @desc: The CPUTLBDesc portion of the TLB
-@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
-     k->gdb_write_register = cpu_common_gdb_write_register;
+     }
-     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
+     qemu_spin_unlock(&env_tlb(env)->c.lock);
-     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
--    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
+-    tb_flush_jmp_cache(cpu, addr);
-     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
++    /*
-     dc->realize = cpu_common_realizefn;
++     * Discard jump cache entries for any tb which might potentially
-     dc->unrealize = cpu_common_unrealizefn;
++     * overlap the flushed page, which includes the previous.
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
++     */
-index XXXXXXX..XXXXXXX 100644
++    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
---- a/softmmu/physmem.c
++    tb_jmp_cache_clear_page(cpu, addr);
-+++ b/softmmu/physmem.c
+ }
-@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
  /**
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
          return;
      }
--    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+-    for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
-+    if (cc->tcg_ops.adjust_watchpoint_address) {
+-        tb_flush_jmp_cache(cpu, d.addr + i);
-+        /* this is currently used only by ARM BE32 */
++    /*
-+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
++     * Discard jump cache entries for any tb which might potentially
-+    }
++     * overlap the flushed pages, which includes the previous.
-     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
++     */
-         if (watchpoint_address_matches(wp, addr, len)
++    d.addr -= TARGET_PAGE_SIZE;
-             && (wp->flags & flags)) {
++    for (target_ulong i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++        tb_jmp_cache_clear_page(cpu, d.addr);
-index XXXXXXX..XXXXXXX 100644
++        d.addr += TARGET_PAGE_SIZE;
---- a/target/arm/cpu.c
+     }
-+++ b/target/arm/cpu.c
+ }
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
  #if !defined(CONFIG_USER_ONLY)
      cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
      cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
 -    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
 +    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
      cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
  #endif /* CONFIG_TCG */
 --
-.25.1
+.34.1

-[PULL 46/46] accel: introduce AccelCPUClass extending CPUClass
+[PULL 15/20] include/hw/core: Create struct CPUJumpCache
-From: Claudio Fontana <cfontana@suse.de>
+Wrap the bare TranslationBlock pointer into a structure.
-add a new optional interface to CPUClass, which allows accelerators
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-to extend the CPUClass with additional accelerator-specific
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 initializations.
 This will allow to separate the target cpu code that is specific
 to each accelerator, and register it automatically with object
 hierarchy lookup depending on accelerator code availability,
 as part of the accel_init_interfaces() initialization step.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-19-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
+ accel/tcg/tb-hash.h       |  1 +
- include/hw/core/cpu.h       |  4 ++++
+ accel/tcg/tb-jmp-cache.h  | 24 ++++++++++++++++++++++++
- accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
+ include/exec/cpu-common.h |  1 +
- MAINTAINERS                 |  1 +
+ include/hw/core/cpu.h     | 15 +--------------
-files changed, 87 insertions(+)
+ include/qemu/typedefs.h   |  1 +
- create mode 100644 include/hw/core/accel-cpu.h
+ accel/stubs/tcg-stub.c    |  4 ++++
  accel/tcg/cpu-exec.c      | 10 +++++++---
  accel/tcg/cputlb.c        |  9 +++++----
  accel/tcg/translate-all.c | 28 +++++++++++++++++++++++++---
  hw/core/cpu-common.c      |  3 +--
  plugins/core.c            |  2 +-
  trace/control-target.c    |  2 +-
 files changed, 72 insertions(+), 28 deletions(-)
  create mode 100644 accel/tcg/tb-jmp-cache.h
-diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
+diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tb-hash.h
 +++ b/accel/tcg/tb-hash.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/cpu-defs.h"
  #include "exec/exec-all.h"
  #include "qemu/xxhash.h"
 +#include "tb-jmp-cache.h"
  #ifdef CONFIG_SOFTMMU
 diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/core/accel-cpu.h
++++ b/accel/tcg/tb-jmp-cache.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Accelerator interface, specializes CPUClass
++ * The per-CPU TranslationBlock jump cache.
 + * This header is used only by target-specific code.
 + *
-+ * Copyright 2021 SUSE LLC
++ *  Copyright (c) 2003 Fabrice Bellard
 + *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * See the COPYING file in the top-level directory.
 + */
 +
-+#ifndef ACCEL_CPU_H
++#ifndef ACCEL_TCG_TB_JMP_CACHE_H
-+#define ACCEL_CPU_H
++#define ACCEL_TCG_TB_JMP_CACHE_H
 +
 +#define TB_JMP_CACHE_BITS 12
 +#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
 +
 +/*
-+ * This header is used to define new accelerator-specific target-specific
++ * Accessed in parallel; all accesses to 'tb' must be atomic.
 + * accelerator cpu subclasses.
 + * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
 + *
 + * Do not try to use for any other purpose than the implementation of new
 + * subclasses in target/, or the accel implementation itself in accel/
 + */
-+
++struct CPUJumpCache {
-+#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
++    struct {
-+#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
++        TranslationBlock *tb;
-+typedef struct AccelCPUClass AccelCPUClass;
++    } array[TB_JMP_CACHE_SIZE];
-+DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
++};
 +
-+typedef struct AccelCPUClass {
++#endif /* ACCEL_TCG_TB_JMP_CACHE_H */
-+    /*< private >*/
+diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
-+    ObjectClass parent_class;
+index XXXXXXX..XXXXXXX 100644
-+    /*< public >*/
+--- a/include/exec/cpu-common.h
-+
++++ b/include/exec/cpu-common.h
-+    void (*cpu_class_init)(CPUClass *cc);
+@@ -XXX,XX +XXX,XX @@ void cpu_list_unlock(void);
-+    void (*cpu_instance_init)(CPUState *cpu);
+ unsigned int cpu_list_generation_id_get(void);
-+    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
-+} AccelCPUClass;
+ void tcg_flush_softmmu_tlb(CPUState *cs);
-+
++void tcg_flush_jmp_cache(CPUState *cs);
-+#endif /* ACCEL_CPU_H */
  void tcg_iommu_init_notifier_list(CPUState *cpu);
  void tcg_iommu_free_notifier_list(CPUState *cpu);
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
+@@ -XXX,XX +XXX,XX @@ struct kvm_run;
- /* see tcg-cpu-ops.h */
+ struct hax_vcpu_state;
- struct TCGCPUOps;
+ struct hvf_vcpu_state;
-+/* see accel-cpu.h */
+-#define TB_JMP_CACHE_BITS 12
-+struct AccelCPUClass;
+-#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
-+
+-
  /* work queue */
  /* The union type allows passing of 64 bit target pointers on 32 bit
@@ -XXX,XX +XXX,XX @@ struct CPUState {
      CPUArchState *env_ptr;
      IcountDecr *icount_decr_ptr;
 -    /* Accessed in parallel; all accesses must be atomic */
 -    TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];
 +    CPUJumpCache *tb_jmp_cache;
      struct GDBRegisterState *gdb_regs;
      int gdb_num_regs;
@@ -XXX,XX +XXX,XX @@ extern CPUTailQ cpus;
  extern __thread CPUState *current_cpu;
 -static inline void cpu_tb_jmp_cache_clear(CPUState *cpu)
 -{
 -    unsigned int i;
 -
 -    for (i = 0; i < TB_JMP_CACHE_SIZE; i++) {
 -        qatomic_set(&cpu->tb_jmp_cache[i], NULL);
 -    }
 -}
 -
  /**
-  * CPUClass:
+  * qemu_tcg_mttcg_enabled:
-  * @class_by_name: Callback to map -cpu command line model name to an
+  * Check whether we are running MultiThread TCG or not.
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
-     /* Keep non-pointer data at the end to minimize holes.  */
+index XXXXXXX..XXXXXXX 100644
-     int gdb_num_core_regs;
+--- a/include/qemu/typedefs.h
-     bool gdb_stop_before_watchpoint;
++++ b/include/qemu/typedefs.h
-+    struct AccelCPUClass *accel_cpu;
+@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex CoMutex;
+ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
-     /* when TCG is not available, this pointer is NULL */
+ typedef struct CPUAddressSpace CPUAddressSpace;
-     struct TCGCPUOps *tcg_ops;
+ typedef struct CPUArchState CPUArchState;
-diff --git a/accel/accel-common.c b/accel/accel-common.c
++typedef struct CPUJumpCache CPUJumpCache;
-index XXXXXXX..XXXXXXX 100644
+ typedef struct CPUState CPUState;
---- a/accel/accel-common.c
+ typedef struct CPUTLBEntryFull CPUTLBEntryFull;
-+++ b/accel/accel-common.c
+ typedef struct DeviceListener DeviceListener;
 diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/stubs/tcg-stub.c
 +++ b/accel/stubs/tcg-stub.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
  {
  }
 +void tcg_flush_jmp_cache(CPUState *cpu)
 +{
 +}
 +
  int probe_access_flags(CPUArchState *env, target_ulong addr,
                         MMUAccessType access_type, int mmu_idx,
                         bool nonfault, void **phost, uintptr_t retaddr)
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
+ #include "sysemu/replay.h"
- #include "qemu/accel.h"
+ #include "sysemu/tcg.h"
+ #include "exec/helper-proto.h"
-+#include "cpu.h"
++#include "tb-jmp-cache.h"
-+#include "hw/core/accel-cpu.h"
+ #include "tb-hash.h"
-+
+ #include "tb-context.h"
  #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      tcg_debug_assert(!(cflags & CF_INVALID));
      hash = tb_jmp_cache_hash_func(pc);
 -    tb = qatomic_rcu_read(&cpu->tb_jmp_cache[hash]);
 +    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
      if (likely(tb &&
                 tb->pc == pc &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      if (tb == NULL) {
          return NULL;
      }
 -    qatomic_set(&cpu->tb_jmp_cache[hash], tb);
 +    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
      return tb;
  }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
              tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
              if (tb == NULL) {
 +                uint32_t h;
 +
                  mmap_lock();
                  tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
                  mmap_unlock();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                   * We add the TB in the virtual pc hash table
                   * for the fast lookup
                   */
 -                qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
 +                h = tb_jmp_cache_hash_func(pc);
 +                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
              }
  #ifndef CONFIG_USER_ONLY
- #include "accel-softmmu.h"
+diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
- #endif /* !CONFIG_USER_ONLY */
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
+--- a/accel/tcg/cputlb.c
-     return ac;
++++ b/accel/tcg/cputlb.c
- }
+@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
-+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+ static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
  {
 -    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
 +    int i, i0 = tb_jmp_cache_hash_page(page_addr);
 +    CPUJumpCache *jc = cpu->tb_jmp_cache;
      for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
 -        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
 +        qatomic_set(&jc->array[i0 + i].tb, NULL);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
      qemu_spin_unlock(&env_tlb(env)->c.lock);
 -    cpu_tb_jmp_cache_clear(cpu);
 +    tcg_flush_jmp_cache(cpu);
      if (to_clean == ALL_MMUIDX_BITS) {
          qatomic_set(&env_tlb(env)->c.full_flush_count,
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
       * longer to clear each entry individually than it will to clear it all.
       */
      if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
 -        cpu_tb_jmp_cache_clear(cpu);
 +        tcg_flush_jmp_cache(cpu);
          return;
      }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/tcg.h"
  #include "qapi/error.h"
  #include "hw/core/tcg-cpu-ops.h"
 +#include "tb-jmp-cache.h"
  #include "tb-hash.h"
  #include "tb-context.h"
  #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
      }
      CPU_FOREACH(cpu) {
 -        cpu_tb_jmp_cache_clear(cpu);
 +        tcg_flush_jmp_cache(cpu);
      }
      qht_reset_size(&tb_ctx.htable, CODE_GEN_HTABLE_SIZE);
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      /* remove the TB from the hash list */
      h = tb_jmp_cache_hash_func(tb->pc);
      CPU_FOREACH(cpu) {
 -        if (qatomic_read(&cpu->tb_jmp_cache[h]) == tb) {
 -            qatomic_set(&cpu->tb_jmp_cache[h], NULL);
 +        CPUJumpCache *jc = cpu->tb_jmp_cache;
 +        if (qatomic_read(&jc->array[h].tb) == tb) {
 +            qatomic_set(&jc->array[h].tb, NULL);
          }
      }
@@ -XXX,XX +XXX,XX @@ int page_unprotect(target_ulong address, uintptr_t pc)
  }
  #endif /* CONFIG_USER_ONLY */
 +/*
 + * Called by generic code at e.g. cpu reset after cpu creation,
 + * therefore we must be prepared to allocate the jump cache.
 + */
 +void tcg_flush_jmp_cache(CPUState *cpu)
 +{
-+    CPUClass *cc = CPU_CLASS(klass);
++    CPUJumpCache *jc = cpu->tb_jmp_cache;
-+    AccelCPUClass *accel_cpu = opaque;
++
-+
++    if (likely(jc)) {
-+    cc->accel_cpu = accel_cpu;
++        for (int i = 0; i < TB_JMP_CACHE_SIZE; i++) {
-+    if (accel_cpu->cpu_class_init) {
++            qatomic_set(&jc->array[i].tb, NULL);
-+        accel_cpu->cpu_class_init(cc);
++        }
 +    } else {
 +        /* This should happen once during realize, and thus never race. */
 +        jc = g_new0(CPUJumpCache, 1);
 +        jc = qatomic_xchg(&cpu->tb_jmp_cache, jc);
 +        assert(jc == NULL);
 +    }
 +}
 +
-+/* initialize the arch-specific accel CpuClass interfaces */
+ /* This is a wrapper for common code that can not use CONFIG_SOFTMMU */
-+static void accel_init_cpu_interfaces(AccelClass *ac)
+ void tcg_flush_softmmu_tlb(CPUState *cs)
-+{
+ {
-+    const char *ac_name; /* AccelClass name */
+diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
-+    char *acc_name;      /* AccelCPUClass name */
+index XXXXXXX..XXXXXXX 100644
-+    ObjectClass *acc;    /* AccelCPUClass */
+--- a/hw/core/cpu-common.c
-+
++++ b/hw/core/cpu-common.c
-+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
-+    g_assert(ac_name != NULL);
+     cpu->cflags_next_tb = -1;
-+
-+    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
+     if (tcg_enabled()) {
-+    acc = object_class_by_name(acc_name);
+-        cpu_tb_jmp_cache_clear(cpu);
-+    g_free(acc_name);
+-
-+
++        tcg_flush_jmp_cache(cpu);
-+    if (acc) {
+         tcg_flush_softmmu_tlb(cpu);
-+        object_class_foreach(accel_init_cpu_int_aux,
+     }
-+                             CPU_RESOLVING_TYPE, false, acc);
+ }
-+    }
+diff --git a/plugins/core.c b/plugins/core.c
-+}
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/plugins/core.c
- void accel_init_interfaces(AccelClass *ac)
++++ b/plugins/core.c
- {
+@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
- #ifndef CONFIG_USER_ONLY
+ static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
-     accel_init_ops_interfaces(ac);
+ {
- #endif /* !CONFIG_USER_ONLY */
+     bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
-+
+-    cpu_tb_jmp_cache_clear(cpu);
-+    accel_init_cpu_interfaces(ac);
++    tcg_flush_jmp_cache(cpu);
  }
-+static const TypeInfo accel_cpu_type = {
+ static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
-+    .name = TYPE_ACCEL_CPU,
+diff --git a/trace/control-target.c b/trace/control-target.c
-+    .parent = TYPE_OBJECT,
+index XXXXXXX..XXXXXXX 100644
-+    .abstract = true,
+--- a/trace/control-target.c
-+    .class_size = sizeof(AccelCPUClass),
++++ b/trace/control-target.c
-+};
+@@ -XXX,XX +XXX,XX @@ static void trace_event_synchronize_vcpu_state_dynamic(
-+
+ {
- static void register_accel_types(void)
+     bitmap_copy(vcpu->trace_dstate, vcpu->trace_dstate_delayed,
- {
+                 CPU_TRACE_DSTATE_MAX_EVENTS);
-     type_register_static(&accel_type);
+-    cpu_tb_jmp_cache_clear(vcpu);
-+    type_register_static(&accel_cpu_type);
++    tcg_flush_jmp_cache(vcpu);
  }
- type_init(register_accel_types);
+ void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
  F: include/sysemu/accel-ops.h
 +F: include/hw/core/accel-cpu.h
  F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 --
-.25.1
+.34.1

-[PULL 43/46] cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
+[PULL 16/20] hw/core: Add CPUClass.get_pc
-From: Claudio Fontana <cfontana@suse.de>
+Populate this new method for all targets.  Always match
 the result that would be given by cpu_get_tb_cpu_state,
 as we will want these values to correspond in the logs.
-we cannot in principle make the TCG Operations field definitions
+Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
-conditional on CONFIG_TCG in code that is included by both common_ss
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-and specific_ss modules.
+Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (target/sparc)
 Therefore, what we can do safely to restrict the TCG fields to TCG-only
 builds, is to move all tcg cpu operations into a separate header file,
 which is only included by TCG, target-specific code.
 This leaves just a NULL pointer in the cpu.h for the non-TCG builds.
 This also tidies up the code in all targets a bit, having all TCG cpu
 operations neatly contained by a dedicated data struct.
 Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Message-Id: <20210204163931.7358-16-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 103 ++------------------------------
+Cc: Eduardo Habkost <eduardo@habkost.net> (supporter:Machine core)
- include/hw/core/tcg-cpu-ops.h   |  97 ++++++++++++++++++++++++++++++
+Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> (supporter:Machine core)
- target/arm/internals.h          |   6 ++
+Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> (reviewer:Machine core)
- accel/tcg/cpu-exec.c            |  27 +++++----
+Cc: Yanan Wang <wangyanan55@huawei.com> (reviewer:Machine core)
- accel/tcg/cputlb.c              |  35 +++++++++--
+Cc: Michael Rolnik <mrolnik@gmail.com> (maintainer:AVR TCG CPUs)
- accel/tcg/user-exec.c           |   9 +--
+Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> (maintainer:CRIS TCG CPUs)
- hw/mips/jazz.c                  |   7 ++-
+Cc: Taylor Simpson <tsimpson@quicinc.com> (supporter:Hexagon TCG CPUs)
- softmmu/physmem.c               |  13 ++--
+Cc: Song Gao <gaosong@loongson.cn> (maintainer:LoongArch TCG CPUs)
- target/alpha/cpu.c              |  21 +++++--
+Cc: Xiaojuan Yang <yangxiaojuan@loongson.cn> (maintainer:LoongArch TCG CPUs)
- target/arm/cpu.c                |  41 ++++++++-----
+Cc: Laurent Vivier <laurent@vivier.eu> (maintainer:M68K TCG CPUs)
- target/arm/cpu64.c              |   7 +--
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> (reviewer:MIPS TCG CPUs)
- target/arm/cpu_tcg.c            |  28 +++++++--
+Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> (reviewer:MIPS TCG CPUs)
- target/avr/cpu.c                |  19 ++++--
+Cc: Chris Wulff <crwulff@gmail.com> (maintainer:NiosII TCG CPUs)
- target/avr/helper.c             |   5 +-
+Cc: Marek Vasut <marex@denx.de> (maintainer:NiosII TCG CPUs)
- target/cris/cpu.c               |  43 ++++++++-----
+Cc: Stafford Horne <shorne@gmail.com> (odd fixer:OpenRISC TCG CPUs)
- target/cris/helper.c            |   5 +-
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp> (reviewer:RENESAS RX CPUs)
- target/hppa/cpu.c               |  22 ++++---
+Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (maintainer:SPARC TCG CPUs)
- target/i386/tcg/tcg-cpu.c       |  26 ++++----
+Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (maintainer:TriCore TCG CPUs)
- target/lm32/cpu.c               |  19 ++++--
+Cc: Max Filippov <jcmvbkbc@gmail.com> (maintainer:Xtensa TCG CPUs)
- target/m68k/cpu.c               |  19 ++++--
+Cc: qemu-arm@nongnu.org (open list:ARM TCG CPUs)
- target/microblaze/cpu.c         |  25 +++++---
+Cc: qemu-ppc@nongnu.org (open list:PowerPC TCG CPUs)
- target/mips/cpu.c               |  36 +++++++----
+Cc: qemu-riscv@nongnu.org (open list:RISC-V TCG CPUs)
- target/moxie/cpu.c              |  15 ++++-
+Cc: qemu-s390x@nongnu.org (open list:S390 TCG CPUs)
- target/nios2/cpu.c              |  18 ++++--
+---
- target/openrisc/cpu.c           |  17 ++++--
+ include/hw/core/cpu.h   |  3 +++
- target/riscv/cpu.c              |  23 ++++---
+ target/alpha/cpu.c      |  9 +++++++++
- target/rx/cpu.c                 |  20 +++++--
+ target/arm/cpu.c        | 13 +++++++++++++
- target/s390x/cpu.c              |  33 ++++++----
+ target/avr/cpu.c        |  8 ++++++++
- target/sh4/cpu.c                |  21 +++++--
+ target/cris/cpu.c       |  8 ++++++++
- target/sparc/cpu.c              |  25 +++++---
+ target/hexagon/cpu.c    |  8 ++++++++
- target/tilegx/cpu.c             |  17 ++++--
+ target/hppa/cpu.c       |  8 ++++++++
- target/tricore/cpu.c            |  12 +++-
+ target/i386/cpu.c       |  9 +++++++++
- target/unicore32/cpu.c          |  17 ++++--
+ target/loongarch/cpu.c  |  9 +++++++++
- target/xtensa/cpu.c             |  23 ++++---
+ target/m68k/cpu.c       |  8 ++++++++
- target/ppc/translate_init.c.inc |  33 ++++++----
+ target/microblaze/cpu.c |  8 ++++++++
- MAINTAINERS                     |   1 +
+ target/mips/cpu.c       |  8 ++++++++
-files changed, 582 insertions(+), 306 deletions(-)
+ target/nios2/cpu.c      |  9 +++++++++
- create mode 100644 include/hw/core/tcg-cpu-ops.h
+ target/openrisc/cpu.c   |  8 ++++++++
  target/ppc/cpu_init.c   |  8 ++++++++
  target/riscv/cpu.c      | 13 +++++++++++++
  target/rx/cpu.c         |  8 ++++++++
  target/s390x/cpu.c      |  8 ++++++++
  target/sh4/cpu.c        |  8 ++++++++
  target/sparc/cpu.c      |  8 ++++++++
  target/tricore/cpu.c    |  9 +++++++++
  target/xtensa/cpu.c     |  8 ++++++++
 files changed, 186 insertions(+)
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
+@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
+  *       If the target behaviour here is anything other than "set
- struct TranslationBlock;
+  *       the PC register to the value passed in" then the target must
+  *       also implement the synchronize_from_tb hook.
--/**
++ * @get_pc: Callback for getting the Program Counter register.
-- * struct TcgCpuOperations: TCG operations specific to a CPU class
++ *       As above, with the semantics of the target architecture.
-- */
+  * @gdb_read_register: Callback for letting GDB read a register.
--typedef struct TcgCpuOperations {
+  * @gdb_write_register: Callback for letting GDB write a register.
--    /**
+  * @gdb_adjust_breakpoint: Callback for adjusting the address of a
 -     * @initialize: Initalize TCG state
 -     *
 -     * Called when the first CPU is realized.
 -     */
 -    void (*initialize)(void);
 -    /**
 -     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
 -     *
 -     * This is called when we abandon execution of a TB before starting it,
 -     * and must set all parts of the CPU state which the previous TB in the
 -     * chain may not have updated.
 -     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
 -     *
 -     * If more state needs to be restored, the target must implement a
 -     * function to restore all the state, and register it here.
 -     */
 -    void (*synchronize_from_tb)(CPUState *cpu,
 -                                const struct TranslationBlock *tb);
 -    /** @cpu_exec_enter: Callback for cpu_exec preparation */
 -    void (*cpu_exec_enter)(CPUState *cpu);
 -    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
 -    void (*cpu_exec_exit)(CPUState *cpu);
 -    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
 -    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 -    /** @do_interrupt: Callback for interrupt handling. */
 -    void (*do_interrupt)(CPUState *cpu);
 -    /**
 -     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
 -     *
 -     * For system mode, if the access is valid, call tlb_set_page
 -     * and return true; if the access is invalid, and probe is
 -     * true, return false; otherwise raise an exception and do
 -     * not return.  For user-only mode, always raise an exception
 -     * and do not return.
 -     */
 -    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 -                     MMUAccessType access_type, int mmu_idx,
 -                     bool probe, uintptr_t retaddr);
 -    /** @debug_excp_handler: Callback for handling debug exceptions */
 -    void (*debug_excp_handler)(CPUState *cpu);
 -
 -    /**
 -     * @do_transaction_failed: Callback for handling failed memory transactions
 -     * (ie bus faults or external aborts; not MMU faults)
 -     */
 -    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 -                                  unsigned size, MMUAccessType access_type,
 -                                  int mmu_idx, MemTxAttrs attrs,
 -                                  MemTxResult response, uintptr_t retaddr);
 -    /**
 -     * @do_unaligned_access: Callback for unaligned access handling
 -     */
 -    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 -                                MMUAccessType access_type,
 -                                int mmu_idx, uintptr_t retaddr);
 -    /**
 -     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 -     */
 -    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 -
 -    /**
 -     * @debug_check_watchpoint: return true if the architectural
 -     * watchpoint whose address has matched should really fire, used by ARM
 -     */
 -    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 -
 -} TcgCpuOperations;
 +/* see tcg-cpu-ops.h */
 +struct TCGCPUOps;
  /**
   * CPUClass:
 @@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     int gdb_num_core_regs;
+     void (*dump_state)(CPUState *cpu, FILE *, int flags);
-     bool gdb_stop_before_watchpoint;
+     int64_t (*get_arch_id)(CPUState *cpu);
+     void (*set_pc)(CPUState *cpu, vaddr value);
--    TcgCpuOperations tcg_ops;
++    vaddr (*get_pc)(CPUState *cpu);
-+    /* when TCG is not available, this pointer is NULL */
+     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
-+    struct TCGCPUOps *tcg_ops;
+     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
- };
+     vaddr (*gdb_adjust_breakpoint)(CPUState *cpu, vaddr addr);
  /*
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
  void cpu_interrupt(CPUState *cpu, int mask);
 -static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 -                                        MMUAccessType access_type,
 -                                        int mmu_idx, uintptr_t retaddr)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 -}
 -
 -static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 -                                          vaddr addr, unsigned size,
 -                                          MMUAccessType access_type,
 -                                          int mmu_idx, MemTxAttrs attrs,
 -                                          MemTxResult response,
 -                                          uintptr_t retaddr)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cpu);
 -
 -    if (!cpu->ignore_memory_transaction_failures &&
 -        cc->tcg_ops.do_transaction_failed) {
 -        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
 -                                          access_type, mmu_idx, attrs,
 -                                          response, retaddr);
 -    }
 -}
 -
  /**
   * cpu_set_pc:
   * @cpu: The CPU to set the program counter for.
 diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * TCG CPU-specific operations
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef TCG_CPU_OPS_H
 +#define TCG_CPU_OPS_H
 +
 +#include "hw/core/cpu.h"
 +
 +struct TCGCPUOps {
 +    /**
 +     * @initialize: Initalize TCG state
 +     *
 +     * Called when the first CPU is realized.
 +     */
 +    void (*initialize)(void);
 +    /**
 +     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
 +     *
 +     * This is called when we abandon execution of a TB before starting it,
 +     * and must set all parts of the CPU state which the previous TB in the
 +     * chain may not have updated.
 +     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
 +     *
 +     * If more state needs to be restored, the target must implement a
 +     * function to restore all the state, and register it here.
 +     */
 +    void (*synchronize_from_tb)(CPUState *cpu,
 +                                const struct TranslationBlock *tb);
 +    /** @cpu_exec_enter: Callback for cpu_exec preparation */
 +    void (*cpu_exec_enter)(CPUState *cpu);
 +    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
 +    void (*cpu_exec_exit)(CPUState *cpu);
 +    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
 +    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 +    /**
 +     * @do_interrupt: Callback for interrupt handling.
 +     *
 +     * note that this is in general SOFTMMU only, but it actually isn't
 +     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
 +     * in the SOFTMMU section in general.
 +     */
 +    void (*do_interrupt)(CPUState *cpu);
 +    /**
 +     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
 +     *
 +     * For system mode, if the access is valid, call tlb_set_page
 +     * and return true; if the access is invalid, and probe is
 +     * true, return false; otherwise raise an exception and do
 +     * not return.  For user-only mode, always raise an exception
 +     * and do not return.
 +     */
 +    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
 +                     MMUAccessType access_type, int mmu_idx,
 +                     bool probe, uintptr_t retaddr);
 +    /** @debug_excp_handler: Callback for handling debug exceptions */
 +    void (*debug_excp_handler)(CPUState *cpu);
 +
 +#ifdef NEED_CPU_H
 +#ifdef CONFIG_SOFTMMU
 +    /**
 +     * @do_transaction_failed: Callback for handling failed memory transactions
 +     * (ie bus faults or external aborts; not MMU faults)
 +     */
 +    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
 +                                  unsigned size, MMUAccessType access_type,
 +                                  int mmu_idx, MemTxAttrs attrs,
 +                                  MemTxResult response, uintptr_t retaddr);
 +    /**
 +     * @do_unaligned_access: Callback for unaligned access handling
 +     */
 +    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
 +                                MMUAccessType access_type,
 +                                int mmu_idx, uintptr_t retaddr);
 +
 +    /**
 +     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
 +     */
 +    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 +
 +    /**
 +     * @debug_check_watchpoint: return true if the architectural
 +     * watchpoint whose address has matched should really fire, used by ARM
 +     */
 +    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 +
 +#endif /* CONFIG_SOFTMMU */
 +#endif /* NEED_CPU_H */
 +
 +};
 +
 +#endif /* TCG_CPU_OPS_H */
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
  void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
  void arm_translate_init(void);
 +#ifdef CONFIG_TCG
 +void arm_cpu_synchronize_from_tb(CPUState *cs,
 +                                 const struct TranslationBlock *tb);
 +#endif /* CONFIG_TCG */
 +
 +
  enum arm_fprounding {
      FPROUNDING_TIEEVEN,
      FPROUNDING_POSINF,
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "qemu/qemu-print.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "trace.h"
  #include "disas/disas.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                 TARGET_FMT_lx "] %s\n",
                                 last_tb->tc.ptr, last_tb->pc,
                                 lookup_symbol(last_tb->pc));
 -        if (cc->tcg_ops.synchronize_from_tb) {
 -            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
 +        if (cc->tcg_ops->synchronize_from_tb) {
 +            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
          } else {
              assert(cc->set_pc);
              cc->set_pc(cpu, last_tb->pc);
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->tcg_ops.cpu_exec_enter) {
 -        cc->tcg_ops.cpu_exec_enter(cpu);
 +    if (cc->tcg_ops->cpu_exec_enter) {
 +        cc->tcg_ops->cpu_exec_enter(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 -    if (cc->tcg_ops.cpu_exec_exit) {
 -        cc->tcg_ops.cpu_exec_exit(cpu);
 +    if (cc->tcg_ops->cpu_exec_exit) {
 +        cc->tcg_ops->cpu_exec_exit(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
          }
      }
 -    if (cc->tcg_ops.debug_excp_handler) {
 -        cc->tcg_ops.debug_excp_handler(cpu);
 +    if (cc->tcg_ops->debug_excp_handler) {
 +        cc->tcg_ops->debug_excp_handler(cpu);
      }
  }
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
             loop */
  #if defined(TARGET_I386)
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        cc->tcg_ops.do_interrupt(cpu);
 +        cc->tcg_ops->do_interrupt(cpu);
  #endif
          *ret = cpu->exception_index;
          cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
          if (replay_exception()) {
              CPUClass *cc = CPU_GET_CLASS(cpu);
              qemu_mutex_lock_iothread();
 -            cc->tcg_ops.do_interrupt(cpu);
 +            cc->tcg_ops->do_interrupt(cpu);
              qemu_mutex_unlock_iothread();
              cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             True when it is, and we should restart on a new TB,
             and via longjmp via cpu_loop_exit.  */
          else {
 -            if (cc->tcg_ops.cpu_exec_interrupt &&
 -                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
 +            if (cc->tcg_ops->cpu_exec_interrupt &&
 +                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                  if (need_replay_interrupt(interrupt_request)) {
                      replay_interrupt();
                  }
@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
      CPUClass *cc = CPU_GET_CLASS(cpu);
      if (!tcg_target_initialized) {
 -        cc->tcg_ops.initialize();
 +        cc->tcg_ops->initialize();
          tcg_target_initialized = true;
      }
      tlb_init(cpu);
 diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cputlb.c
 +++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/main-loop.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "exec/exec-all.h"
  #include "exec/memory.h"
  #include "exec/address-spaces.h"
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
       * This is not a probe, so only valid return is success; failure
       * should result in exception + longjmp to the cpu loop.
       */
 -    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
 -                              access_type, mmu_idx, false, retaddr);
 +    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
 +                               access_type, mmu_idx, false, retaddr);
      assert(ok);
  }
 +static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 +                                        MMUAccessType access_type,
 +                                        int mmu_idx, uintptr_t retaddr)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
 +    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 +}
 +
 +static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 +                                          vaddr addr, unsigned size,
 +                                          MMUAccessType access_type,
 +                                          int mmu_idx, MemTxAttrs attrs,
 +                                          MemTxResult response,
 +                                          uintptr_t retaddr)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cpu);
 +
 +    if (!cpu->ignore_memory_transaction_failures &&
 +        cc->tcg_ops->do_transaction_failed) {
 +        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
 +                                           access_type, mmu_idx, attrs,
 +                                           response, retaddr);
 +    }
 +}
 +
  static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                           int mmu_idx, target_ulong addr, uintptr_t retaddr,
                           MMUAccessType access_type, MemOp op)
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
              CPUState *cs = env_cpu(env);
              CPUClass *cc = CPU_GET_CLASS(cs);
 -            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
 -                                      mmu_idx, nonfault, retaddr)) {
 +            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
 +                                       mmu_idx, nonfault, retaddr)) {
                  /* Non-faulting page table read failed.  */
                  *phost = NULL;
                  return TLB_INVALID_MASK;
 diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/user-exec.c
 +++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
  #include "disas/disas.h"
  #include "exec/exec-all.h"
  #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
      clear_helper_retaddr();
      cc = CPU_GET_CLASS(cpu);
 -    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
 -                         MMU_USER_IDX, false, pc);
 +    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
 +                          MMU_USER_IDX, false, pc);
      g_assert_not_reached();
  }
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
          } else {
              CPUState *cpu = env_cpu(env);
              CPUClass *cc = CPU_GET_CLASS(cpu);
 -            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
 -                                 MMU_USER_IDX, false, ra);
 +            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
 +                                  MMU_USER_IDX, false, ra);
              g_assert_not_reached();
          }
      }
 diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/mips/jazz.c
 +++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "qemu/help_option.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  enum jazz_model_e {
      JAZZ_MAGNUM,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
       */
      cc = CPU_GET_CLASS(cpu);
  #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 -    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
 -    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
 +    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
 +    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
  #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
      /* allocate RAM */
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/cutils.h"
  #include "qemu/cacheflush.h"
  #include "cpu.h"
 +
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
 +
  #include "exec/exec-all.h"
  #include "exec/target_page.h"
  #include "hw/qdev-core.h"
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
          return;
      }
 -    if (cc->tcg_ops.adjust_watchpoint_address) {
 +    if (cc->tcg_ops->adjust_watchpoint_address) {
          /* this is currently used only by ARM BE32 */
 -        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
 +        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
      }
      QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
          if (watchpoint_address_matches(wp, addr, len)
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
              wp->hitaddr = MAX(addr, wp->vaddr);
              wp->hitattrs = attrs;
              if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
 -                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
 +                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
 +                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
                      wp->flags &= ~BP_WATCHPOINT_HIT;
                      continue;
                  }
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
- #endif
+     cpu->env.pc = value;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr alpha_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps alpha_tcg_ops = {
++    AlphaCPU *cpu = ALPHA_CPU(cs);
-+    .initialize = alpha_translate_init,
++
-+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
++    return cpu->env.pc;
-+    .tlb_fill = alpha_cpu_tlb_fill,
++}
 +
-+#ifndef CONFIG_USER_ONLY
++
-+    .do_interrupt = alpha_cpu_do_interrupt,
+ static bool alpha_cpu_has_work(CPUState *cs)
-+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
+ {
-+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
+     /* Here we are checking to see if the CPU should wake up from HALT.
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void alpha_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
--    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
++    cc->get_pc = alpha_cpu_get_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
      cc->gdb_write_register = alpha_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
      cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
      dc->vmsd = &vmstate_alpha_cpu;
  #endif
      cc->disas_set_info = alpha_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = alpha_translate_init;
 +    cc->tcg_ops = &alpha_tcg_ops;
      cc->gdb_num_core_regs = 67;
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #include "qapi/error.h"
- #include "qapi/visitor.h"
- #include "cpu.h"
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+#endif /* CONFIG_TCG */
- #include "internals.h"
- #include "exec/exec-all.h"
- #include "hw/qdev-properties.h"
 @@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
- }
+     }
+ }
 +static vaddr arm_cpu_get_pc(CPUState *cs)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +
 +    if (is_a64(env)) {
 +        return env->pc;
 +    } else {
 +        return env->regs[15];
 +    }
 +}
 +
  #ifdef CONFIG_TCG
--static void arm_cpu_synchronize_from_tb(CPUState *cs,
+ void arm_cpu_synchronize_from_tb(CPUState *cs,
--                                        const TranslationBlock *tb)
+                                  const TranslationBlock *tb)
 +void arm_cpu_synchronize_from_tb(CPUState *cs,
 +                                 const TranslationBlock *tb)
  {
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
   found:
      cs->exception_index = excp_idx;
      env->exception.target_el = target_el;
 -    cc->tcg_ops.do_interrupt(cs);
 +    cc->tcg_ops->do_interrupt(cs);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
      return g_strdup("arm");
  }
 +#ifdef CONFIG_TCG
 +static struct TCGCPUOps arm_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .do_interrupt = arm_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void arm_cpu_class_init(ObjectClass *oc, void *data)
  {
      ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
+     cc->has_work = arm_cpu_has_work;
-     cc->gdb_stop_before_watchpoint = true;
+     cc->dump_state = arm_cpu_dump_state;
-     cc->disas_set_info = arm_disas_set_info;
+     cc->set_pc = arm_cpu_set_pc;
-+
++    cc->get_pc = arm_cpu_get_pc;
- #ifdef CONFIG_TCG
+     cc->gdb_read_register = arm_cpu_gdb_read_register;
--    cc->tcg_ops.initialize = arm_translate_init;
+     cc->gdb_write_register = arm_cpu_gdb_write_register;
--    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
+ #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
 -    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
 -    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
 -#if !defined(CONFIG_USER_ONLY)
 -    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 -    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
 -    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
 -    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
 -#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 +    cc->tcg_ops = &arm_tcg_ops;
  #endif /* CONFIG_TCG */
  }
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "cpu.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  #include "qemu/module.h"
  #if !defined(CONFIG_USER_ONLY)
  #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
 -#endif /* CONFIG_TCG */
 -
      cc->gdb_read_register = aarch64_cpu_gdb_read_register;
      cc->gdb_write_register = aarch64_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 34;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 +#ifdef CONFIG_TCG
 +#include "hw/core/tcg-cpu-ops.h"
 +#endif /* CONFIG_TCG */
  #include "internals.h"
  /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      if (interrupt_request & CPU_INTERRUPT_HARD
          && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
          cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops.do_interrupt(cs);
 +        cc->tcg_ops->do_interrupt(cs);
          ret = true;
      }
      return ret;
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
 +#ifdef CONFIG_TCG
 +static struct TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void arm_v7m_class_init(ObjectClass *oc, void *data)
  {
      ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
      acc->info = data;
  #ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
 -#endif
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
  #endif /* CONFIG_TCG */
      cc->gdb_core_xml_file = "arm-m-profile.xml";
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_set_pc(CPUState *cs, vaddr value)
-     qemu_fprintf(f, "\n");
+     cpu->env.pc_w = value / 2; /* internally PC points to words */
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr avr_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps avr_tcg_ops = {
++    AVRCPU *cpu = AVR_CPU(cs);
-+    .initialize = avr_cpu_tcg_init,
++
-+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
++    return cpu->env.pc_w * 2;
-+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
++}
-+    .tlb_fill = avr_cpu_tlb_fill,
++
-+
+ static bool avr_cpu_has_work(CPUState *cs)
-+#ifndef CONFIG_USER_ONLY
+ {
-+    .do_interrupt = avr_cpu_do_interrupt,
+     AVRCPU *cpu = AVR_CPU(cs);
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void avr_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = avr_cpu_class_by_name;
      cc->has_work = avr_cpu_has_work;
--    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
      cc->dump_state = avr_cpu_dump_state;
      cc->set_pc = avr_cpu_set_pc;
-     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
++    cc->get_pc = avr_cpu_get_pc;
-     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
+     dc->vmsd = &vms_avr_cpu;
--    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
+     cc->sysemu_ops = &avr_sysemu_ops;
      cc->vmsd = &vms_avr_cpu;
      cc->disas_set_info = avr_cpu_disas_set_info;
--    cc->tcg_ops.initialize = avr_cpu_tcg_init;
--    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
-     cc->gdb_read_register = avr_cpu_gdb_read_register;
-     cc->gdb_write_register = avr_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 35;
-     cc->gdb_core_xml_file = "avr-cpu.xml";
-+    cc->tcg_ops = &avr_tcg_ops;
- }
- /*
-diff --git a/target/avr/helper.c b/target/avr/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/avr/helper.c
-+++ b/target/avr/helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "cpu.h"
-+#include "hw/core/tcg-cpu-ops.h"
- #include "exec/exec-all.h"
- #include "exec/address-spaces.h"
- #include "exec/helper-proto.h"
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     if (interrupt_request & CPU_INTERRUPT_RESET) {
-         if (cpu_interrupts_enabled(env)) {
-             cs->exception_index = EXCP_RESET;
--            cc->tcg_ops.do_interrupt(cs);
-+            cc->tcg_ops->do_interrupt(cs);
-             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
-@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
-             int index = ctz32(env->intsrc);
-             cs->exception_index = EXCP_INT(index);
--            cc->tcg_ops.do_interrupt(cs);
-+            cc->tcg_ops->do_interrupt(cs);
-             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
-             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
- #endif
+     cpu->env.pc = value;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr cris_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps crisv10_tcg_ops = {
++    CRISCPU *cpu = CRIS_CPU(cs);
-+    .initialize = cris_initialize_crisv10_tcg,
++
-+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
++    return cpu->env.pc;
-+    .tlb_fill = cris_cpu_tlb_fill,
++}
 +
-+#ifndef CONFIG_USER_ONLY
+ static bool cris_cpu_has_work(CPUState *cs)
-+    .do_interrupt = crisv10_cpu_do_interrupt,
+ {
-+#endif /* !CONFIG_USER_ONLY */
+     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 +};
 +
 +static struct TCGCPUOps crisv32_tcg_ops = {
 +    .initialize = cris_initialize_tcg,
 +    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
 +    .tlb_fill = cris_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = cris_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 8;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 9;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 10;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 11;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 17;
 -    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
      cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 -    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 +    cc->tcg_ops = &crisv10_tcg_ops;
  }
  static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
  {
 +    CPUClass *cc = CPU_CLASS(oc);
      CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
      ccc->vr = 32;
 +    cc->tcg_ops = &crisv32_tcg_ops;
  }
  static void cris_cpu_class_init(ObjectClass *oc, void *data)
 @@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
--    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
++    cc->get_pc = cris_cpu_get_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
      cc->gdb_write_register = cris_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
- #ifndef CONFIG_USER_ONLY
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
-     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
+index XXXXXXX..XXXXXXX 100644
-     dc->vmsd = &vmstate_cris_cpu;
+--- a/target/hexagon/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
++++ b/target/hexagon/cpu.c
-     cc->gdb_stop_before_watchpoint = true;
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_set_pc(CPUState *cs, vaddr value)
+     env->gpr[HEX_REG_PC] = value;
-     cc->disas_set_info = cris_disas_set_info;
+ }
--    cc->tcg_ops.initialize = cris_initialize_tcg;
- }
++static vaddr hexagon_cpu_get_pc(CPUState *cs)
++{
- #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
++    HexagonCPU *cpu = HEXAGON_CPU(cs);
-diff --git a/target/cris/helper.c b/target/cris/helper.c
++    CPUHexagonState *env = &cpu->env;
-index XXXXXXX..XXXXXXX 100644
++    return env->gpr[HEX_REG_PC];
---- a/target/cris/helper.c
++}
-+++ b/target/cris/helper.c
++
-@@ -XXX,XX +XXX,XX @@
+ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
+                                             const TranslationBlock *tb)
- #include "qemu/osdep.h"
+ {
- #include "cpu.h"
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
-+#include "hw/core/tcg-cpu-ops.h"
+     cc->has_work = hexagon_cpu_has_work;
- #include "mmu.h"
+     cc->dump_state = hexagon_dump_state;
- #include "qemu/host-utils.h"
+     cc->set_pc = hexagon_cpu_set_pc;
- #include "exec/exec-all.h"
++    cc->get_pc = hexagon_cpu_get_pc;
-@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+     cc->gdb_read_register = hexagon_gdb_read_register;
-         && (env->pregs[PR_CCS] & I_FLAG)
+     cc->gdb_write_register = hexagon_gdb_write_register;
-         && !env->locked_irq) {
+     cc->gdb_num_core_regs = TOTAL_PER_THREAD_REGS + NUM_VREGS + NUM_QREGS;
          cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops.do_interrupt(cs);
 +        cc->tcg_ops->do_interrupt(cs);
          ret = true;
      }
      if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          }
          if ((env->pregs[PR_CCS] & m_flag_archval)) {
              cs->exception_index = EXCP_NMI;
 -            cc->tcg_ops.do_interrupt(cs);
 +            cc->tcg_ops->do_interrupt(cs);
              ret = true;
          }
      }
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
+@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_set_pc(CPUState *cs, vaddr value)
-     return object_class_by_name(TYPE_HPPA_CPU);
+     cpu->env.iaoq_b = value + 4;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr hppa_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps hppa_tcg_ops = {
++    HPPACPU *cpu = HPPA_CPU(cs);
-+    .initialize = hppa_translate_init,
++
-+    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
++    return cpu->env.iaoq_f;
-+    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
++}
-+    .tlb_fill = hppa_cpu_tlb_fill,
++
-+
+ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
-+#ifndef CONFIG_USER_ONLY
+                                          const TranslationBlock *tb)
-+    .do_interrupt = hppa_cpu_do_interrupt,
+ {
 +    .do_unaligned_access = hppa_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void hppa_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
--    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
++    cc->get_pc = hppa_cpu_get_pc;
      cc->gdb_read_register = hppa_cpu_gdb_read_register;
      cc->gdb_write_register = hppa_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
- #ifndef CONFIG_USER_ONLY
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+index XXXXXXX..XXXXXXX 100644
--    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
+--- a/target/i386/cpu.c
-     dc->vmsd = &vmstate_hppa_cpu;
++++ b/target/i386/cpu.c
- #endif
+@@ -XXX,XX +XXX,XX @@ static void x86_cpu_set_pc(CPUState *cs, vaddr value)
-     cc->disas_set_info = hppa_cpu_disas_set_info;
+     cpu->env.eip = value;
--    cc->tcg_ops.initialize = hppa_translate_init;
+ }
--
-     cc->gdb_num_core_regs = 128;
++static vaddr x86_cpu_get_pc(CPUState *cs)
-+    cc->tcg_ops = &hppa_tcg_ops;
++{
- }
++    X86CPU *cpu = X86_CPU(cs);
++
- static const TypeInfo hppa_cpu_type_info = {
++    /* Match cpu_get_tb_cpu_state. */
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
++    return cpu->env.eip + cpu->env.segs[R_CS].base;
-index XXXXXXX..XXXXXXX 100644
++}
---- a/target/i386/tcg/tcg-cpu.c
++
-+++ b/target/i386/tcg/tcg-cpu.c
+ int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
-@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
+ {
-     cpu->env.eip = tb->pc - tb->cs_base;
+     X86CPU *cpu = X86_CPU(cs);
- }
+@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
+     cc->has_work = x86_cpu_has_work;
-+#include "hw/core/tcg-cpu-ops.h"
+     cc->dump_state = x86_cpu_dump_state;
-+
+     cc->set_pc = x86_cpu_set_pc;
-+static struct TCGCPUOps x86_tcg_ops = {
++    cc->get_pc = x86_cpu_get_pc;
-+    .initialize = tcg_x86_init,
+     cc->gdb_read_register = x86_cpu_gdb_read_register;
-+    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
+     cc->gdb_write_register = x86_cpu_gdb_write_register;
-+    .cpu_exec_enter = x86_cpu_exec_enter,
+     cc->get_arch_id = x86_cpu_get_arch_id;
-+    .cpu_exec_exit = x86_cpu_exec_exit,
+diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
-+    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+index XXXXXXX..XXXXXXX 100644
-+    .do_interrupt = x86_cpu_do_interrupt,
+--- a/target/loongarch/cpu.c
-+    .tlb_fill = x86_cpu_tlb_fill,
++++ b/target/loongarch/cpu.c
-+#ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
-+    .debug_excp_handler = breakpoint_handler,
+     env->pc = value;
-+#endif /* !CONFIG_USER_ONLY */
+ }
-+};
-+
++static vaddr loongarch_cpu_get_pc(CPUState *cs)
- void tcg_cpu_common_class_init(CPUClass *cc)
++{
- {
++    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
--    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
++    CPULoongArchState *env = &cpu->env;
--    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
++
--    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
++    return env->pc;
--    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
++}
--    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
++
--    cc->tcg_ops.initialize = tcg_x86_init;
+ #ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
+ #include "hw/loongarch/virt.h"
--#ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
+@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
--#endif
+     cc->has_work = loongarch_cpu_has_work;
-+    cc->tcg_ops = &x86_tcg_ops;
+     cc->dump_state = loongarch_cpu_dump_state;
- }
+     cc->set_pc = loongarch_cpu_set_pc;
-diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
++    cc->get_pc = loongarch_cpu_get_pc;
-index XXXXXXX..XXXXXXX 100644
+ #ifndef CONFIG_USER_ONLY
---- a/target/lm32/cpu.c
+     dc->vmsd = &vmstate_loongarch_cpu;
-+++ b/target/lm32/cpu.c
+     cc->sysemu_ops = &loongarch_sysemu_ops;
@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
      return oc;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps lm32_tcg_ops = {
 +    .initialize = lm32_translate_init,
 +    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
 +    .tlb_fill = lm32_cpu_tlb_fill,
 +    .debug_excp_handler = lm32_debug_excp_handler,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = lm32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void lm32_cpu_class_init(ObjectClass *oc, void *data)
  {
      LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = lm32_cpu_class_by_name;
      cc->has_work = lm32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
      cc->dump_state = lm32_cpu_dump_state;
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
      cc->gdb_write_register = lm32_cpu_gdb_write_register;
 -    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_lm32_cpu;
  #endif
      cc->gdb_num_core_regs = 32 + 7;
      cc->gdb_stop_before_watchpoint = true;
 -    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
      cc->disas_set_info = lm32_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = lm32_translate_init;
 +    cc->tcg_ops = &lm32_tcg_ops;
  }
  #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
- };
+     cpu->env.pc = value;
- #endif
+ }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr m68k_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps m68k_tcg_ops = {
++    M68kCPU *cpu = M68K_CPU(cs);
-+    .initialize = m68k_tcg_init,
++
-+    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
++    return cpu->env.pc;
-+    .tlb_fill = m68k_cpu_tlb_fill,
++}
 +
-+#ifndef CONFIG_USER_ONLY
+ static bool m68k_cpu_has_work(CPUState *cs)
-+    .do_interrupt = m68k_cpu_do_interrupt,
+ {
-+    .do_transaction_failed = m68k_cpu_transaction_failed,
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void m68k_cpu_class_init(ObjectClass *c, void *data)
  {
      M68kCPUClass *mcc = M68K_CPU_CLASS(c);
 @@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = m68k_cpu_class_by_name;
      cc->has_work = m68k_cpu_has_work;
--    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
++    cc->get_pc = m68k_cpu_get_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
      cc->gdb_write_register = m68k_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
  #if defined(CONFIG_SOFTMMU)
--    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
-     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_m68k_cpu;
- #endif
-     cc->disas_set_info = m68k_cpu_disas_set_info;
--    cc->tcg_ops.initialize = m68k_tcg_init;
-     cc->gdb_num_core_regs = 18;
-+    cc->tcg_ops = &m68k_tcg_ops;
- }
- static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_set_pc(CPUState *cs, vaddr value)
-     return object_class_by_name(TYPE_MICROBLAZE_CPU);
+     cpu->env.iflags = 0;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr mb_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps mb_tcg_ops = {
++    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-+    .initialize = mb_tcg_init,
++
-+    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
++    return cpu->env.pc;
-+    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
++}
-+    .tlb_fill = mb_cpu_tlb_fill,
++
-+
+ static void mb_cpu_synchronize_from_tb(CPUState *cs,
-+#ifndef CONFIG_USER_ONLY
+                                        const TranslationBlock *tb)
-+    .do_interrupt = mb_cpu_do_interrupt,
+ {
 +    .do_transaction_failed = mb_cpu_transaction_failed,
 +    .do_unaligned_access = mb_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void mb_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = mb_cpu_class_by_name;
-     cc->has_work = mb_cpu_has_work;
--    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
-+
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
++    cc->get_pc = mb_cpu_get_pc;
      cc->gdb_read_register = mb_cpu_gdb_read_register;
      cc->gdb_write_register = mb_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 +
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
      cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
      dc->vmsd = &vmstate_mb_cpu;
  #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->gdb_num_core_regs = 32 + 27;
      cc->disas_set_info = mb_disas_set_info;
 -    cc->tcg_ops.initialize = mb_tcg_init;
 +    cc->tcg_ops = &mb_tcg_ops;
  }
  static const TypeInfo mb_cpu_type_info = {
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
-     DEFINE_PROP_END_OF_LIST()
+     mips_env_set_pc(&cpu->env, value);
- };
+ }
-+#ifdef CONFIG_TCG
++static vaddr mips_cpu_get_pc(CPUState *cs)
-+#include "hw/core/tcg-cpu-ops.h"
++{
-+/*
++    MIPSCPU *cpu = MIPS_CPU(cs);
-+ * NB: cannot be const, as some elements are changed for specific
++
-+ * mips hardware (see hw/mips/jazz.c).
++    return cpu->env.active_tc.PC;
-+ */
++}
-+static struct TCGCPUOps mips_tcg_ops = {
++
-+    .initialize = mips_tcg_init,
+ static bool mips_cpu_has_work(CPUState *cs)
-+    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
+ {
-+    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+     MIPSCPU *cpu = MIPS_CPU(cs);
 +    .tlb_fill = mips_cpu_tlb_fill,
 +
 +#if !defined(CONFIG_USER_ONLY)
 +    .do_interrupt = mips_cpu_do_interrupt,
 +    .do_transaction_failed = mips_cpu_do_transaction_failed,
 +    .do_unaligned_access = mips_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void mips_cpu_class_init(ObjectClass *c, void *data)
  {
      MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
 @@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->vmsd = &vmstate_mips_cpu;
+     cc->has_work = mips_cpu_has_work;
- #endif
+     cc->dump_state = mips_cpu_dump_state;
-     cc->disas_set_info = mips_cpu_disas_set_info;
+     cc->set_pc = mips_cpu_set_pc;
--#ifdef CONFIG_TCG
++    cc->get_pc = mips_cpu_get_pc;
--    cc->tcg_ops.initialize = mips_tcg_init;
+     cc->gdb_read_register = mips_cpu_gdb_read_register;
--    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
+     cc->gdb_write_register = mips_cpu_gdb_write_register;
--    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
+ #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
 -    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 -#ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
 -
 -#endif /* CONFIG_USER_ONLY */
 -#endif /* CONFIG_TCG */
 -
      cc->gdb_num_core_regs = 73;
      cc->gdb_stop_before_watchpoint = true;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &mips_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo mips_cpu_type_info = {
 diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/moxie/cpu.c
 +++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
      return oc;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps moxie_tcg_ops = {
 +    .initialize = moxie_translate_init,
 +    .tlb_fill = moxie_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = moxie_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void moxie_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = moxie_cpu_class_by_name;
      cc->has_work = moxie_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
      cc->dump_state = moxie_cpu_dump_state;
      cc->set_pc = moxie_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
      cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_moxie_cpu;
  #endif
      cc->disas_set_info = moxie_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = moxie_translate_init;
 +    cc->tcg_ops = &moxie_tcg_ops;
  }
  static void moxielite_initfn(Object *obj)
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
-     DEFINE_PROP_END_OF_LIST(),
+     env->pc = value;
- };
+ }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr nios2_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps nios2_tcg_ops = {
++    Nios2CPU *cpu = NIOS2_CPU(cs);
-+    .initialize = nios2_tcg_init,
++    CPUNios2State *env = &cpu->env;
-+    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
++
-+    .tlb_fill = nios2_cpu_tlb_fill,
++    return env->pc;
-+
++}
-+#ifndef CONFIG_USER_ONLY
++
-+    .do_interrupt = nios2_cpu_do_interrupt,
+ static bool nios2_cpu_has_work(CPUState *cs)
-+    .do_unaligned_access = nios2_cpu_do_unaligned_access,
+ {
-+#endif /* !CONFIG_USER_ONLY */
+     return cs->interrupt_request & CPU_INTERRUPT_HARD;
 +};
  static void nios2_cpu_class_init(ObjectClass *oc, void *data)
  {
 @@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
--    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
++    cc->get_pc = nios2_cpu_get_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
--    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
- #ifndef CONFIG_USER_ONLY
+     cc->sysemu_ops = &nios2_sysemu_ops;
 -    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
      cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
  #endif
      cc->gdb_read_register = nios2_cpu_gdb_read_register;
      cc->gdb_write_register = nios2_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 49;
 -    cc->tcg_ops.initialize = nios2_tcg_init;
 +    cc->tcg_ops = &nios2_tcg_ops;
  }
  static const TypeInfo nios2_cpu_type_info = {
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
-                       | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
+     cpu->env.dflag = 0;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr openrisc_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps openrisc_tcg_ops = {
++    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
-+    .initialize = openrisc_translate_init,
++
-+    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
++    return cpu->env.pc;
-+    .tlb_fill = openrisc_cpu_tlb_fill,
++}
 +
-+#ifndef CONFIG_USER_ONLY
+ static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
-+    .do_interrupt = openrisc_cpu_do_interrupt,
+                                              const TranslationBlock *tb)
-+#endif /* !CONFIG_USER_ONLY */
+ {
 +};
 +
  static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
  {
      OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
--    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
++    cc->get_pc = openrisc_cpu_get_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
      cc->gdb_write_register = openrisc_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
- #ifndef CONFIG_USER_ONLY
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
-     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
+index XXXXXXX..XXXXXXX 100644
-     dc->vmsd = &vmstate_openrisc_cpu;
+--- a/target/ppc/cpu_init.c
- #endif
++++ b/target/ppc/cpu_init.c
-     cc->gdb_num_core_regs = 32 + 3;
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
--    cc->tcg_ops.initialize = openrisc_translate_init;
+     cpu->env.nip = value;
-     cc->disas_set_info = openrisc_disas_set_info;
+ }
-+    cc->tcg_ops = &openrisc_tcg_ops;
- }
++static vaddr ppc_cpu_get_pc(CPUState *cs)
++{
- /* Sort alphabetically by type name, except for "any". */
++    PowerPCCPU *cpu = POWERPC_CPU(cs);
 +
 +    return cpu->env.nip;
 +}
 +
  static bool ppc_cpu_has_work(CPUState *cs)
  {
      PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = ppc_cpu_has_work;
      cc->dump_state = ppc_cpu_dump_state;
      cc->set_pc = ppc_cpu_set_pc;
 +    cc->get_pc = ppc_cpu_get_pc;
      cc->gdb_read_register = ppc_cpu_gdb_read_register;
      cc->gdb_write_register = ppc_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
-     return NULL;
+     }
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr riscv_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps riscv_tcg_ops = {
++    RISCVCPU *cpu = RISCV_CPU(cs);
-+    .initialize = riscv_translate_init,
++    CPURISCVState *env = &cpu->env;
-+    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
++
-+    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
++    /* Match cpu_get_tb_cpu_state. */
-+    .tlb_fill = riscv_cpu_tlb_fill,
++    if (env->xl == MXL_RV32) {
-+
++        return env->pc & UINT32_MAX;
-+#ifndef CONFIG_USER_ONLY
++    }
-+    .do_interrupt = riscv_cpu_do_interrupt,
++    return env->pc;
-+    .do_transaction_failed = riscv_cpu_do_transaction_failed,
++}
-+    .do_unaligned_access = riscv_cpu_do_unaligned_access,
++
-+#endif /* !CONFIG_USER_ONLY */
+ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
-+};
+                                           const TranslationBlock *tb)
-+
+ {
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
--    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
++    cc->get_pc = riscv_cpu_get_pc;
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = riscv_cpu_disas_set_info;
- #ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
--    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
-     /* For now, mark unmigratable: */
-     cc->vmsd = &vmstate_riscv_cpu;
- #endif
-     cc->gdb_arch_name = riscv_gdb_arch_name;
-     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
--    cc->tcg_ops.initialize = riscv_translate_init;
--    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
-+    cc->tcg_ops = &riscv_tcg_ops;
-     device_class_set_props(dc, riscv_cpu_properties);
- }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_set_pc(CPUState *cs, vaddr value)
-     qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
+     cpu->env.pc = value;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr rx_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps rx_tcg_ops = {
++    RXCPU *cpu = RX_CPU(cs);
-+    .initialize = rx_translate_init,
++
-+    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
++    return cpu->env.pc;
-+    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
++}
-+    .tlb_fill = rx_cpu_tlb_fill,
++
-+
+ static void rx_cpu_synchronize_from_tb(CPUState *cs,
-+#ifndef CONFIG_USER_ONLY
+                                        const TranslationBlock *tb)
-+    .do_interrupt = rx_cpu_do_interrupt,
+ {
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void rx_cpu_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
 @@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
-     cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
--    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
++    cc->get_pc = rx_cpu_get_pc;
-+
-     cc->gdb_read_register = rx_cpu_gdb_read_register;
+ #ifndef CONFIG_USER_ONLY
-     cc->gdb_write_register = rx_cpu_gdb_write_register;
+     cc->sysemu_ops = &rx_sysemu_ops;
      cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
      cc->disas_set_info = rx_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = rx_translate_init;
 -    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 26;
      cc->gdb_core_xml_file = "rx-core.xml";
 +    cc->tcg_ops = &rx_tcg_ops;
  }
  static const TypeInfo rx_cpu_info = {
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
-     return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
+     cpu->env.psw.addr = value;
  }
-+#ifdef CONFIG_TCG
++static vaddr s390_cpu_get_pc(CPUState *cs)
-+#include "hw/core/tcg-cpu-ops.h"
++{
-+
++    S390CPU *cpu = S390_CPU(cs);
-+static struct TCGCPUOps s390_tcg_ops = {
++
-+    .initialize = s390x_translate_init,
++    return cpu->env.psw.addr;
-+    .tlb_fill = s390_cpu_tlb_fill,
++}
 +
-+#if !defined(CONFIG_USER_ONLY)
+ static bool s390_cpu_has_work(CPUState *cs)
-+    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+ {
-+    .do_interrupt = s390_cpu_do_interrupt,
+     S390CPU *cpu = S390_CPU(cs);
 +    .debug_excp_handler = s390x_cpu_debug_excp_handler,
 +    .do_unaligned_access = s390x_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void s390_cpu_class_init(ObjectClass *oc, void *data)
  {
      S390CPUClass *scc = S390_CPU_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-     scc->reset = s390_cpu_reset;
-     cc->class_by_name = s390_cpu_class_by_name,
      cc->has_work = s390_cpu_has_work;
--#ifdef CONFIG_TCG
--    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
--#endif
      cc->dump_state = s390_cpu_dump_state;
      cc->set_pc = s390_cpu_set_pc;
++    cc->get_pc = s390_cpu_get_pc;
      cc->gdb_read_register = s390_cpu_gdb_read_register;
-@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+     cc->gdb_write_register = s390_cpu_gdb_write_register;
-     cc->vmsd = &vmstate_s390_cpu;
+ #ifndef CONFIG_USER_ONLY
      cc->get_crash_info = s390_cpu_get_crash_info;
      cc->write_elf64_note = s390_cpu_write_elf64_note;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
 -    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
 -    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 -#endif
  #endif
      cc->disas_set_info = s390_cpu_disas_set_info;
 -#ifdef CONFIG_TCG
 -    cc->tcg_ops.initialize = s390x_translate_init;
 -    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 -#endif
 -
      cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
      cc->gdb_core_xml_file = "s390x-core64.xml";
      cc->gdb_arch_name = s390_gdb_arch_name;
      s390_cpu_model_class_register_props(oc);
 +
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops = &s390_tcg_ops;
 +#endif /* CONFIG_TCG */
  }
  static const TypeInfo s390_cpu_type_info = {
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_set_pc(CPUState *cs, vaddr value)
-     .unmigratable = 1,
+     cpu->env.pc = value;
- };
+ }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr superh_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps superh_tcg_ops = {
++    SuperHCPU *cpu = SUPERH_CPU(cs);
-+    .initialize = sh4_translate_init,
++
-+    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
++    return cpu->env.pc;
-+    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
++}
-+    .tlb_fill = superh_cpu_tlb_fill,
++
-+
+ static void superh_cpu_synchronize_from_tb(CPUState *cs,
-+#ifndef CONFIG_USER_ONLY
+                                            const TranslationBlock *tb)
-+    .do_interrupt = superh_cpu_do_interrupt,
+ {
 +    .do_unaligned_access = superh_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void superh_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = superh_cpu_class_by_name;
      cc->has_work = superh_cpu_has_work;
--    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
      cc->dump_state = superh_cpu_dump_state;
      cc->set_pc = superh_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
++    cc->get_pc = superh_cpu_get_pc;
      cc->gdb_read_register = superh_cpu_gdb_read_register;
      cc->gdb_write_register = superh_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
      cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
  #endif
      cc->disas_set_info = superh_cpu_disas_set_info;
 -    cc->tcg_ops.initialize = sh4_translate_init;
      cc->gdb_num_core_regs = 59;
      dc->vmsd = &vmstate_sh_cpu;
 +    cc->tcg_ops = &superh_tcg_ops;
  }
  #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
-     DEFINE_PROP_END_OF_LIST()
+     cpu->env.npc = value + 4;
- };
+ }
-+#ifdef CONFIG_TCG
++static vaddr sparc_cpu_get_pc(CPUState *cs)
-+#include "hw/core/tcg-cpu-ops.h"
++{
-+
++    SPARCCPU *cpu = SPARC_CPU(cs);
-+static struct TCGCPUOps sparc_tcg_ops = {
++
-+    .initialize = sparc_tcg_init,
++    return cpu->env.pc;
-+    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
++}
-+    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
++
-+    .tlb_fill = sparc_cpu_tlb_fill,
+ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
-+
+                                           const TranslationBlock *tb)
-+#ifndef CONFIG_USER_ONLY
+ {
 +    .do_interrupt = sparc_cpu_do_interrupt,
 +    .do_transaction_failed = sparc_cpu_do_transaction_failed,
 +    .do_unaligned_access = sparc_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +#endif /* CONFIG_TCG */
 +
  static void sparc_cpu_class_init(ObjectClass *oc, void *data)
  {
      SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = sparc_cpu_class_by_name;
-     cc->parse_features = sparc_cpu_parse_features;
-     cc->has_work = sparc_cpu_has_work;
--    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
-     cc->dump_state = sparc_cpu_dump_state;
- #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
      cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
  #endif
      cc->set_pc = sparc_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
++    cc->get_pc = sparc_cpu_get_pc;
      cc->gdb_read_register = sparc_cpu_gdb_read_register;
      cc->gdb_write_register = sparc_cpu_gdb_write_register;
--    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
+ #ifndef CONFIG_USER_ONLY
  #ifndef CONFIG_USER_ONLY
 -    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
 -    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
      cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
      cc->vmsd = &vmstate_sparc_cpu;
  #endif
      cc->disas_set_info = cpu_sparc_disas_set_info;
 -    cc->tcg_ops.initialize = sparc_tcg_init;
  #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
      cc->gdb_num_core_regs = 86;
  #else
      cc->gdb_num_core_regs = 72;
  #endif
 +    cc->tcg_ops = &sparc_tcg_ops;
  }
  static const TypeInfo sparc_cpu_type_info = {
 diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tilegx/cpu.c
 +++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      return false;
  }
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps tilegx_tcg_ops = {
 +    .initialize = tilegx_tcg_init,
 +    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
 +    .tlb_fill = tilegx_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = tilegx_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = tilegx_cpu_class_by_name;
      cc->has_work = tilegx_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
      cc->dump_state = tilegx_cpu_dump_state;
      cc->set_pc = tilegx_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
      cc->gdb_num_core_regs = 0;
 -    cc->tcg_ops.initialize = tilegx_tcg_init;
 +    cc->tcg_ops = &tilegx_tcg_ops;
  }
  static const TypeInfo tilegx_cpu_type_info = {
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_set_pc(CPUState *cs, vaddr value)
-     set_feature(&cpu->env, TRICORE_FEATURE_161);
+     env->PC = value & ~(target_ulong)1;
  }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr tricore_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps tricore_tcg_ops = {
++    TriCoreCPU *cpu = TRICORE_CPU(cs);
-+    .initialize = tricore_tcg_init,
++    CPUTriCoreState *env = &cpu->env;
-+    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
++
-+    .tlb_fill = tricore_cpu_tlb_fill,
++    return env->PC;
-+};
++}
 +
- static void tricore_cpu_class_init(ObjectClass *c, void *data)
+ static void tricore_cpu_synchronize_from_tb(CPUState *cs,
- {
+                                             const TranslationBlock *tb)
-     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
+ {
 @@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
      cc->dump_state = tricore_cpu_dump_state;
      cc->set_pc = tricore_cpu_set_pc;
--    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
++    cc->get_pc = tricore_cpu_get_pc;
-     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
+     cc->sysemu_ops = &tricore_sysemu_ops;
--    cc->tcg_ops.initialize = tricore_tcg_init;
+     cc->tcg_ops = &tricore_tcg_ops;
--    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
+ }
 +    cc->tcg_ops = &tricore_tcg_ops;
  }
  #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/unicore32/cpu.c
 +++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
      .unmigratable = 1,
  };
 +#include "hw/core/tcg-cpu-ops.h"
 +
 +static struct TCGCPUOps uc32_tcg_ops = {
 +    .initialize = uc32_translate_init,
 +    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
 +    .tlb_fill = uc32_cpu_tlb_fill,
 +
 +#ifndef CONFIG_USER_ONLY
 +    .do_interrupt = uc32_cpu_do_interrupt,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void uc32_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = uc32_cpu_class_by_name;
      cc->has_work = uc32_cpu_has_work;
 -    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
 -    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
      cc->dump_state = uc32_cpu_dump_state;
      cc->set_pc = uc32_cpu_set_pc;
 -    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
      cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
 -    cc->tcg_ops.initialize = uc32_translate_init;
      dc->vmsd = &vmstate_uc32_cpu;
 +    cc->tcg_ops = &uc32_tcg_ops;
  }
  #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
 diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
-     .unmigratable = 1,
+     cpu->env.pc = value;
- };
+ }
-+#include "hw/core/tcg-cpu-ops.h"
++static vaddr xtensa_cpu_get_pc(CPUState *cs)
-+
++{
-+static struct TCGCPUOps xtensa_tcg_ops = {
++    XtensaCPU *cpu = XTENSA_CPU(cs);
-+    .initialize = xtensa_translate_init,
++
-+    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
++    return cpu->env.pc;
-+    .tlb_fill = xtensa_cpu_tlb_fill,
++}
-+    .debug_excp_handler = xtensa_breakpoint_handler,
++
-+
+ static bool xtensa_cpu_has_work(CPUState *cs)
-+#ifndef CONFIG_USER_ONLY
+ {
-+    .do_interrupt = xtensa_cpu_do_interrupt,
+ #ifndef CONFIG_USER_ONLY
 +    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
 +    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
  static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 @@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
-     cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
--    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
--    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
++    cc->get_pc = xtensa_cpu_get_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
      cc->gdb_write_register = xtensa_cpu_gdb_write_register;
      cc->gdb_stop_before_watchpoint = true;
--    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
--    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
- #endif
--    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
-     cc->disas_set_info = xtensa_cpu_disas_set_info;
--    cc->tcg_ops.initialize = xtensa_translate_init;
-     dc->vmsd = &vmstate_xtensa_cpu;
-+    cc->tcg_ops = &xtensa_tcg_ops;
- }
- static const TypeInfo xtensa_cpu_type_info = {
-diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/ppc/translate_init.c.inc
-+++ b/target/ppc/translate_init.c.inc
-@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
-     DEFINE_PROP_END_OF_LIST(),
- };
-+#ifdef CONFIG_TCG
-+#include "hw/core/tcg-cpu-ops.h"
-+
-+static struct TCGCPUOps ppc_tcg_ops = {
-+  .initialize = ppc_translate_init,
-+  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
-+  .tlb_fill = ppc_cpu_tlb_fill,
-+
-+#ifndef CONFIG_USER_ONLY
-+  .do_interrupt = ppc_cpu_do_interrupt,
-+  .cpu_exec_enter = ppc_cpu_exec_enter,
-+  .cpu_exec_exit = ppc_cpu_exec_exit,
-+  .do_unaligned_access = ppc_cpu_do_unaligned_access,
-+#endif /* !CONFIG_USER_ONLY */
-+};
-+#endif /* CONFIG_TCG */
-+
- static void ppc_cpu_class_init(ObjectClass *oc, void *data)
- {
-     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
- #ifndef CONFIG_USER_ONLY
-     cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
- #endif
--#ifdef CONFIG_TCG
--    cc->tcg_ops.initialize = ppc_translate_init;
--    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
--    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
--    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
--#ifndef CONFIG_USER_ONLY
--    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
--    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
--    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
--#endif /* !CONFIG_USER_ONLY */
--#endif /* CONFIG_TCG */
--
-     cc->disas_set_info = ppc_disas_set_info;
-     dc->fw_name = "PowerPC,UNKNOWN";
-+
-+#ifdef CONFIG_TCG
-+    cc->tcg_ops = &ppc_tcg_ops;
-+#endif /* CONFIG_TCG */
- }
- static const TypeInfo ppc_cpu_type_info = {
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
- F: include/exec/tb-hash.h
- F: include/sysemu/cpus.h
- F: include/sysemu/tcg.h
-+F: include/hw/core/tcg-cpu-ops.h
- FPU emulation
- M: Aurelien Jarno <aurelien@aurel32.net>
 --
-.25.1
+.34.1

-[PULL 32/46] cpu: Move synchronize_from_tb() to tcg_ops
+[PULL 17/20] accel/tcg: Introduce tb_pc and log_pc
-From: Eduardo Habkost <ehabkost@redhat.com>
+The availability of tb->pc will shortly be conditional.
 Introduce accessor functions to minimize ifdefs.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Pass around a known pc to places like tcg_gen_code,
-[claudio: wrapped target code in CONFIG_TCG, reworded comments]
+where the caller must already have the value.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20210204163931.7358-5-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h     | 22 +++++++++++++---------
+ accel/tcg/internal.h                    |  6 ++++
- accel/tcg/cpu-exec.c      |  4 ++--
+ include/exec/exec-all.h                 |  6 ++++
- target/arm/cpu.c          |  4 +++-
+ include/tcg/tcg.h                       |  2 +-
- target/avr/cpu.c          |  2 +-
+ accel/tcg/cpu-exec.c                    | 46 ++++++++++++++-----------
- target/hppa/cpu.c         |  2 +-
+ accel/tcg/translate-all.c               | 37 +++++++++++---------
- target/i386/tcg/tcg-cpu.c |  2 +-
+ target/arm/cpu.c                        |  4 +--
- target/microblaze/cpu.c   |  2 +-
+ target/avr/cpu.c                        |  2 +-
- target/mips/cpu.c         |  4 +++-
+ target/hexagon/cpu.c                    |  2 +-
- target/riscv/cpu.c        |  2 +-
+ target/hppa/cpu.c                       |  4 +--
- target/rx/cpu.c           |  2 +-
+ target/i386/tcg/tcg-cpu.c               |  2 +-
- target/sh4/cpu.c          |  2 +-
+ target/loongarch/cpu.c                  |  2 +-
- target/sparc/cpu.c        |  2 +-
+ target/microblaze/cpu.c                 |  2 +-
- target/tricore/cpu.c      |  2 +-
+ target/mips/tcg/exception.c             |  2 +-
-files changed, 30 insertions(+), 22 deletions(-)
+ target/mips/tcg/sysemu/special_helper.c |  2 +-
  target/openrisc/cpu.c                   |  2 +-
  target/riscv/cpu.c                      |  4 +--
  target/rx/cpu.c                         |  2 +-
  target/sh4/cpu.c                        |  4 +--
  target/sparc/cpu.c                      |  2 +-
  target/tricore/cpu.c                    |  2 +-
  tcg/tcg.c                               |  8 ++---
 files changed, 82 insertions(+), 61 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/accel/tcg/internal.h
-+++ b/include/hw/core/cpu.h
++++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
-      * Called when the first CPU is realized.
+ void page_init(void);
-      */
+ void tb_htable_init(void);
-     void (*initialize)(void);
-+    /**
++/* Return the current PC from CPU, which may be cached in TB. */
-+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
++static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
-+     *
++{
-+     * This is called when we abandon execution of a TB before starting it,
++    return tb_pc(tb);
-+     * and must set all parts of the CPU state which the previous TB in the
++}
-+     * chain may not have updated.
++
-+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+ #endif /* ACCEL_TCG_INTERNAL_H */
-+     *
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
-+     * If more state needs to be restored, the target must implement a
+index XXXXXXX..XXXXXXX 100644
-+     * function to restore all the state, and register it here.
+--- a/include/exec/exec-all.h
-+     */
++++ b/include/exec/exec-all.h
-+    void (*synchronize_from_tb)(CPUState *cpu,
+@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
-+                                const struct TranslationBlock *tb);
+     uintptr_t jmp_dest[2];
+ };
- } TcgCpuOperations;
++/* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
++static inline target_ulong tb_pc(const TranslationBlock *tb)
-  *       If the target behaviour here is anything other than "set
++{
-  *       the PC register to the value passed in" then the target must
++    return tb->pc;
-  *       also implement the synchronize_from_tb hook.
++}
-- * @synchronize_from_tb: Callback for synchronizing state from a TCG
++
-- *       #TranslationBlock. This is called when we abandon execution
+ /* Hide the qatomic_read to make code a little easier on the eyes */
-- *       of a TB before starting it, and must set all parts of the CPU
+ static inline uint32_t tb_cflags(const TranslationBlock *tb)
-- *       state which the previous TB in the chain may not have updated.
+ {
-- *       This always includes at least the program counter; some targets
+diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
-- *       will need to do more. If this hook is not implemented then the
+index XXXXXXX..XXXXXXX 100644
-- *       default is to call @set_pc(tb->pc).
+--- a/include/tcg/tcg.h
-  * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
++++ b/include/tcg/tcg.h
-  *       address fault.  For system mode, if the access is valid, call
+@@ -XXX,XX +XXX,XX @@ void tcg_register_thread(void);
-  *       tlb_set_page and return true; if the access is invalid, and
+ void tcg_prologue_init(TCGContext *s);
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+ void tcg_func_start(TCGContext *s);
-     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
-                                Error **errp);
+-int tcg_gen_code(TCGContext *s, TranslationBlock *tb);
-     void (*set_pc)(CPUState *cpu, vaddr value);
++int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start);
--    void (*synchronize_from_tb)(CPUState *cpu,
--                                const struct TranslationBlock *tb);
+ void tcg_set_frame(TCGContext *s, TCGReg reg, intptr_t start, intptr_t size);
-     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr);
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
+     const TranslationBlock *tb = p;
+     const struct tb_desc *desc = d;
+-    if (tb->pc == desc->pc &&
++    if (tb_pc(tb) == desc->pc &&
+         tb->page_addr[0] == desc->page_addr0 &&
+         tb->cs_base == desc->cs_base &&
+         tb->flags == desc->flags &&
+@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
+     return tb;
+ }
+-static inline void log_cpu_exec(target_ulong pc, CPUState *cpu,
+-                                const TranslationBlock *tb)
++static void log_cpu_exec(target_ulong pc, CPUState *cpu,
++                         const TranslationBlock *tb)
+ {
+-    if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC))
+-        && qemu_log_in_addr_range(pc)) {
+-
++    if (qemu_log_in_addr_range(pc)) {
+         qemu_log_mask(CPU_LOG_EXEC,
+                       "Trace %d: %p [" TARGET_FMT_lx
+                       "/" TARGET_FMT_lx "/%08x/%08x] %s\n",
+@@ -XXX,XX +XXX,XX @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
+         return tcg_code_gen_epilogue;
+     }
+-    log_cpu_exec(pc, cpu, tb);
++    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
++        log_cpu_exec(pc, cpu, tb);
++    }
+     return tb->tc.ptr;
+ }
 @@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-                                TARGET_FMT_lx "] %s\n",
+     TranslationBlock *last_tb;
-                                last_tb->tc.ptr, last_tb->pc,
+     const void *tb_ptr = itb->tc.ptr;
-                                lookup_symbol(last_tb->pc));
--        if (cc->synchronize_from_tb) {
+-    log_cpu_exec(itb->pc, cpu, itb);
--            cc->synchronize_from_tb(cpu, last_tb);
++    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
-+        if (cc->tcg_ops.synchronize_from_tb) {
++        log_cpu_exec(log_pc(cpu, itb), cpu, itb);
-+            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
++    }
      qemu_thread_jit_execute();
      ret = tcg_qemu_tb_exec(env, tb_ptr);
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
           * of the start of the TB.
           */
          CPUClass *cc = CPU_GET_CLASS(cpu);
 -        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
 -                               "Stopped execution of TB chain before %p ["
 -                               TARGET_FMT_lx "] %s\n",
 -                               last_tb->tc.ptr, last_tb->pc,
 -                               lookup_symbol(last_tb->pc));
 +
          if (cc->tcg_ops->synchronize_from_tb) {
              cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
          } else {
              assert(cc->set_pc);
-             cc->set_pc(cpu, last_tb->pc);
+-            cc->set_pc(cpu, last_tb->pc);
 +            cc->set_pc(cpu, tb_pc(last_tb));
 +        }
 +        if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
 +            target_ulong pc = log_pc(cpu, last_tb);
 +            if (qemu_log_in_addr_range(pc)) {
 +                qemu_log("Stopped execution of TB chain before %p ["
 +                         TARGET_FMT_lx "] %s\n",
 +                         last_tb->tc.ptr, pc, lookup_symbol(pc));
 +            }
          }
      }
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
      qemu_spin_unlock(&tb_next->jmp_lock);
 -    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
 -                           "Linking TBs %p [" TARGET_FMT_lx
 -                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
 -                           tb->tc.ptr, tb->pc, n,
 -                           tb_next->tc.ptr, tb_next->pc);
 +    qemu_log_mask(CPU_LOG_EXEC, "Linking TBs %p index %d -> %p\n",
 +                  tb->tc.ptr, n, tb_next->tc.ptr);
      return;
   out_unlock_next:
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
  }
  static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 +                                    target_ulong pc,
                                      TranslationBlock **last_tb, int *tb_exit)
  {
      int32_t insns_left;
 -    trace_exec_tb(tb, tb->pc);
 +    trace_exec_tb(tb, pc);
      tb = cpu_tb_exec(cpu, tb, tb_exit);
      if (*tb_exit != TB_EXIT_REQUESTED) {
          *last_tb = tb;
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  tb_add_jump(last_tb, tb_exit, tb);
              }
 -            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
 +            cpu_loop_exec_tb(cpu, tb, pc, &last_tb, &tb_exit);
              /* Try to align the host and virtual clocks
                 if the guest is in advance */
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
          for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
              if (i == 0) {
 -                prev = (j == 0 ? tb->pc : 0);
 +                prev = (j == 0 ? tb_pc(tb) : 0);
              } else {
                  prev = tcg_ctx->gen_insn_data[i - 1][j];
              }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
  static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                       uintptr_t searched_pc, bool reset_icount)
  {
 -    target_ulong data[TARGET_INSN_START_WORDS] = { tb->pc };
 +    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
      uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
      CPUArchState *env = cpu->env_ptr;
      const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
      const TranslationBlock *a = ap;
      const TranslationBlock *b = bp;
 -    return a->pc == b->pc &&
 +    return tb_pc(a) == tb_pc(b) &&
          a->cs_base == b->cs_base &&
          a->flags == b->flags &&
          (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
@@ -XXX,XX +XXX,XX @@ static void do_tb_invalidate_check(void *p, uint32_t hash, void *userp)
      TranslationBlock *tb = p;
      target_ulong addr = *(target_ulong *)userp;
 -    if (!(addr + TARGET_PAGE_SIZE <= tb->pc || addr >= tb->pc + tb->size)) {
 +    if (!(addr + TARGET_PAGE_SIZE <= tb_pc(tb) ||
 +          addr >= tb_pc(tb) + tb->size)) {
          printf("ERROR invalidate: address=" TARGET_FMT_lx
 -               " PC=%08lx size=%04x\n", addr, (long)tb->pc, tb->size);
 +               " PC=%08lx size=%04x\n", addr, (long)tb_pc(tb), tb->size);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void do_tb_page_check(void *p, uint32_t hash, void *userp)
      TranslationBlock *tb = p;
      int flags1, flags2;
 -    flags1 = page_get_flags(tb->pc);
 -    flags2 = page_get_flags(tb->pc + tb->size - 1);
 +    flags1 = page_get_flags(tb_pc(tb));
 +    flags2 = page_get_flags(tb_pc(tb) + tb->size - 1);
      if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
          printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
 -               (long)tb->pc, tb->size, flags1, flags2);
 +               (long)tb_pc(tb), tb->size, flags1, flags2);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
      /* remove the TB from the hash list */
      phys_pc = tb->page_addr[0];
 -    h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
 +    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
                       tb->trace_vcpu_dstate);
      if (!qht_remove(&tb_ctx.htable, tb, h)) {
          return;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      }
      /* add in the hash table */
 -    h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags,
 +    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
                       tb->trace_vcpu_dstate);
      qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      tcg_ctx->cpu = NULL;
      max_insns = tb->icount;
 -    trace_translate_block(tb, tb->pc, tb->tc.ptr);
 +    trace_translate_block(tb, pc, tb->tc.ptr);
      /* generate machine code */
      tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      ti = profile_getclock();
  #endif
 -    gen_code_size = tcg_gen_code(tcg_ctx, tb);
 +    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
      if (unlikely(gen_code_size < 0)) {
   error_return:
          switch (gen_code_size) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
  #ifdef DEBUG_DISAS
      if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
 -        qemu_log_in_addr_range(tb->pc)) {
 +        qemu_log_in_addr_range(pc)) {
          FILE *logfile = qemu_log_trylock();
          if (logfile) {
              int code_size, data_size;
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
       */
      cpu->cflags_next_tb = curr_cflags(cpu) | CF_MEMI_ONLY | CF_LAST_IO | n;
 -    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
 -                           "cpu_io_recompile: rewound execution of TB to "
 -                           TARGET_FMT_lx "\n", tb->pc);
 +    if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
 +        target_ulong pc = log_pc(cpu, tb);
 +        if (qemu_log_in_addr_range(pc)) {
 +            qemu_log("cpu_io_recompile: rewound execution of TB to "
 +                     TARGET_FMT_lx "\n", pc);
 +        }
 +    }
      cpu_loop_exit_noexc(cpu);
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
-     }
+      * never possible for an AArch64 TB to chain to an AArch32 TB.
- }
+      */
+     if (is_a64(env)) {
-+#ifdef CONFIG_TCG
+-        env->pc = tb->pc;
- static void arm_cpu_synchronize_from_tb(CPUState *cs,
++        env->pc = tb_pc(tb);
-                                         const TranslationBlock *tb)
+     } else {
- {
+-        env->regs[15] = tb->pc;
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
++        env->regs[15] = tb_pc(tb);
-         env->regs[15] = tb->pc;
+     }
-     }
+ }
- }
+ #endif /* CONFIG_TCG */
 +#endif /* CONFIG_TCG */
  static bool arm_cpu_has_work(CPUState *cs)
  {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
 -    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
      cc->gdb_write_register = arm_cpu_gdb_write_register;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = arm_translate_init;
 +    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
      cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void avr_cpu_synchronize_from_tb(CPUState *cs,
-     cc->vmsd = &vms_avr_cpu;
+     AVRCPU *cpu = AVR_CPU(cs);
-     cc->disas_set_info = avr_cpu_disas_set_info;
+     CPUAVRState *env = &cpu->env;
-     cc->tcg_ops.initialize = avr_cpu_tcg_init;
--    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
+-    env->pc_w = tb->pc / 2; /* internally PC points to words */
-+    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
++    env->pc_w = tb_pc(tb) / 2; /* internally PC points to words */
-     cc->gdb_read_register = avr_cpu_gdb_read_register;
+ }
-     cc->gdb_write_register = avr_cpu_gdb_write_register;
-     cc->gdb_num_core_regs = 35;
+ static void avr_cpu_reset(DeviceState *ds)
 diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hexagon/cpu.c
 +++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
  {
      HexagonCPU *cpu = HEXAGON_CPU(cs);
      CPUHexagonState *env = &cpu->env;
 -    env->gpr[HEX_REG_PC] = tb->pc;
 +    env->gpr[HEX_REG_PC] = tb_pc(tb);
  }
  static bool hexagon_cpu_has_work(CPUState *cs)
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
-     cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
+     HPPACPU *cpu = HPPA_CPU(cs);
-     cc->dump_state = hppa_cpu_dump_state;
-     cc->set_pc = hppa_cpu_set_pc;
+ #ifdef CONFIG_USER_ONLY
--    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
+-    cpu->env.iaoq_f = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
++    cpu->env.iaoq_f = tb_pc(tb);
-     cc->gdb_read_register = hppa_cpu_gdb_read_register;
+     cpu->env.iaoq_b = tb->cs_base;
-     cc->gdb_write_register = hppa_cpu_gdb_write_register;
+ #else
-     cc->tlb_fill = hppa_cpu_tlb_fill;
+     /* Recover the IAOQ values from the GVA + PRIV.  */
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
      int32_t diff = cs_base;
      cpu->env.iasq_f = iasq_f;
 -    cpu->env.iaoq_f = (tb->pc & ~iasq_f) + priv;
 +    cpu->env.iaoq_f = (tb_pc(tb) & ~iasq_f) + priv;
      if (diff) {
          cpu->env.iaoq_b = cpu->env.iaoq_f + diff;
      }
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
+@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  {
-     cc->do_interrupt = x86_cpu_do_interrupt;
+     X86CPU *cpu = X86_CPU(cs);
-     cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
--    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
+-    cpu->env.eip = tb->pc - tb->cs_base;
-+    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
++    cpu->env.eip = tb_pc(tb) - tb->cs_base;
-     cc->cpu_exec_enter = x86_cpu_exec_enter;
+ }
-     cc->cpu_exec_exit = x86_cpu_exec_exit;
-     cc->tcg_ops.initialize = tcg_x86_init;
+ #ifndef CONFIG_USER_ONLY
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
      LoongArchCPU *cpu = LOONGARCH_CPU(cs);
      CPULoongArchState *env = &cpu->env;
 -    env->pc = tb->pc;
 +    env->pc = tb_pc(tb);
  }
  #endif /* CONFIG_TCG */
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
-     cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
+ {
-     cc->dump_state = mb_cpu_dump_state;
+     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-     cc->set_pc = mb_cpu_set_pc;
--    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
+-    cpu->env.pc = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
++    cpu->env.pc = tb_pc(tb);
-     cc->gdb_read_register = mb_cpu_gdb_read_register;
+     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
-     cc->gdb_write_register = mb_cpu_gdb_write_register;
+ }
-     cc->tlb_fill = mb_cpu_tlb_fill;
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
+diff --git a/target/mips/tcg/exception.c b/target/mips/tcg/exception.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
+--- a/target/mips/tcg/exception.c
-+++ b/target/mips/cpu.c
++++ b/target/mips/tcg/exception.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
+@@ -XXX,XX +XXX,XX @@ void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb)
-     }
+     MIPSCPU *cpu = MIPS_CPU(cs);
- }
+     CPUMIPSState *env = &cpu->env;
-+#ifdef CONFIG_TCG
+-    env->active_tc.PC = tb->pc;
- static void mips_cpu_synchronize_from_tb(CPUState *cs,
++    env->active_tc.PC = tb_pc(tb);
                                           const TranslationBlock *tb)
  {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
      env->hflags &= ~MIPS_HFLAG_BMASK;
      env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
  }
-+#endif /* CONFIG_TCG */
+diff --git a/target/mips/tcg/sysemu/special_helper.c b/target/mips/tcg/sysemu/special_helper.c
+index XXXXXXX..XXXXXXX 100644
- static bool mips_cpu_has_work(CPUState *cs)
+--- a/target/mips/tcg/sysemu/special_helper.c
- {
++++ b/target/mips/tcg/sysemu/special_helper.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ bool mips_io_recompile_replay_branch(CPUState *cs, const TranslationBlock *tb)
-     cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
+     CPUMIPSState *env = &cpu->env;
-     cc->dump_state = mips_cpu_dump_state;
-     cc->set_pc = mips_cpu_set_pc;
+     if ((env->hflags & MIPS_HFLAG_BMASK) != 0
--    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
+-        && env->active_tc.PC != tb->pc) {
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
++        && env->active_tc.PC != tb_pc(tb)) {
-     cc->gdb_write_register = mips_cpu_gdb_write_register;
+         env->active_tc.PC -= (env->hflags & MIPS_HFLAG_B16 ? 2 : 4);
- #ifndef CONFIG_USER_ONLY
+         env->hflags &= ~MIPS_HFLAG_BMASK;
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
+         return true;
-     cc->disas_set_info = mips_cpu_disas_set_info;
+diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
- #ifdef CONFIG_TCG
+index XXXXXXX..XXXXXXX 100644
-     cc->tcg_ops.initialize = mips_tcg_init;
+--- a/target/openrisc/cpu.c
-+    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
++++ b/target/openrisc/cpu.c
-     cc->tlb_fill = mips_cpu_tlb_fill;
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
- #endif
+ {
      OpenRISCCPU *cpu = OPENRISC_CPU(cs);
 -    cpu->env.pc = tb->pc;
 +    cpu->env.pc = tb_pc(tb);
  }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
-     cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
+     RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
-     cc->dump_state = riscv_cpu_dump_state;
-     cc->set_pc = riscv_cpu_set_pc;
+     if (xl == MXL_RV32) {
--    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
+-        env->pc = (int32_t)tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
++        env->pc = (int32_t)tb_pc(tb);
-     cc->gdb_read_register = riscv_cpu_gdb_read_register;
+     } else {
-     cc->gdb_write_register = riscv_cpu_gdb_write_register;
+-        env->pc = tb->pc;
-     cc->gdb_num_core_regs = 33;
++        env->pc = tb_pc(tb);
      }
  }
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
-     cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
+ {
-     cc->dump_state = rx_cpu_dump_state;
+     RXCPU *cpu = RX_CPU(cs);
-     cc->set_pc = rx_cpu_set_pc;
--    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
+-    cpu->env.pc = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
++    cpu->env.pc = tb_pc(tb);
-     cc->gdb_read_register = rx_cpu_gdb_read_register;
+ }
-     cc->gdb_write_register = rx_cpu_gdb_write_register;
-     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
+ static bool rx_cpu_has_work(CPUState *cs)
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
-     cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
+ {
-     cc->dump_state = superh_cpu_dump_state;
+     SuperHCPU *cpu = SUPERH_CPU(cs);
-     cc->set_pc = superh_cpu_set_pc;
--    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+-    cpu->env.pc = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
++    cpu->env.pc = tb_pc(tb);
-     cc->gdb_read_register = superh_cpu_gdb_read_register;
+     cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
-     cc->gdb_write_register = superh_cpu_gdb_write_register;
+ }
-     cc->tlb_fill = superh_cpu_tlb_fill;
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
      CPUSH4State *env = &cpu->env;
      if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
 -        && env->pc != tb->pc) {
 +        && env->pc != tb_pc(tb)) {
          env->pc -= 2;
          env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
          return true;
 diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/cpu.c
 +++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
-     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
+ {
- #endif
+     SPARCCPU *cpu = SPARC_CPU(cs);
-     cc->set_pc = sparc_cpu_set_pc;
--    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+-    cpu->env.pc = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
++    cpu->env.pc = tb_pc(tb);
-     cc->gdb_read_register = sparc_cpu_gdb_read_register;
+     cpu->env.npc = tb->cs_base;
-     cc->gdb_write_register = sparc_cpu_gdb_write_register;
+ }
-     cc->tlb_fill = sparc_cpu_tlb_fill;
 diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/cpu.c
 +++ b/target/tricore/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
+@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_synchronize_from_tb(CPUState *cs,
+     TriCoreCPU *cpu = TRICORE_CPU(cs);
-     cc->dump_state = tricore_cpu_dump_state;
+     CPUTriCoreState *env = &cpu->env;
-     cc->set_pc = tricore_cpu_set_pc;
--    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
+-    env->PC = tb->pc;
-+    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
++    env->PC = tb_pc(tb);
-     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
+ }
-     cc->tcg_ops.initialize = tricore_tcg_init;
-     cc->tlb_fill = tricore_cpu_tlb_fill;
+ static void tricore_cpu_reset(DeviceState *dev)
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void)
  #endif
 -int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 +int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
  {
  #ifdef CONFIG_PROFILER
      TCGProfile *prof = &s->prof;
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
  #ifdef DEBUG_DISAS
      if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
 -                 && qemu_log_in_addr_range(tb->pc))) {
 +                 && qemu_log_in_addr_range(pc_start))) {
          FILE *logfile = qemu_log_trylock();
          if (logfile) {
              fprintf(logfile, "OP:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
      if (s->nb_indirects > 0) {
  #ifdef DEBUG_DISAS
          if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_IND)
 -                     && qemu_log_in_addr_range(tb->pc))) {
 +                     && qemu_log_in_addr_range(pc_start))) {
              FILE *logfile = qemu_log_trylock();
              if (logfile) {
                  fprintf(logfile, "OP before indirect lowering:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
  #ifdef DEBUG_DISAS
      if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
 -                 && qemu_log_in_addr_range(tb->pc))) {
 +                 && qemu_log_in_addr_range(pc_start))) {
          FILE *logfile = qemu_log_trylock();
          if (logfile) {
              fprintf(logfile, "OP after optimization and liveness analysis:\n");
 --
-.25.1
+.34.1

-[PULL 40/46] physmem: make watchpoint checking code TCG-only
+[PULL 18/20] accel/tcg: Introduce TARGET_TB_PCREL
-From: Claudio Fontana <cfontana@suse.de>
+Prepare for targets to be able to produce TBs that can
 run in more than one virtual context.
-cpu_check_watchpoint, watchpoint_address_matches are TCG-only.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-Id: <20210204163931.7358-13-cfontana@suse.de>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
+ accel/tcg/internal.h      |  4 +++
-file changed, 72 insertions(+), 69 deletions(-)
+ accel/tcg/tb-jmp-cache.h  | 41 +++++++++++++++++++++++++
  include/exec/cpu-defs.h   |  3 ++
  include/exec/exec-all.h   | 32 ++++++++++++++++++--
  accel/tcg/cpu-exec.c      | 16 ++++++----
  accel/tcg/translate-all.c | 64 ++++++++++++++++++++++++++-------------
 files changed, 131 insertions(+), 29 deletions(-)
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
+--- a/accel/tcg/internal.h
-+++ b/softmmu/physmem.c
++++ b/accel/tcg/internal.h
-@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
+@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void);
-     }
+ /* Return the current PC from CPU, which may be cached in TB. */
- }
+ static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
+ {
-+#ifdef CONFIG_TCG
++#if TARGET_TB_PCREL
- /* Return true if this watchpoint address matches the specified
++    return cpu->cc->get_pc(cpu);
-  * access (ie the address range covered by the watchpoint overlaps
++#else
-  * partially or completely with the address range covered by the
+     return tb_pc(tb);
-@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
++#endif
-     return ret;
+ }
- }
+ #endif /* ACCEL_TCG_INTERNAL_H */
-+/* Generate a debug exception if a watchpoint has been hit.  */
+diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
-+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+index XXXXXXX..XXXXXXX 100644
-+                          MemTxAttrs attrs, int flags, uintptr_t ra)
+--- a/accel/tcg/tb-jmp-cache.h
 +++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Accessed in parallel; all accesses to 'tb' must be atomic.
 + * For TARGET_TB_PCREL, accesses to 'pc' must be protected by
 + * a load_acquire/store_release to 'tb'.
   */
  struct CPUJumpCache {
      struct {
          TranslationBlock *tb;
 +#if TARGET_TB_PCREL
 +        target_ulong pc;
 +#endif
      } array[TB_JMP_CACHE_SIZE];
  };
 +static inline TranslationBlock *
 +tb_jmp_cache_get_tb(CPUJumpCache *jc, uint32_t hash)
 +{
-+    CPUClass *cc = CPU_GET_CLASS(cpu);
++#if TARGET_TB_PCREL
-+    CPUWatchpoint *wp;
++    /* Use acquire to ensure current load of pc from jc. */
-+
++    return qatomic_load_acquire(&jc->array[hash].tb);
-+    assert(tcg_enabled());
++#else
-+    if (cpu->watchpoint_hit) {
++    /* Use rcu_read to ensure current load of pc from *tb. */
-+        /*
++    return qatomic_rcu_read(&jc->array[hash].tb);
-+         * We re-entered the check after replacing the TB.
++#endif
-+         * Now raise the debug interrupt so that it will
++}
-+         * trigger after the current instruction.
++
-+         */
++static inline target_ulong
-+        qemu_mutex_lock_iothread();
++tb_jmp_cache_get_pc(CPUJumpCache *jc, uint32_t hash, TranslationBlock *tb)
-+        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
++{
-+        qemu_mutex_unlock_iothread();
++#if TARGET_TB_PCREL
-+        return;
++    return jc->array[hash].pc;
 +#else
 +    return tb_pc(tb);
 +#endif
 +}
 +
 +static inline void
 +tb_jmp_cache_set(CPUJumpCache *jc, uint32_t hash,
 +                 TranslationBlock *tb, target_ulong pc)
 +{
 +#if TARGET_TB_PCREL
 +    jc->array[hash].pc = pc;
 +    /* Use store_release on tb to ensure pc is written first. */
 +    qatomic_store_release(&jc->array[hash].tb, tb);
 +#else
 +    /* Use the pc value already stored in tb->pc. */
 +    qatomic_set(&jc->array[hash].tb, tb);
 +#endif
 +}
 +
  #endif /* ACCEL_TCG_TB_JMP_CACHE_H */
 diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/cpu-defs.h
 +++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
  #  error TARGET_PAGE_BITS must be defined in cpu-param.h
  # endif
  #endif
 +#ifndef TARGET_TB_PCREL
 +# define TARGET_TB_PCREL 0
 +#endif
  #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct tb_tc {
  };
  struct TranslationBlock {
 -    target_ulong pc;   /* simulated PC corresponding to this block (EIP + CS base) */
 -    target_ulong cs_base; /* CS base for this block */
 +#if !TARGET_TB_PCREL
 +    /*
 +     * Guest PC corresponding to this block.  This must be the true
 +     * virtual address.  Therefore e.g. x86 stores EIP + CS_BASE, and
 +     * targets like Arm, MIPS, HP-PA, which reuse low bits for ISA or
 +     * privilege, must store those bits elsewhere.
 +     *
 +     * If TARGET_TB_PCREL, the opcodes for the TranslationBlock are
 +     * written such that the TB is associated only with the physical
 +     * page and may be run in any virtual address context.  In this case,
 +     * PC must always be taken from ENV in a target-specific manner.
 +     * Unwind information is taken as offsets from the page, to be
 +     * deposited into the "current" PC.
 +     */
 +    target_ulong pc;
 +#endif
 +
 +    /*
 +     * Target-specific data associated with the TranslationBlock, e.g.:
 +     * x86: the original user, the Code Segment virtual base,
 +     * arm: an extension of tb->flags,
 +     * s390x: instruction data for EXECUTE,
 +     * sparc: the next pc of the instruction queue (for delay slots).
 +     */
 +    target_ulong cs_base;
 +
      uint32_t flags; /* flags defining in which context the code was generated */
      uint32_t cflags;    /* compile flags */
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
  /* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
  static inline target_ulong tb_pc(const TranslationBlock *tb)
  {
 +#if TARGET_TB_PCREL
 +    qemu_build_not_reached();
 +#else
      return tb->pc;
 +#endif
  }
  /* Hide the qatomic_read to make code a little easier on the eyes */
 diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
      const TranslationBlock *tb = p;
      const struct tb_desc *desc = d;
 -    if (tb_pc(tb) == desc->pc &&
 +    if ((TARGET_TB_PCREL || tb_pc(tb) == desc->pc) &&
          tb->page_addr[0] == desc->page_addr0 &&
          tb->cs_base == desc->cs_base &&
          tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
          return NULL;
      }
      desc.page_addr0 = phys_pc;
 -    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
 +    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : pc),
 +                     flags, cflags, *cpu->trace_dstate);
      return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
  }
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                            uint32_t flags, uint32_t cflags)
  {
      TranslationBlock *tb;
 +    CPUJumpCache *jc;
      uint32_t hash;
      /* we should never be trying to look up an INVALID tb */
      tcg_debug_assert(!(cflags & CF_INVALID));
      hash = tb_jmp_cache_hash_func(pc);
 -    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
 +    jc = cpu->tb_jmp_cache;
 +    tb = tb_jmp_cache_get_tb(jc, hash);
      if (likely(tb &&
 -               tb->pc == pc &&
 +               tb_jmp_cache_get_pc(jc, hash, tb) == pc &&
                 tb->cs_base == cs_base &&
                 tb->flags == flags &&
                 tb->trace_vcpu_dstate == *cpu->trace_dstate &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
      if (tb == NULL) {
          return NULL;
      }
 -    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
 +    tb_jmp_cache_set(jc, hash, tb, pc);
      return tb;
  }
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
          if (cc->tcg_ops->synchronize_from_tb) {
              cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
          } else {
 +            assert(!TARGET_TB_PCREL);
              assert(cc->set_pc);
              cc->set_pc(cpu, tb_pc(last_tb));
          }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                   * for the fast lookup
                   */
                  h = tb_jmp_cache_hash_func(pc);
 -                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
 +                tb_jmp_cache_set(cpu->tb_jmp_cache, h, tb, pc);
              }
  #ifndef CONFIG_USER_ONLY
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
          for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
              if (i == 0) {
 -                prev = (j == 0 ? tb_pc(tb) : 0);
 +                prev = (!TARGET_TB_PCREL && j == 0 ? tb_pc(tb) : 0);
              } else {
                  prev = tcg_ctx->gen_insn_data[i - 1][j];
              }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
  static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                       uintptr_t searched_pc, bool reset_icount)
  {
 -    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
 +    target_ulong data[TARGET_INSN_START_WORDS];
      uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
      CPUArchState *env = cpu->env_ptr;
      const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
          return -1;
      }
 +    memset(data, 0, sizeof(data));
 +    if (!TARGET_TB_PCREL) {
 +        data[0] = tb_pc(tb);
 +    }
 +
-+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+     /* Reconstruct the stored insn data while looking for the point at
-+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+        which the end of the insn exceeds the searched_pc.  */
-+        if (watchpoint_address_matches(wp, addr, len)
+     for (i = 0; i < num_insns; ++i) {
-+            && (wp->flags & flags)) {
+@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
-+            if (replay_running_debug()) {
+     const TranslationBlock *a = ap;
-+                /*
+     const TranslationBlock *b = bp;
-+                 * Don't process the watchpoints when we are
-+                 * in a reverse debugging operation.
+-    return tb_pc(a) == tb_pc(b) &&
-+                 */
+-        a->cs_base == b->cs_base &&
-+                replay_breakpoint();
+-        a->flags == b->flags &&
-+                return;
+-        (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
 -        a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
 -        a->page_addr[0] == b->page_addr[0] &&
 -        a->page_addr[1] == b->page_addr[1];
 +    return ((TARGET_TB_PCREL || tb_pc(a) == tb_pc(b)) &&
 +            a->cs_base == b->cs_base &&
 +            a->flags == b->flags &&
 +            (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
 +            a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
 +            a->page_addr[0] == b->page_addr[0] &&
 +            a->page_addr[1] == b->page_addr[1]);
  }
  void tb_htable_init(void)
@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
      qemu_spin_unlock(&dest->jmp_lock);
  }
 +static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
 +{
 +    CPUState *cpu;
 +
 +    if (TARGET_TB_PCREL) {
 +        /* A TB may be at any virtual address */
 +        CPU_FOREACH(cpu) {
 +            tcg_flush_jmp_cache(cpu);
 +        }
 +    } else {
 +        uint32_t h = tb_jmp_cache_hash_func(tb_pc(tb));
 +
 +        CPU_FOREACH(cpu) {
 +            CPUJumpCache *jc = cpu->tb_jmp_cache;
 +
 +            if (qatomic_read(&jc->array[h].tb) == tb) {
 +                qatomic_set(&jc->array[h].tb, NULL);
 +            }
-+            if (flags == BP_MEM_READ) {
-+                wp->flags |= BP_WATCHPOINT_HIT_READ;
-+            } else {
-+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-+            }
-+            wp->hitaddr = MAX(addr, wp->vaddr);
-+            wp->hitattrs = attrs;
-+            if (!cpu->watchpoint_hit) {
-+                if (wp->flags & BP_CPU &&
-+                    !cc->debug_check_watchpoint(cpu, wp)) {
-+                    wp->flags &= ~BP_WATCHPOINT_HIT;
-+                    continue;
-+                }
-+                cpu->watchpoint_hit = wp;
-+
-+                mmap_lock();
-+                tb_check_watchpoint(cpu, ra);
-+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-+                    cpu->exception_index = EXCP_DEBUG;
-+                    mmap_unlock();
-+                    cpu_loop_exit_restore(cpu, ra);
-+                } else {
-+                    /* Force execution of one insn next time.  */
-+                    cpu->cflags_next_tb = 1 | curr_cflags();
-+                    mmap_unlock();
-+                    if (ra) {
-+                        cpu_restore_state(cpu, ra, true);
-+                    }
-+                    cpu_loop_exit_noexc(cpu);
-+                }
-+            }
-+        } else {
-+            wp->flags &= ~BP_WATCHPOINT_HIT;
 +        }
 +    }
 +}
 +
-+#endif /* CONFIG_TCG */
+ /*
-+
+  * In user-mode, call with mmap_lock held.
- /* Called from RCU critical section */
+  * In !user-mode, if @rm_from_page_list is set, call with the TB's pages'
- static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
+@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
- {
+  */
-@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
+ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
-     return block->offset + offset;
+ {
- }
+-    CPUState *cpu;
+     PageDesc *p;
--/* Generate a debug exception if a watchpoint has been hit.  */
+     uint32_t h;
--void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+     tb_page_addr_t phys_pc;
--                          MemTxAttrs attrs, int flags, uintptr_t ra)
+@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
--{
--    CPUClass *cc = CPU_GET_CLASS(cpu);
+     /* remove the TB from the hash list */
--    CPUWatchpoint *wp;
+     phys_pc = tb->page_addr[0];
--
+-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
--    assert(tcg_enabled());
+-                     tb->trace_vcpu_dstate);
--    if (cpu->watchpoint_hit) {
++    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
--        /*
++                     tb->flags, orig_cflags, tb->trace_vcpu_dstate);
--         * We re-entered the check after replacing the TB.
+     if (!qht_remove(&tb_ctx.htable, tb, h)) {
--         * Now raise the debug interrupt so that it will
+         return;
--         * trigger after the current instruction.
+     }
--         */
+@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
--        qemu_mutex_lock_iothread();
+     }
--        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
--        qemu_mutex_unlock_iothread();
+     /* remove the TB from the hash list */
--        return;
+-    h = tb_jmp_cache_hash_func(tb->pc);
--    }
+-    CPU_FOREACH(cpu) {
--
+-        CPUJumpCache *jc = cpu->tb_jmp_cache;
--    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+-        if (qatomic_read(&jc->array[h].tb) == tb) {
--    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+-            qatomic_set(&jc->array[h].tb, NULL);
 -        if (watchpoint_address_matches(wp, addr, len)
 -            && (wp->flags & flags)) {
 -            if (replay_running_debug()) {
 -                /*
 -                 * Don't process the watchpoints when we are
 -                 * in a reverse debugging operation.
 -                 */
 -                replay_breakpoint();
 -                return;
 -            }
 -            if (flags == BP_MEM_READ) {
 -                wp->flags |= BP_WATCHPOINT_HIT_READ;
 -            } else {
 -                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
 -            }
 -            wp->hitaddr = MAX(addr, wp->vaddr);
 -            wp->hitattrs = attrs;
 -            if (!cpu->watchpoint_hit) {
 -                if (wp->flags & BP_CPU &&
 -                    !cc->debug_check_watchpoint(cpu, wp)) {
 -                    wp->flags &= ~BP_WATCHPOINT_HIT;
 -                    continue;
 -                }
 -                cpu->watchpoint_hit = wp;
 -
 -                mmap_lock();
 -                tb_check_watchpoint(cpu, ra);
 -                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
 -                    cpu->exception_index = EXCP_DEBUG;
 -                    mmap_unlock();
 -                    cpu_loop_exit_restore(cpu, ra);
 -                } else {
 -                    /* Force execution of one insn next time.  */
 -                    cpu->cflags_next_tb = 1 | curr_cflags();
 -                    mmap_unlock();
 -                    if (ra) {
 -                        cpu_restore_state(cpu, ra, true);
 -                    }
 -                    cpu_loop_exit_noexc(cpu);
 -                }
 -            }
 -        } else {
 -            wp->flags &= ~BP_WATCHPOINT_HIT;
 -        }
 -    }
--}
++    tb_jmp_cache_inval_tb(tb);
--
- static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
+     /* suppress this TB from the two jump lists */
-                                  MemTxAttrs attrs, void *buf, hwaddr len);
+     tb_remove_from_jmp_list(tb, 0);
- static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
+@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      }
      /* add in the hash table */
 -    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
 -                     tb->trace_vcpu_dstate);
 +    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
 +                     tb->flags, tb->cflags, tb->trace_vcpu_dstate);
      qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
      /* remove TB from the page(s) if we couldn't insert it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      gen_code_buf = tcg_ctx->code_gen_ptr;
      tb->tc.ptr = tcg_splitwx_to_rx(gen_code_buf);
 +#if !TARGET_TB_PCREL
      tb->pc = pc;
 +#endif
      tb->cs_base = cs_base;
      tb->flags = flags;
      tb->cflags = cflags;
 --
-.25.1
+.34.1

-[PULL 45/46] accel: replace struct CpusAccel with AccelOpsClass
+[PULL 19/20] tcg/ppc: Optimize 26-bit jumps
-From: Claudio Fontana <cfontana@suse.de>
+From: Leandro Lupori <leandro.lupori@eldorado.org.br>
-This will allow us to centralize the registration of
+PowerPC64 processors handle direct branches better than indirect
-the cpus.c module accelerator operations (in accel/accel-softmmu.c),
+ones, resulting in less stalled cycles and branch misses.
 and trigger it automatically using object hierarchy lookup from the
 new accel_init_interfaces() initialization step, depending just on
 which accelerators are available in the code.
-Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
+However, PPC's tb_target_set_jmp_target() was only using direct
-kvm-accel-ops.c, etc, matching the object type names.
+branches for 16-bit jumps, while PowerPC64's unconditional branch
 instructions are able to handle displacements of up to 26 bits.
 To take advantage of this, now jumps whose displacements fit in
 between 17 and 26 bits are also converted to direct branches.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20210204163931.7358-18-cfontana@suse.de>
+Signed-off-by: Leandro Lupori <leandro.lupori@eldorado.org.br>
 [rth: Expanded some commentary.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- accel/accel-softmmu.h                         | 15 ++++++
+ tcg/ppc/tcg-target.c.inc | 119 +++++++++++++++++++++++++++++----------
- accel/kvm/kvm-cpus.h                          |  2 -
+file changed, 88 insertions(+), 31 deletions(-)
  ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
  accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
  .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
  accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
  include/qemu/accel.h                          |  2 +
  include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
  include/sysemu/cpus.h                         | 26 ++--------
  .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
  target/i386/hax/hax-windows.h                 |  2 +-
  .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
  .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
  accel/accel-common.c                          | 11 +++++
  accel/accel-softmmu.c                         | 44 +++++++++++++++--
  accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
  accel/kvm/kvm-all.c                           |  2 -
  accel/qtest/qtest.c                           | 23 ++++++---
  ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
  ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
  .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
  accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
  accel/tcg/tcg-all.c                           | 12 -----
  accel/xen/xen-all.c                           | 24 ++++++----
  bsd-user/main.c                               |  3 +-
  linux-user/main.c                             |  1 +
  softmmu/cpus.c                                | 12 ++---
  softmmu/vl.c                                  |  7 ++-
  .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
  target/i386/hax/hax-all.c                     |  5 +-
  target/i386/hax/hax-mem.c                     |  2 +-
  target/i386/hax/hax-posix.c                   |  2 +-
  target/i386/hax/hax-windows.c                 |  2 +-
  .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
  target/i386/hvf/hvf.c                         |  3 +-
  target/i386/hvf/x86hvf.c                      |  2 +-
  .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
  target/i386/whpx/whpx-all.c                   |  7 +--
  MAINTAINERS                                   |  3 +-
  accel/kvm/meson.build                         |  2 +-
  accel/tcg/meson.build                         |  8 ++--
  target/i386/hax/meson.build                   |  2 +-
  target/i386/hvf/meson.build                   |  2 +-
  target/i386/whpx/meson.build                  |  2 +-
 files changed, 361 insertions(+), 163 deletions(-)
  create mode 100644 accel/accel-softmmu.h
  rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
  create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
  rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
  rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
  create mode 100644 include/sysemu/accel-ops.h
  rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
  rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
  rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
  rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
  rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
  rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
  rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
  rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
  rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
  rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
  rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)
-diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
+diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/accel-softmmu.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU System Emulation accel internal functions
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_SOFTMMU_H
 +#define ACCEL_SOFTMMU_H
 +
 +void accel_init_ops_interfaces(AccelClass *ac);
 +
 +#endif /* ACCEL_SOFTMMU_H */
 diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
 index XXXXXXX..XXXXXXX 100644
---- a/accel/kvm/kvm-cpus.h
+--- a/tcg/ppc/tcg-target.c.inc
-+++ b/accel/kvm/kvm-cpus.h
++++ b/tcg/ppc/tcg-target.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
+     tcg_out32(s, insn);
  #include "sysemu/cpus.h"
 -extern const CpusAccel kvm_cpus;
 -
  int kvm_init_vcpu(CPUState *cpu, Error **errp);
  int kvm_cpu_exec(CPUState *cpu);
  void kvm_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
 similarity index 88%
 rename from accel/tcg/tcg-cpus-icount.h
 rename to accel/tcg/tcg-accel-ops-icount.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.h
 +++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
  void icount_prepare_for_run(CPUState *cpu);
  void icount_process_data(CPUState *cpu);
 +void icount_handle_interrupt(CPUState *cpu, int mask);
 +
  #endif /* TCG_CPUS_ICOUNT_H */
 diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU TCG Multi Threaded vCPUs implementation
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef TCG_CPUS_MTTCG_H
 +#define TCG_CPUS_MTTCG_H
 +
 +/* kick MTTCG vCPU thread */
 +void mttcg_kick_vcpu_thread(CPUState *cpu);
 +
 +/* start an mttcg vCPU thread */
 +void mttcg_start_vcpu_thread(CPUState *cpu);
 +
 +#endif /* TCG_CPUS_MTTCG_H */
 diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
 similarity index 100%
 rename from accel/tcg/tcg-cpus-rr.h
 rename to accel/tcg/tcg-accel-ops-rr.h
 diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
 similarity index 72%
 rename from accel/tcg/tcg-cpus.h
 rename to accel/tcg/tcg-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.h
 +++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel tcg_cpus_mttcg;
 -extern const CpusAccel tcg_cpus_icount;
 -extern const CpusAccel tcg_cpus_rr;
 -
  void tcg_cpus_destroy(CPUState *cpu);
  int tcg_cpus_exec(CPUState *cpu);
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
 +void tcg_handle_interrupt(CPUState *cpu, int mask);
  #endif /* TCG_CPUS_H */
 diff --git a/include/qemu/accel.h b/include/qemu/accel.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/accel.h
 +++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
  AccelClass *accel_find(const char *opt_name);
  AccelState *current_accel(void);
 +void accel_init_interfaces(AccelClass *ac);
 +
  #ifndef CONFIG_USER_ONLY
  int accel_init_machine(AccelState *accel, MachineState *ms);
 diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Accelerator OPS, used for cpus.c module
 + *
 + * Copyright 2021 SUSE LLC
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ACCEL_OPS_H
 +#define ACCEL_OPS_H
 +
 +#include "qom/object.h"
 +
 +#define ACCEL_OPS_SUFFIX "-ops"
 +#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
 +#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
 +
 +typedef struct AccelOpsClass AccelOpsClass;
 +DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
 +
 +/* cpus.c operations interface */
 +struct AccelOpsClass {
 +    /*< private >*/
 +    ObjectClass parent_class;
 +    /*< public >*/
 +
 +    /* initialization function called when accel is chosen */
 +    void (*ops_init)(AccelOpsClass *ops);
 +
 +    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
 +    void (*kick_vcpu_thread)(CPUState *cpu);
 +
 +    void (*synchronize_post_reset)(CPUState *cpu);
 +    void (*synchronize_post_init)(CPUState *cpu);
 +    void (*synchronize_state)(CPUState *cpu);
 +    void (*synchronize_pre_loadvm)(CPUState *cpu);
 +
 +    void (*handle_interrupt)(CPUState *cpu, int mask);
 +
 +    int64_t (*get_virtual_clock)(void);
 +    int64_t (*get_elapsed_ticks)(void);
 +};
 +
 +#endif /* ACCEL_OPS_H */
 diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/cpus.h
 +++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_CPUS_H
  #include "qemu/timer.h"
 +#include "sysemu/accel-ops.h"
 -/* cpus.c */
 +/* register accel-specific operations */
 +void cpus_register_accel(const AccelOpsClass *i);
 -/* CPU execution threads */
 +/* accel/dummy-cpus.c */
 -typedef struct CpusAccel {
 -    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
 -    void (*kick_vcpu_thread)(CPUState *cpu);
 -
 -    void (*synchronize_post_reset)(CPUState *cpu);
 -    void (*synchronize_post_init)(CPUState *cpu);
 -    void (*synchronize_state)(CPUState *cpu);
 -    void (*synchronize_pre_loadvm)(CPUState *cpu);
 -
 -    void (*handle_interrupt)(CPUState *cpu, int mask);
 -
 -    int64_t (*get_virtual_clock)(void);
 -    int64_t (*get_elapsed_ticks)(void);
 -} CpusAccel;
 -
 -/* register accel-specific cpus interface implementation */
 -void cpus_register_accel(const CpusAccel *i);
 -
 -/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
 +/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
  void dummy_start_vcpu_thread(CPUState *);
  /* interface available for cpus accelerator threads */
 diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
 similarity index 95%
 rename from target/i386/hax/hax-cpus.h
 rename to target/i386/hax/hax-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.h
 +++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hax_cpus;
 -
  #include "hax-interface.h"
  #include "hax-i386.h"
 diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.h
 +++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
  #include <winioctl.h>
  #include <windef.h>
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
 similarity index 94%
 rename from target/i386/hvf/hvf-cpus.h
 rename to target/i386/hvf/hvf-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.h
 +++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel hvf_cpus;
 -
  int hvf_init_vcpu(CPUState *);
  int hvf_vcpu_exec(CPUState *);
  void hvf_cpu_synchronize_state(CPUState *);
 diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
 similarity index 96%
 rename from target/i386/whpx/whpx-cpus.h
 rename to target/i386/whpx/whpx-accel-ops.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.h
 +++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
 -extern const CpusAccel whpx_cpus;
 -
  int whpx_init_vcpu(CPUState *cpu);
  int whpx_vcpu_exec(CPUState *cpu);
  void whpx_destroy_vcpu(CPUState *cpu);
 diff --git a/accel/accel-common.c b/accel/accel-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/accel-common.c
 +++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/accel.h"
 +#ifndef CONFIG_USER_ONLY
 +#include "accel-softmmu.h"
 +#endif /* !CONFIG_USER_ONLY */
 +
  static const TypeInfo accel_type = {
      .name = TYPE_ACCEL,
      .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
      return ac;
  }
-+void accel_init_interfaces(AccelClass *ac)
++static inline uint64_t make_pair(tcg_insn_unit i1, tcg_insn_unit i2)
 +{
-+#ifndef CONFIG_USER_ONLY
++    if (HOST_BIG_ENDIAN) {
-+    accel_init_ops_interfaces(ac);
++        return (uint64_t)i1 << 32 | i2;
-+#endif /* !CONFIG_USER_ONLY */
++    }
 +    return (uint64_t)i2 << 32 | i1;
 +}
 +
- static void register_accel_types(void)
++static inline void ppc64_replace2(uintptr_t rx, uintptr_t rw,
- {
++                                  tcg_insn_unit i0, tcg_insn_unit i1)
-     type_register_static(&accel_type);
++{
-diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
++#if TCG_TARGET_REG_BITS == 64
-index XXXXXXX..XXXXXXX 100644
++    qatomic_set((uint64_t *)rw, make_pair(i0, i1));
---- a/accel/accel-softmmu.c
++    flush_idcache_range(rx, rw, 8);
-+++ b/accel/accel-softmmu.c
++#else
-@@ -XXX,XX +XXX,XX @@
++    qemu_build_not_reached();
- #include "qemu/osdep.h"
++#endif
- #include "qemu/accel.h"
++}
  #include "hw/boards.h"
 -#include "sysemu/arch_init.h"
 -#include "sysemu/sysemu.h"
 -#include "qom/object.h"
 +#include "sysemu/cpus.h"
 +
-+#include "accel-softmmu.h"
++static inline void ppc64_replace4(uintptr_t rx, uintptr_t rw,
++                                  tcg_insn_unit i0, tcg_insn_unit i1,
- int accel_init_machine(AccelState *accel, MachineState *ms)
++                                  tcg_insn_unit i2, tcg_insn_unit i3)
- {
++{
-@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
++    uint64_t p[2];
          acc->setup_post(ms, accel);
      }
  }
 +
-+/* initialize the arch-independent accel operation interfaces */
++    p[!HOST_BIG_ENDIAN] = make_pair(i0, i1);
-+void accel_init_ops_interfaces(AccelClass *ac)
++    p[HOST_BIG_ENDIAN] = make_pair(i2, i3);
 +{
 +    const char *ac_name;
 +    char *ops_name;
 +    AccelOpsClass *ops;
 +
 +    ac_name = object_class_get_name(OBJECT_CLASS(ac));
 +    g_assert(ac_name != NULL);
 +
 +    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
 +    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
 +    g_free(ops_name);
 +
 +    /*
-+     * all accelerators need to define ops, providing at least a mandatory
++     * There's no convenient way to get the compiler to allocate a pair
-+     * non-NULL create_vcpu_thread operation.
++     * of registers at an even index, so copy into r6/r7 and clobber.
 +     */
-+    g_assert(ops != NULL);
++    asm("mr  %%r6, %1\n\t"
-+    if (ops->ops_init) {
++        "mr  %%r7, %2\n\t"
-+        ops->ops_init(ops);
++        "stq %%r6, %0"
-+    }
++        : "=Q"(*(__int128 *)rw) : "r"(p[0]), "r"(p[1]) : "r6", "r7");
-+    cpus_register_accel(ops);
++    flush_idcache_range(rx, rw, 16);
 +}
 +
-+static const TypeInfo accel_ops_type_info = {
+ void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
-+    .name = TYPE_ACCEL_OPS,
+                               uintptr_t jmp_rw, uintptr_t addr)
-+    .parent = TYPE_OBJECT,
+ {
-+    .abstract = true,
+-    if (TCG_TARGET_REG_BITS == 64) {
-+    .class_size = sizeof(AccelOpsClass),
+-        tcg_insn_unit i1, i2;
-+};
+-        intptr_t tb_diff = addr - tc_ptr;
 -        intptr_t br_diff = addr - (jmp_rx + 4);
 -        uint64_t pair;
 +    tcg_insn_unit i0, i1, i2, i3;
 +    intptr_t tb_diff = addr - tc_ptr;
 +    intptr_t br_diff = addr - (jmp_rx + 4);
 +    intptr_t lo, hi;
 -        /* This does not exercise the range of the branch, but we do
 -           still need to be able to load the new value of TCG_REG_TB.
 -           But this does still happen quite often.  */
 -        if (tb_diff == (int16_t)tb_diff) {
 -            i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
 -            i2 = B | (br_diff & 0x3fffffc);
 -        } else {
 -            intptr_t lo = (int16_t)tb_diff;
 -            intptr_t hi = (int32_t)(tb_diff - lo);
 -            assert(tb_diff == hi + lo);
 -            i1 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
 -            i2 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
 -        }
 -#if HOST_BIG_ENDIAN
 -        pair = (uint64_t)i1 << 32 | i2;
 -#else
 -        pair = (uint64_t)i2 << 32 | i1;
 -#endif
 -
 -        /* As per the enclosing if, this is ppc64.  Avoid the _Static_assert
 -           within qatomic_set that would fail to build a ppc32 host.  */
 -        qatomic_set__nocheck((uint64_t *)jmp_rw, pair);
 -        flush_idcache_range(jmp_rx, jmp_rw, 8);
 -    } else {
 +    if (TCG_TARGET_REG_BITS == 32) {
          intptr_t diff = addr - jmp_rx;
          tcg_debug_assert(in_range_b(diff));
          qatomic_set((uint32_t *)jmp_rw, B | (diff & 0x3fffffc));
          flush_idcache_range(jmp_rx, jmp_rw, 4);
 +        return;
      }
 +
-+static void accel_softmmu_register_types(void)
++    /*
-+{
++     * For 16-bit displacements, we can use a single add + branch.
-+    type_register_static(&accel_ops_type_info);
++     * This happens quite often.
-+}
++     */
-+type_init(accel_softmmu_register_types);
++    if (tb_diff == (int16_t)tb_diff) {
-diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
++        i0 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
-similarity index 72%
++        i1 = B | (br_diff & 0x3fffffc);
-rename from accel/kvm/kvm-cpus.c
++        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
-rename to accel/kvm/kvm-accel-ops.c
++        return;
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/accel/kvm/kvm-cpus.c
++
-+++ b/accel/kvm/kvm-accel-ops.c
++    lo = (int16_t)tb_diff;
-@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
++    hi = (int32_t)(tb_diff - lo);
-                        cpu, QEMU_THREAD_JOINABLE);
++    assert(tb_diff == hi + lo);
 +    i0 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
 +    i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
 +
 +    /*
 +     * Without stq from 2.07, we can only update two insns,
 +     * and those must be the ones that load the target address.
 +     */
 +    if (!have_isa_2_07) {
 +        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
 +        return;
 +    }
 +
 +    /*
 +     * For 26-bit displacements, we can use a direct branch.
 +     * Otherwise we still need the indirect branch, which we
 +     * must restore after a potential direct branch write.
 +     */
 +    br_diff -= 4;
 +    if (in_range_b(br_diff)) {
 +        i2 = B | (br_diff & 0x3fffffc);
 +        i3 = NOP;
 +    } else {
 +        i2 = MTSPR | RS(TCG_REG_TB) | CTR;
 +        i3 = BCCTR | BO_ALWAYS;
 +    }
 +    ppc64_replace4(jmp_rx, jmp_rw, i0, i1, i2, i3);
  }
--const CpusAccel kvm_cpus = {
+ static void tcg_out_call_int(TCGContext *s, int lk,
--    .create_vcpu_thread = kvm_start_vcpu_thread,
+@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
-+static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+         if (s->tb_jmp_insn_offset) {
-+{
+             /* Direct jump. */
-+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+             if (TCG_TARGET_REG_BITS == 64) {
+-                /* Ensure the next insns are 8-byte aligned. */
--    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
+-                if ((uintptr_t)s->code_ptr & 7) {
--    .synchronize_post_init = kvm_cpu_synchronize_post_init,
++                /* Ensure the next insns are 8 or 16-byte aligned. */
--    .synchronize_state = kvm_cpu_synchronize_state,
++                while ((uintptr_t)s->code_ptr & (have_isa_2_07 ? 15 : 7)) {
--    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
+                     tcg_out32(s, NOP);
-+    ops->create_vcpu_thread = kvm_start_vcpu_thread;
+                 }
-+    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
+                 s->tb_jmp_insn_offset[args[0]] = tcg_current_code_size(s);
 +    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
 +    ops->synchronize_state = kvm_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo kvm_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("kvm"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = kvm_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void kvm_accel_ops_register_types(void)
 +{
 +    type_register_static(&kvm_accel_ops_type);
 +}
 +type_init(kvm_accel_ops_register_types);
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
          ret = ram_block_discard_disable(true);
          assert(!ret);
      }
 -
 -    cpus_register_accel(&kvm_cpus);
      return 0;
  err:
 diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/qtest/qtest.c
 +++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/main-loop.h"
  #include "hw/core/cpu.h"
 -const CpusAccel qtest_cpus = {
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -    .get_virtual_clock = qtest_get_virtual_clock,
 -};
 -
  static int qtest_init_accel(MachineState *ms)
  {
 -    cpus_register_accel(&qtest_cpus);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
      .class_init = qtest_accel_class_init,
  };
 +static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +    ops->get_virtual_clock = qtest_get_virtual_clock;
 +};
 +
 +static const TypeInfo qtest_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("qtest"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = qtest_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void qtest_type_init(void)
  {
      type_register_static(&qtest_accel_type);
 +    type_register_static(&qtest_accel_ops_type);
  }
  type_init(qtest_type_init);
 diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
 similarity index 89%
 rename from accel/tcg/tcg-cpus-icount.c
 rename to accel/tcg/tcg-accel-ops-icount.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-icount.c
 +++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-icount.h"
 -#include "tcg-cpus-rr.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-icount.h"
 +#include "tcg-accel-ops-rr.h"
  static int64_t icount_get_limit(void)
  {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
      /*
       * These should always be cleared by icount_process_data after
       * each vCPU execution. However u16.high can be raised
 -     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
 +     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
       */
      g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
      g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
      replay_mutex_unlock();
  }
 -static void icount_handle_interrupt(CPUState *cpu, int mask)
 +void icount_handle_interrupt(CPUState *cpu, int mask)
  {
      int old_mask = cpu->interrupt_request;
 -    tcg_cpus_handle_interrupt(cpu, mask);
 +    tcg_handle_interrupt(cpu, mask);
      if (qemu_cpu_is_self(cpu) &&
          !cpu->can_do_io
          && (mask & ~old_mask) != 0) {
          cpu_abort(cpu, "Raised interrupt while not in I/O function");
      }
  }
 -
 -const CpusAccel tcg_cpus_icount = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = icount_handle_interrupt,
 -    .get_virtual_clock = icount_get,
 -    .get_elapsed_ticks = icount_get,
 -};
 diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
 similarity index 92%
 rename from accel/tcg/tcg-cpus-mttcg.c
 rename to accel/tcg/tcg-accel-ops-mttcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-mttcg.c
 +++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
  /*
   * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
      return NULL;
  }
 -static void mttcg_kick_vcpu_thread(CPUState *cpu)
 +void mttcg_kick_vcpu_thread(CPUState *cpu)
  {
      cpu_exit(cpu);
  }
 -static void mttcg_start_vcpu_thread(CPUState *cpu)
 +void mttcg_start_vcpu_thread(CPUState *cpu)
  {
      char thread_name[VCPU_THREAD_NAME_SIZE];
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
      cpu->hThread = qemu_thread_get_handle(cpu->thread);
  #endif
  }
 -
 -const CpusAccel tcg_cpus_mttcg = {
 -    .create_vcpu_thread = mttcg_start_vcpu_thread,
 -    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
 similarity index 97%
 rename from accel/tcg/tcg-cpus-rr.c
 rename to accel/tcg/tcg-accel-ops-rr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus-rr.c
 +++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 -#include "tcg-cpus-rr.h"
 -#include "tcg-cpus-icount.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* Kick all RR vCPUs */
  void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
          cpu->created = true;
      }
  }
 -
 -const CpusAccel tcg_cpus_rr = {
 -    .create_vcpu_thread = rr_start_vcpu_thread,
 -    .kick_vcpu_thread = rr_kick_vcpu_thread,
 -
 -    .handle_interrupt = tcg_cpus_handle_interrupt,
 -};
 diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
 similarity index 63%
 rename from accel/tcg/tcg-cpus.c
 rename to accel/tcg/tcg-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-cpus.c
 +++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/exec-all.h"
  #include "hw/boards.h"
 -#include "tcg-cpus.h"
 +#include "tcg-accel-ops.h"
 +#include "tcg-accel-ops-mttcg.h"
 +#include "tcg-accel-ops-rr.h"
 +#include "tcg-accel-ops-icount.h"
  /* common functionality among all TCG variants */
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
  }
  /* mask must never be zero, except for A20 change call */
 -void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
 +void tcg_handle_interrupt(CPUState *cpu, int mask)
  {
      g_assert(qemu_mutex_iothread_locked());
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
          qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
      }
  }
 +
 +static void tcg_accel_ops_init(AccelOpsClass *ops)
 +{
 +    if (qemu_tcg_mttcg_enabled()) {
 +        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
 +        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    } else if (icount_enabled()) {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = icount_handle_interrupt;
 +        ops->get_virtual_clock = icount_get;
 +        ops->get_elapsed_ticks = icount_get;
 +    } else {
 +        ops->create_vcpu_thread = rr_start_vcpu_thread;
 +        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
 +        ops->handle_interrupt = tcg_handle_interrupt;
 +    }
 +}
 +
 +static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->ops_init = tcg_accel_ops_init;
 +}
 +
 +static const TypeInfo tcg_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("tcg"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = tcg_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
 +static void tcg_accel_ops_register_types(void)
 +{
 +    type_register_static(&tcg_accel_ops_type);
 +}
 +type_init(tcg_accel_ops_register_types);
 diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-all.c
 +++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "qapi/qapi-builtin-visit.h"
 -#ifndef CONFIG_USER_ONLY
 -#include "tcg-cpus.h"
 -#endif /* CONFIG_USER_ONLY */
 -
  struct TCGState {
      AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
       */
  #ifndef CONFIG_USER_ONLY
      tcg_region_init();
 -
 -    if (mttcg_enabled) {
 -        cpus_register_accel(&tcg_cpus_mttcg);
 -    } else if (icount_enabled()) {
 -        cpus_register_accel(&tcg_cpus_icount);
 -    } else {
 -        cpus_register_accel(&tcg_cpus_rr);
 -    }
  #endif /* !CONFIG_USER_ONLY */
      return 0;
 diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/xen/xen-all.c
 +++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
      }
  }
 -const CpusAccel xen_cpus = {
 -    .create_vcpu_thread = dummy_start_vcpu_thread,
 -};
 -
  static int xen_init(MachineState *ms)
  {
      MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
       * opt out of system RAM being allocated by generic code
       */
      mc->default_ram_id = NULL;
 -
 -    cpus_register_accel(&xen_cpus);
 -
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
      .class_init = xen_accel_class_init,
  };
 +static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 +
 +    ops->create_vcpu_thread = dummy_start_vcpu_thread;
 +}
 +
 +static const TypeInfo xen_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("xen"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = xen_accel_ops_class_init,
 +    .abstract = true,
 +};
 +
  static void xen_type_init(void)
  {
      type_register_static(&xen_accel_type);
 +    type_register_static(&xen_accel_ops_type);
  }
 -
  type_init(xen_type_init);
 diff --git a/bsd-user/main.c b/bsd-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/bsd-user/main.c
 +++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
  #endif
      }
 +    cpu_type = parse_cpu_option(cpu_model);
      /* init tcg before creating CPUs and to get qemu_host_page_size */
      {
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
 -    cpu_type = parse_cpu_option(cpu_model);
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
  #if defined(TARGET_SPARC) || defined(TARGET_PPC)
 diff --git a/linux-user/main.c b/linux-user/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/main.c
 +++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          AccelClass *ac = ACCEL_GET_CLASS(current_accel());
          ac->init_machine(NULL);
 +        accel_init_interfaces(ac);
      }
      cpu = cpu_create(cpu_type);
      env = cpu->env_ptr;
 diff --git a/softmmu/cpus.c b/softmmu/cpus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/cpus.c
 +++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
  /*
   * The chosen accelerator is supposed to register this.
   */
 -static const CpusAccel *cpus_accel;
 +static const AccelOpsClass *cpus_accel;
  void cpu_synchronize_all_states(void)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
      qemu_mutex_lock_iothread();
  }
 -void cpus_register_accel(const CpusAccel *ca)
 +void cpus_register_accel(const AccelOpsClass *ops)
  {
 -    assert(ca != NULL);
 -    assert(ca->create_vcpu_thread != NULL); /* mandatory */
 -    cpus_accel = ca;
 +    assert(ops != NULL);
 +    assert(ops->create_vcpu_thread != NULL); /* mandatory */
 +    cpus_accel = ops;
  }
  void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
          cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
      }
 -    /* accelerators all implement the CpusAccel interface */
 +    /* accelerators all implement the AccelOpsClass */
      g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
      cpus_accel->create_vcpu_thread(cpu);
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
          return false;
      }
 -    /* Allocation of large amounts of memory may delay
 +    /*
 +     * Allocation of large amounts of memory may delay
       * chardev initialization for too long, and trigger timeouts
       * on software that waits for a monitor socket to be created
       * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
       *
       * Machine compat properties: object_set_machine_compat_props().
       * Accelerator compat props: object_set_accelerator_compat_props(),
 -     * called from configure_accelerator().
 +     * called from do_configure_accelerator().
       */
      machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      if (cpu_option) {
          current_machine->cpu_type = parse_cpu_option(cpu_option);
      }
 +    /* NB: for machine none cpu_type could STILL be NULL here! */
 +    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
      qemu_resolve_machine_memdev();
      parse_numa_opts(current_machine);
 diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
 similarity index 69%
 rename from target/i386/hax/hax-cpus.c
 rename to target/i386/hax/hax-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-cpus.c
 +++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/cpus.h"
  #include "qemu/guest-random.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  static void *hax_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
  #endif
  }
 -const CpusAccel hax_cpus = {
 -    .create_vcpu_thread = hax_start_vcpu_thread,
 -    .kick_vcpu_thread = hax_kick_vcpu_thread,
 +static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hax_cpu_synchronize_post_init,
 -    .synchronize_state = hax_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hax_start_vcpu_thread;
 +    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
 +    ops->synchronize_state = hax_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo hax_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hax"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hax_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void hax_accel_ops_register_types(void)
 +{
 +    type_register_static(&hax_accel_ops_type);
 +}
 +type_init(hax_accel_ops_register_types);
 diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-all.c
 +++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/runstate.h"
  #include "hw/boards.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #define DEBUG_HAX 0
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                  !ret ? "working" : "not working",
                  !ret ? "fast virt" : "emulation");
      }
 -    if (ret == 0) {
 -        cpus_register_accel(&hax_cpus);
 -    }
      return ret;
  }
 diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-mem.c
 +++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/error-report.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  #include "qemu/queue.h"
  #define DEBUG_HAX_MEM 0
 diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-posix.c
 +++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
  #include <sys/ioctl.h>
  #include "sysemu/cpus.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  hax_fd hax_mod_open(void)
  {
 diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/hax-windows.c
 +++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
 -#include "hax-cpus.h"
 +#include "hax-accel-ops.h"
  /*
   * return 0 when success, -1 when driver not loaded,
 diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
 similarity index 84%
 rename from target/i386/hvf/hvf-cpus.c
 rename to target/i386/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf-cpus.c
 +++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "target/i386/cpu.h"
  #include "qemu/guest-random.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  /*
   * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                         cpu, QEMU_THREAD_JOINABLE);
  }
 -const CpusAccel hvf_cpus = {
 -    .create_vcpu_thread = hvf_start_vcpu_thread,
 +static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
 -    .synchronize_post_init = hvf_cpu_synchronize_post_init,
 -    .synchronize_state = hvf_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = hvf_start_vcpu_thread;
 +
 +    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
 +    ops->synchronize_state = hvf_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
  };
 +static const TypeInfo hvf_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("hvf"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = hvf_accel_ops_class_init,
 +    .abstract = true,
 +};
 +static void hvf_accel_ops_register_types(void)
 +{
 +    type_register_static(&hvf_accel_ops_type);
 +}
 +type_init(hvf_accel_ops_register_types);
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/accel.h"
  #include "target/i386/cpu.h"
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  HVFState *hvf_state;
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
      hvf_state = s;
      memory_listener_register(&hvf_memory_listener, &address_space_memory);
 -    cpus_register_accel(&hvf_cpus);
      return 0;
  }
 diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/x86hvf.c
 +++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
  #include <Hypervisor/hv.h>
  #include <Hypervisor/hv_vmx.h>
 -#include "hvf-cpus.h"
 +#include "hvf-accel-ops.h"
  void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                       SegmentCache *qseg, bool is_tr)
 diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
 similarity index 71%
 rename from target/i386/whpx/whpx-cpus.c
 rename to target/i386/whpx/whpx-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-cpus.c
 +++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/whpx.h"
  #include "whpx-internal.h"
 -#include "whpx-cpus.h"
 +#include "whpx-accel-ops.h"
  static void *whpx_cpu_thread_fn(void *arg)
  {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
      }
  }
 -const CpusAccel whpx_cpus = {
 -    .create_vcpu_thread = whpx_start_vcpu_thread,
 -    .kick_vcpu_thread = whpx_kick_vcpu_thread,
 +static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
 +{
 +    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 -    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
 -    .synchronize_post_init = whpx_cpu_synchronize_post_init,
 -    .synchronize_state = whpx_cpu_synchronize_state,
 -    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
 +    ops->create_vcpu_thread = whpx_start_vcpu_thread;
 +    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
 +
 +    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
 +    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
 +    ops->synchronize_state = whpx_cpu_synchronize_state;
 +    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
 +}
 +
 +static const TypeInfo whpx_accel_ops_type = {
 +    .name = ACCEL_OPS_NAME("whpx"),
 +
 +    .parent = TYPE_ACCEL_OPS,
 +    .class_init = whpx_accel_ops_class_init,
 +    .abstract = true,
  };
 +
 +static void whpx_accel_ops_register_types(void)
 +{
 +    type_register_static(&whpx_accel_ops_type);
 +}
 +type_init(whpx_accel_ops_register_types);
 diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/whpx-all.c
 +++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/blocker.h"
  #include <winerror.h>
 -#include "whpx-cpus.h"
  #include "whpx-internal.h"
 +#include "whpx-accel-ops.h"
 +
 +#include <WinHvPlatform.h>
 +#include <WinHvEmulation.h>
  #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
      whpx_memory_init();
 -    cpus_register_accel(&whpx_cpus);
 -
      printf("Windows Hypervisor Platform accelerator is operational\n");
      return 0;
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
  R: Paolo Bonzini <pbonzini@redhat.com>
  S: Maintained
  F: include/qemu/accel.h
 -F: accel/accel.c
 +F: include/sysemu/accel-ops.h
 +F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/meson.build
 +++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
  kvm_ss = ss.source_set()
  kvm_ss.add(files(
    'kvm-all.c',
 -  'kvm-cpus.c',
 +  'kvm-accel-ops.c',
  ))
  kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/meson.build
 +++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
  specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
    'cputlb.c',
 -  'tcg-cpus.c',
 -  'tcg-cpus-mttcg.c',
 -  'tcg-cpus-icount.c',
 -  'tcg-cpus-rr.c'
 +  'tcg-accel-ops.c',
 +  'tcg-accel-ops-mttcg.c',
 +  'tcg-accel-ops-icount.c',
 +  'tcg-accel-ops-rr.c'
  ))
 diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hax/meson.build
 +++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
    'hax-all.c',
    'hax-mem.c',
 -  'hax-cpus.c',
 +  'hax-accel-ops.c',
  ))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
  i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
 diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/meson.build
 +++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
    'hvf.c',
 -  'hvf-cpus.c',
 +  'hvf-accel-ops.c',
    'x86.c',
    'x86_cpuid.c',
    'x86_decode.c',
 diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/whpx/meson.build
 +++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
  i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
    'whpx-all.c',
    'whpx-apic.c',
 -  'whpx-cpus.c',
 +  'whpx-accel-ops.c',
  ))
 --
-.25.1
+.34.1

-[PULL 33/46] cpu: Move cpu_exec_* to tcg_ops
+[PULL 20/20] target/sh4: Fix TB_FLAG_UNALIGN
-From: Eduardo Habkost <ehabkost@redhat.com>
+The value previously chosen overlaps GUSA_MASK.
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Rename all DELAY_SLOT_* and GUSA_* defines to emphasize
-[claudio: wrapped target code in CONFIG_TCG]
+that they are included in TB_FLAGs.  Add aliases for the
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+FPSCR and SR bits that are included in TB_FLAGS, so that
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+we don't accidentally reassign those bits.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Fixes: 4da06fb3062 ("target/sh4: Implement prctl_unalign_sigbus")
-Message-Id: <20210204163931.7358-6-cfontana@suse.de>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/856
 Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/core/cpu.h           | 12 ++++++------
+ target/sh4/cpu.h        | 56 +++++++++++++------------
- accel/tcg/cpu-exec.c            | 12 ++++++------
+ linux-user/sh4/signal.c |  6 +--
- target/alpha/cpu.c              |  2 +-
+ target/sh4/cpu.c        |  6 +--
- target/arm/cpu.c                |  2 +-
+ target/sh4/helper.c     |  6 +--
- target/arm/cpu64.c              |  5 ++++-
+ target/sh4/translate.c  | 90 ++++++++++++++++++++++-------------------
- target/arm/cpu_tcg.c            |  7 ++++++-
+files changed, 88 insertions(+), 76 deletions(-)
  target/avr/cpu.c                |  2 +-
  target/cris/cpu.c               |  2 +-
  target/hppa/cpu.c               |  2 +-
  target/i386/tcg/tcg-cpu.c       |  6 +++---
  target/lm32/cpu.c               |  2 +-
  target/m68k/cpu.c               |  2 +-
  target/microblaze/cpu.c         |  2 +-
  target/mips/cpu.c               |  2 +-
  target/nios2/cpu.c              |  2 +-
  target/openrisc/cpu.c           |  2 +-
  target/riscv/cpu.c              |  2 +-
  target/rx/cpu.c                 |  2 +-
  target/s390x/cpu.c              |  2 +-
  target/sh4/cpu.c                |  2 +-
  target/sparc/cpu.c              |  2 +-
  target/tilegx/cpu.c             |  2 +-
  target/unicore32/cpu.c          |  2 +-
  target/xtensa/cpu.c             |  2 +-
  target/ppc/translate_init.c.inc | 16 ++++++++++------
 files changed, 54 insertions(+), 42 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
+--- a/target/sh4/cpu.h
-+++ b/include/hw/core/cpu.h
++++ b/target/sh4/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
+@@ -XXX,XX +XXX,XX @@
-      */
+ #define FPSCR_RM_NEAREST       (0 << 0)
-     void (*synchronize_from_tb)(CPUState *cpu,
+ #define FPSCR_RM_ZERO          (1 << 0)
-                                 const struct TranslationBlock *tb);
-+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+-#define DELAY_SLOT_MASK        0x7
-+    void (*cpu_exec_enter)(CPUState *cpu);
+-#define DELAY_SLOT             (1 << 0)
-+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+-#define DELAY_SLOT_CONDITIONAL (1 << 1)
-+    void (*cpu_exec_exit)(CPUState *cpu);
+-#define DELAY_SLOT_RTE         (1 << 2)
-+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
++#define TB_FLAG_DELAY_SLOT       (1 << 0)
-+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
++#define TB_FLAG_DELAY_SLOT_COND  (1 << 1)
++#define TB_FLAG_DELAY_SLOT_RTE   (1 << 2)
- } TcgCpuOperations;
++#define TB_FLAG_PENDING_MOVCA    (1 << 3)
++#define TB_FLAG_GUSA_SHIFT       4                      /* [11:4] */
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
++#define TB_FLAG_GUSA_EXCLUSIVE   (1 << 12)
-  * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
++#define TB_FLAG_UNALIGN          (1 << 13)
-  *   gdb stub. Returns a pointer to the XML contents for the specified XML file
++#define TB_FLAG_SR_FD            (1 << SR_FD)           /* 15 */
-  *   or NULL if the CPU doesn't have a dynamically generated content for it.
++#define TB_FLAG_FPSCR_PR         FPSCR_PR               /* 19 */
-- * @cpu_exec_enter: Callback for cpu_exec preparation.
++#define TB_FLAG_FPSCR_SZ         FPSCR_SZ               /* 20 */
-- * @cpu_exec_exit: Callback for cpu_exec cleanup.
++#define TB_FLAG_FPSCR_FR         FPSCR_FR               /* 21 */
-- * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
++#define TB_FLAG_SR_RB            (1 << SR_RB)           /* 29 */
-  * @disas_set_info: Setup architecture specific components of disassembly info
++#define TB_FLAG_SR_MD            (1 << SR_MD)           /* 30 */
-  * @adjust_watchpoint_address: Perform a target-specific adjustment to an
-  * address before attempting to match it against watchpoints.
+-#define TB_FLAG_PENDING_MOVCA  (1 << 3)
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
+-#define TB_FLAG_UNALIGN        (1 << 4)
-     const char *gdb_core_xml_file;
+-
-     gchar * (*gdb_arch_name)(CPUState *cpu);
+-#define GUSA_SHIFT             4
-     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
+-#ifdef CONFIG_USER_ONLY
--    void (*cpu_exec_enter)(CPUState *cpu);
+-#define GUSA_EXCLUSIVE         (1 << 12)
--    void (*cpu_exec_exit)(CPUState *cpu);
+-#define GUSA_MASK              ((0xff << GUSA_SHIFT) | GUSA_EXCLUSIVE)
--    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+-#else
+-/* Provide dummy versions of the above to allow tests against tbflags
-     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
+-   to be elided while avoiding ifdefs.  */
-     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+-#define GUSA_EXCLUSIVE         0
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+-#define GUSA_MASK              0
 -#endif
 -
 -#define TB_FLAG_ENVFLAGS_MASK  (DELAY_SLOT_MASK | GUSA_MASK)
 +#define TB_FLAG_DELAY_SLOT_MASK  (TB_FLAG_DELAY_SLOT |       \
 +                                  TB_FLAG_DELAY_SLOT_COND |  \
 +                                  TB_FLAG_DELAY_SLOT_RTE)
 +#define TB_FLAG_GUSA_MASK        ((0xff << TB_FLAG_GUSA_SHIFT) | \
 +                                  TB_FLAG_GUSA_EXCLUSIVE)
 +#define TB_FLAG_FPSCR_MASK       (TB_FLAG_FPSCR_PR | \
 +                                  TB_FLAG_FPSCR_SZ | \
 +                                  TB_FLAG_FPSCR_FR)
 +#define TB_FLAG_SR_MASK          (TB_FLAG_SR_FD | \
 +                                  TB_FLAG_SR_RB | \
 +                                  TB_FLAG_SR_MD)
 +#define TB_FLAG_ENVFLAGS_MASK    (TB_FLAG_DELAY_SLOT_MASK | \
 +                                  TB_FLAG_GUSA_MASK)
  typedef struct tlb_t {
      uint32_t vpn;        /* virtual page number */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index (CPUSH4State *env, bool ifetch)
  {
      /* The instruction in a RTE delay slot is fetched in privileged
         mode, but executed in user mode.  */
 -    if (ifetch && (env->flags & DELAY_SLOT_RTE)) {
 +    if (ifetch && (env->flags & TB_FLAG_DELAY_SLOT_RTE)) {
          return 0;
      } else {
          return (env->sr & (1u << SR_MD)) == 0 ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
  {
      *pc = env->pc;
      /* For a gUSA region, notice the end of the region.  */
 -    *cs_base = env->flags & GUSA_MASK ? env->gregs[0] : 0;
 -    *flags = env->flags /* TB_FLAG_ENVFLAGS_MASK: bits 0-2, 4-12 */
 -            | (env->fpscr & (FPSCR_FR | FPSCR_SZ | FPSCR_PR))  /* Bits 19-21 */
 -            | (env->sr & ((1u << SR_MD) | (1u << SR_RB)))      /* Bits 29-30 */
 -            | (env->sr & (1u << SR_FD))                        /* Bit 15 */
 +    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
 +    *flags = env->flags
 +            | (env->fpscr & TB_FLAG_FPSCR_MASK)
 +            | (env->sr & TB_FLAG_SR_MASK)
              | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
  #ifdef CONFIG_USER_ONLY
      *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
 diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
+--- a/linux-user/sh4/signal.c
-+++ b/accel/tcg/cpu-exec.c
++++ b/linux-user/sh4/signal.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc)
- {
+     __get_user(regs->fpul, &sc->sc_fpul);
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+     regs->tra = -1;         /* disable syscall checks */
--    if (cc->cpu_exec_enter) {
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
--        cc->cpu_exec_enter(cpu);
++    regs->flags = 0;
 +    if (cc->tcg_ops.cpu_exec_enter) {
 +        cc->tcg_ops.cpu_exec_enter(cpu);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
+ void setup_frame(int sig, struct target_sigaction *ka,
- {
+@@ -XXX,XX +XXX,XX @@ void setup_frame(int sig, struct target_sigaction *ka,
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+     regs->gregs[5] = 0;
+     regs->gregs[6] = frame_addr += offsetof(typeof(*frame), sc);
--    if (cc->cpu_exec_exit) {
+     regs->pc = (unsigned long) ka->_sa_handler;
--        cc->cpu_exec_exit(cpu);
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
-+    if (cc->tcg_ops.cpu_exec_exit) {
++    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
-+        cc->tcg_ops.cpu_exec_exit(cpu);
-     }
+     unlock_user_struct(frame, frame_addr, 1);
- }
+     return;
+@@ -XXX,XX +XXX,XX @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
-@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
+     regs->gregs[5] = frame_addr + offsetof(typeof(*frame), info);
-            True when it is, and we should restart on a new TB,
+     regs->gregs[6] = frame_addr + offsetof(typeof(*frame), uc);
-            and via longjmp via cpu_loop_exit.  */
+     regs->pc = (unsigned long) ka->_sa_handler;
-         else {
+-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
--            if (cc->cpu_exec_interrupt &&
++    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
--                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
-+            if (cc->tcg_ops.cpu_exec_interrupt &&
+     unlock_user_struct(frame, frame_addr, 1);
-+                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
+     return;
                  if (need_replay_interrupt(interrupt_request)) {
                      replay_interrupt();
                  }
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = alpha_cpu_class_by_name;
      cc->has_work = alpha_cpu_has_work;
      cc->do_interrupt = alpha_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
      cc->dump_state = alpha_cpu_dump_state;
      cc->set_pc = alpha_cpu_set_pc;
      cc->gdb_read_register = alpha_cpu_gdb_read_register;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = arm_cpu_class_by_name;
      cc->has_work = arm_cpu_has_work;
 -    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->dump_state = arm_cpu_dump_state;
      cc->set_pc = arm_cpu_set_pc;
      cc->gdb_read_register = arm_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
      cc->disas_set_info = arm_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = arm_translate_init;
 +    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
      cc->tlb_fill = arm_cpu_tlb_fill;
      cc->debug_excp_handler = arm_debug_excp_handler;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
 -    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
 +#endif /* CONFIG_TCG */
 +
      cc->gdb_read_register = aarch64_cpu_gdb_read_register;
      cc->gdb_write_register = aarch64_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 34;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#ifdef CONFIG_TCG
  static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  {
      CPUClass *cc = CPU_GET_CLASS(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      }
      return ret;
  }
 +#endif /* CONFIG_TCG */
  static void arm926_initfn(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
      cc->do_interrupt = arm_v7m_cpu_do_interrupt;
  #endif
 -    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 +#ifdef CONFIG_TCG
 +    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
 +#endif /* CONFIG_TCG */
 +
      cc->gdb_core_xml_file = "arm-m-profile.xml";
  }
 diff --git a/target/avr/cpu.c b/target/avr/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/avr/cpu.c
 +++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = avr_cpu_has_work;
      cc->do_interrupt = avr_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
      cc->dump_state = avr_cpu_dump_state;
      cc->set_pc = avr_cpu_set_pc;
      cc->memory_rw_debug = avr_cpu_memory_rw_debug;
 diff --git a/target/cris/cpu.c b/target/cris/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/cris/cpu.c
 +++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = cris_cpu_class_by_name;
      cc->has_work = cris_cpu_has_work;
      cc->do_interrupt = cris_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
      cc->dump_state = cris_cpu_dump_state;
      cc->set_pc = cris_cpu_set_pc;
      cc->gdb_read_register = cris_cpu_gdb_read_register;
 diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/cpu.c
 +++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = hppa_cpu_class_by_name;
      cc->has_work = hppa_cpu_has_work;
      cc->do_interrupt = hppa_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
      cc->dump_state = hppa_cpu_dump_state;
      cc->set_pc = hppa_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
 diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/tcg-cpu.c
 +++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
  void tcg_cpu_common_class_init(CPUClass *cc)
  {
      cc->do_interrupt = x86_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
 -    cc->cpu_exec_enter = x86_cpu_exec_enter;
 -    cc->cpu_exec_exit = x86_cpu_exec_exit;
 +    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
 +    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
      cc->tcg_ops.initialize = tcg_x86_init;
      cc->tlb_fill = x86_cpu_tlb_fill;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/lm32/cpu.c
 +++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = lm32_cpu_class_by_name;
      cc->has_work = lm32_cpu_has_work;
      cc->do_interrupt = lm32_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
      cc->dump_state = lm32_cpu_dump_state;
      cc->set_pc = lm32_cpu_set_pc;
      cc->gdb_read_register = lm32_cpu_gdb_read_register;
 diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/m68k/cpu.c
 +++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = m68k_cpu_class_by_name;
      cc->has_work = m68k_cpu_has_work;
      cc->do_interrupt = m68k_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
      cc->dump_state = m68k_cpu_dump_state;
      cc->set_pc = m68k_cpu_set_pc;
      cc->gdb_read_register = m68k_cpu_gdb_read_register;
 diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/microblaze/cpu.c
 +++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
      cc->has_work = mb_cpu_has_work;
      cc->do_interrupt = mb_cpu_do_interrupt;
      cc->do_unaligned_access = mb_cpu_do_unaligned_access;
 -    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
      cc->dump_state = mb_cpu_dump_state;
      cc->set_pc = mb_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
 diff --git a/target/mips/cpu.c b/target/mips/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/cpu.c
 +++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = mips_cpu_class_by_name;
      cc->has_work = mips_cpu_has_work;
      cc->do_interrupt = mips_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->dump_state = mips_cpu_dump_state;
      cc->set_pc = mips_cpu_set_pc;
      cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
      cc->disas_set_info = mips_cpu_disas_set_info;
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = mips_tcg_init;
 +    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
      cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
      cc->tlb_fill = mips_cpu_tlb_fill;
  #endif
 diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/nios2/cpu.c
 +++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = nios2_cpu_class_by_name;
      cc->has_work = nios2_cpu_has_work;
      cc->do_interrupt = nios2_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
      cc->dump_state = nios2_cpu_dump_state;
      cc->set_pc = nios2_cpu_set_pc;
      cc->disas_set_info = nios2_cpu_disas_set_info;
 diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/openrisc/cpu.c
 +++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = openrisc_cpu_class_by_name;
      cc->has_work = openrisc_cpu_has_work;
      cc->do_interrupt = openrisc_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
      cc->dump_state = openrisc_cpu_dump_state;
      cc->set_pc = openrisc_cpu_set_pc;
      cc->gdb_read_register = openrisc_cpu_gdb_read_register;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->class_by_name = riscv_cpu_class_by_name;
      cc->has_work = riscv_cpu_has_work;
      cc->do_interrupt = riscv_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
      cc->dump_state = riscv_cpu_dump_state;
      cc->set_pc = riscv_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
      cc->class_by_name = rx_cpu_class_by_name;
      cc->has_work = rx_cpu_has_work;
      cc->do_interrupt = rx_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
      cc->dump_state = rx_cpu_dump_state;
      cc->set_pc = rx_cpu_set_pc;
      cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
 diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/cpu.c
 +++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
      cc->get_crash_info = s390_cpu_get_crash_info;
      cc->write_elf64_note = s390_cpu_write_elf64_note;
  #ifdef CONFIG_TCG
 -    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
      cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
      cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
  #endif
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
-     cc->class_by_name = superh_cpu_class_by_name;
+     SuperHCPU *cpu = SUPERH_CPU(cs);
-     cc->has_work = superh_cpu_has_work;
-     cc->do_interrupt = superh_cpu_do_interrupt;
+     cpu->env.pc = tb_pc(tb);
--    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
+-    cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
-+    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
++    cpu->env.flags = tb->flags;
-     cc->dump_state = superh_cpu_dump_state;
+ }
-     cc->set_pc = superh_cpu_set_pc;
-     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
+ #ifndef CONFIG_USER_ONLY
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
      SuperHCPU *cpu = SUPERH_CPU(cs);
      CPUSH4State *env = &cpu->env;
 -    if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
 +    if ((env->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND))
          && env->pc != tb_pc(tb)) {
          env->pc -= 2;
 -        env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
 +        env->flags &= ~(TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND);
          return true;
      }
      return false;
 diff --git a/target/sh4/helper.c b/target/sh4/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
+--- a/target/sh4/helper.c
-+++ b/target/sparc/cpu.c
++++ b/target/sh4/helper.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_interrupt(CPUState *cs)
-     cc->parse_features = sparc_cpu_parse_features;
+     env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
-     cc->has_work = sparc_cpu_has_work;
+     env->lock_addr = -1;
-     cc->do_interrupt = sparc_cpu_do_interrupt;
--    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
+-    if (env->flags & DELAY_SLOT_MASK) {
-+    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
++    if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
-     cc->dump_state = sparc_cpu_dump_state;
+         /* Branch instruction should be executed again before delay slot. */
- #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
+     env->spc -= 2;
-     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
+     /* Clear flags for exception/interrupt routine. */
-diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
+-        env->flags &= ~DELAY_SLOT_MASK;
 +        env->flags &= ~TB_FLAG_DELAY_SLOT_MASK;
      }
      if (do_exp) {
@@ -XXX,XX +XXX,XX @@ bool superh_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
          CPUSH4State *env = &cpu->env;
          /* Delay slots are indivisible, ignore interrupts */
 -        if (env->flags & DELAY_SLOT_MASK) {
 +        if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
              return false;
          } else {
              superh_cpu_do_interrupt(cs);
 diff --git a/target/sh4/translate.c b/target/sh4/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/tilegx/cpu.c
+--- a/target/sh4/translate.c
-+++ b/target/tilegx/cpu.c
++++ b/target/sh4/translate.c
-@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void superh_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-     cc->class_by_name = tilegx_cpu_class_by_name;
+             i, env->gregs[i], i + 1, env->gregs[i + 1],
-     cc->has_work = tilegx_cpu_has_work;
+             i + 2, env->gregs[i + 2], i + 3, env->gregs[i + 3]);
-     cc->do_interrupt = tilegx_cpu_do_interrupt;
+     }
--    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
+-    if (env->flags & DELAY_SLOT) {
-+    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
++    if (env->flags & TB_FLAG_DELAY_SLOT) {
-     cc->dump_state = tilegx_cpu_dump_state;
+         qemu_printf("in delay slot (delayed_pc=0x%08x)\n",
-     cc->set_pc = tilegx_cpu_set_pc;
+             env->delayed_pc);
-     cc->tlb_fill = tilegx_cpu_tlb_fill;
+-    } else if (env->flags & DELAY_SLOT_CONDITIONAL) {
-diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
++    } else if (env->flags & TB_FLAG_DELAY_SLOT_COND) {
-index XXXXXXX..XXXXXXX 100644
+         qemu_printf("in conditional delay slot (delayed_pc=0x%08x)\n",
---- a/target/unicore32/cpu.c
+             env->delayed_pc);
-+++ b/target/unicore32/cpu.c
+-    } else if (env->flags & DELAY_SLOT_RTE) {
-@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
++    } else if (env->flags & TB_FLAG_DELAY_SLOT_RTE) {
-     cc->class_by_name = uc32_cpu_class_by_name;
+         qemu_fprintf(f, "in rte delay slot (delayed_pc=0x%08x)\n",
-     cc->has_work = uc32_cpu_has_work;
+                      env->delayed_pc);
-     cc->do_interrupt = uc32_cpu_do_interrupt;
+     }
--    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
+@@ -XXX,XX +XXX,XX @@ static inline void gen_save_cpu_state(DisasContext *ctx, bool save_pc)
-+    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
-     cc->dump_state = uc32_cpu_dump_state;
+ static inline bool use_exit_tb(DisasContext *ctx)
-     cc->set_pc = uc32_cpu_set_pc;
+ {
-     cc->tlb_fill = uc32_cpu_tlb_fill;
+-    return (ctx->tbflags & GUSA_EXCLUSIVE) != 0;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
++    return (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) != 0;
 index XXXXXXX..XXXXXXX 100644
 --- a/target/xtensa/cpu.c
 +++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = xtensa_cpu_class_by_name;
      cc->has_work = xtensa_cpu_has_work;
      cc->do_interrupt = xtensa_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
 +    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
      cc->dump_state = xtensa_cpu_dump_state;
      cc->set_pc = xtensa_cpu_set_pc;
      cc->gdb_read_register = xtensa_cpu_gdb_read_register;
 diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/translate_init.c.inc
 +++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
  }
- #ifndef CONFIG_USER_ONLY
+ static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
-+
+@@ -XXX,XX +XXX,XX @@ static void gen_conditional_jump(DisasContext *ctx, target_ulong dest,
- static bool ppc_cpu_is_big_endian(CPUState *cs)
+     TCGLabel *l1 = gen_new_label();
      TCGCond cond_not_taken = jump_if_true ? TCG_COND_EQ : TCG_COND_NE;
 -    if (ctx->tbflags & GUSA_EXCLUSIVE) {
 +    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
          /* When in an exclusive region, we must continue to the end.
             Therefore, exit the region on a taken branch, but otherwise
             fall through to the next instruction.  */
          tcg_gen_brcondi_i32(cond_not_taken, cpu_sr_t, 0, l1);
 -        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
 +        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
          /* Note that this won't actually use a goto_tb opcode because we
             disallow it in use_goto_tb, but it handles exit + singlestep.  */
          gen_goto_tb(ctx, 0, dest);
@@ -XXX,XX +XXX,XX @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
      tcg_gen_mov_i32(ds, cpu_delayed_cond);
      tcg_gen_discard_i32(cpu_delayed_cond);
 -    if (ctx->tbflags & GUSA_EXCLUSIVE) {
 +    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
          /* When in an exclusive region, we must continue to the end.
             Therefore, exit the region on a taken branch, but otherwise
             fall through to the next instruction.  */
          tcg_gen_brcondi_i32(TCG_COND_EQ, ds, 0, l1);
          /* Leave the gUSA region.  */
 -        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
 +        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
          gen_jump(ctx);
          gen_set_label(l1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
  #define XHACK(x) ((((x) & 1 ) << 4) | ((x) & 0xe))
  #define CHECK_NOT_DELAY_SLOT \
 -    if (ctx->envflags & DELAY_SLOT_MASK) {  \
 -        goto do_illegal_slot;               \
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {  \
 +        goto do_illegal_slot;                       \
      }
  #define CHECK_PRIVILEGED \
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x000b:        /* rts */
      CHECK_NOT_DELAY_SLOT
      tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x0028:        /* clrmac */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          gen_write_sr(cpu_ssr);
      tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
 -        ctx->envflags |= DELAY_SLOT_RTE;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_RTE;
      ctx->delayed_pc = (uint32_t) - 1;
          ctx->base.is_jmp = DISAS_STOP;
      return;
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      return;
      case 0xe000:        /* mov #imm,Rn */
  #ifdef CONFIG_USER_ONLY
 -        /* Detect the start of a gUSA region.  If so, update envflags
 -           and end the TB.  This will allow us to see the end of the
 -           region (stored in R0) in the next TB.  */
 +        /*
 +         * Detect the start of a gUSA region (mov #-n, r15).
 +         * If so, update envflags and end the TB.  This will allow us
 +         * to see the end of the region (stored in R0) in the next TB.
 +         */
          if (B11_8 == 15 && B7_0s < 0 &&
              (tb_cflags(ctx->base.tb) & CF_PARALLEL)) {
 -            ctx->envflags = deposit32(ctx->envflags, GUSA_SHIFT, 8, B7_0s);
 +            ctx->envflags =
 +                deposit32(ctx->envflags, TB_FLAG_GUSA_SHIFT, 8, B7_0s);
              ctx->base.is_jmp = DISAS_STOP;
          }
  #endif
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0xa000:        /* bra disp */
      CHECK_NOT_DELAY_SLOT
          ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      return;
      case 0xb000:        /* bsr disp */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      return;
      }
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          tcg_gen_xori_i32(cpu_delayed_cond, cpu_sr_t, 1);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
 -        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
      return;
      case 0x8900:        /* bt label */
      CHECK_NOT_DELAY_SLOT
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      CHECK_NOT_DELAY_SLOT
          tcg_gen_mov_i32(cpu_delayed_cond, cpu_sr_t);
          ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
 -        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
      return;
      case 0x8800:        /* cmp/eq #imm,R0 */
          tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_t, REG(0), B7_0s);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x0023:        /* braf Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->base.pc_next + 4);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x0003:        /* bsrf Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
      tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr);
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x4015:        /* cmp/pl Rn */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      case 0x402b:        /* jmp @Rn */
      CHECK_NOT_DELAY_SLOT
      tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x400b:        /* jsr @Rn */
      CHECK_NOT_DELAY_SLOT
          tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
      tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
 -        ctx->envflags |= DELAY_SLOT;
 +        ctx->envflags |= TB_FLAG_DELAY_SLOT;
      ctx->delayed_pc = (uint32_t) - 1;
      return;
      case 0x400e:        /* ldc Rm,SR */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
      fflush(stderr);
  #endif
   do_illegal:
 -    if (ctx->envflags & DELAY_SLOT_MASK) {
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
   do_illegal_slot:
          gen_save_cpu_state(ctx, true);
          gen_helper_raise_slot_illegal_instruction(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
   do_fpu_disabled:
      gen_save_cpu_state(ctx, true);
 -    if (ctx->envflags & DELAY_SLOT_MASK) {
 +    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
          gen_helper_raise_slot_fpu_disable(cpu_env);
      } else {
          gen_helper_raise_fpu_disable(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void decode_opc(DisasContext * ctx)
      _decode_opc(ctx);
 -    if (old_flags & DELAY_SLOT_MASK) {
 +    if (old_flags & TB_FLAG_DELAY_SLOT_MASK) {
          /* go out of the delay slot */
 -        ctx->envflags &= ~DELAY_SLOT_MASK;
 +        ctx->envflags &= ~TB_FLAG_DELAY_SLOT_MASK;
          /* When in an exclusive region, we must continue to the end
             for conditional branches.  */
 -        if (ctx->tbflags & GUSA_EXCLUSIVE
 -            && old_flags & DELAY_SLOT_CONDITIONAL) {
 +        if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE
 +            && old_flags & TB_FLAG_DELAY_SLOT_COND) {
              gen_delayed_conditional_jump(ctx);
              return;
          }
          /* Otherwise this is probably an invalid gUSA region.
             Drop the GUSA bits so the next TB doesn't see them.  */
 -        ctx->envflags &= ~GUSA_MASK;
 +        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
          tcg_gen_movi_i32(cpu_flags, ctx->envflags);
 -        if (old_flags & DELAY_SLOT_CONDITIONAL) {
 +        if (old_flags & TB_FLAG_DELAY_SLOT_COND) {
          gen_delayed_conditional_jump(ctx);
          } else {
              gen_jump(ctx);
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
      }
      /* The entire region has been translated.  */
 -    ctx->envflags &= ~GUSA_MASK;
 +    ctx->envflags &= ~TB_FLAG_GUSA_MASK;
      ctx->base.pc_next = pc_end;
      ctx->base.num_insns += max_insns - 1;
      return;
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
      /* Restart with the EXCLUSIVE bit set, within a TB run via
         cpu_exec_step_atomic holding the exclusive lock.  */
 -    ctx->envflags |= GUSA_EXCLUSIVE;
 +    ctx->envflags |= TB_FLAG_GUSA_EXCLUSIVE;
      gen_save_cpu_state(ctx, false);
      gen_helper_exclusive(cpu_env);
      ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
                    (tbflags & (1 << SR_RB))) * 0x10;
      ctx->fbank = tbflags & FPSCR_FR ? 0x10 : 0;
 -    if (tbflags & GUSA_MASK) {
 +#ifdef CONFIG_USER_ONLY
 +    if (tbflags & TB_FLAG_GUSA_MASK) {
 +        /* In gUSA exclusive region. */
          uint32_t pc = ctx->base.pc_next;
          uint32_t pc_end = ctx->base.tb->cs_base;
 -        int backup = sextract32(ctx->tbflags, GUSA_SHIFT, 8);
 +        int backup = sextract32(ctx->tbflags, TB_FLAG_GUSA_SHIFT, 8);
          int max_insns = (pc_end - pc) / 2;
          if (pc != pc_end + backup || max_insns < 2) {
              /* This is a malformed gUSA region.  Don't do anything special,
                 since the interpreter is likely to get confused.  */
 -            ctx->envflags &= ~GUSA_MASK;
 -        } else if (tbflags & GUSA_EXCLUSIVE) {
 +            ctx->envflags &= ~TB_FLAG_GUSA_MASK;
 +        } else if (tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
              /* Regardless of single-stepping or the end of the page,
                 we must complete execution of the gUSA region while
                 holding the exclusive lock.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
              return;
          }
      }
 +#endif
      /* Since the ISA is fixed-width, we can bound by the number
         of instructions remaining on the page.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
      DisasContext *ctx = container_of(dcbase, DisasContext, base);
  #ifdef CONFIG_USER_ONLY
 -    if (unlikely(ctx->envflags & GUSA_MASK)
 -        && !(ctx->envflags & GUSA_EXCLUSIVE)) {
 +    if (unlikely(ctx->envflags & TB_FLAG_GUSA_MASK)
 +        && !(ctx->envflags & TB_FLAG_GUSA_EXCLUSIVE)) {
          /* We're in an gUSA region, and we have not already fallen
             back on using an exclusive region.  Attempt to parse the
             region into a single supported atomic operation.  Failure
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
  {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
+     DisasContext *ctx = container_of(dcbase, DisasContext, base);
-@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
-     return !msr_le;
+-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
- }
++    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
+         /* Ending the region of exclusivity.  Clear the bits.  */
-+#ifdef CONFIG_TCG
+-        ctx->envflags &= ~GUSA_MASK;
- static void ppc_cpu_exec_enter(CPUState *cs)
++        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
- {
+     }
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
+     switch (ctx->base.is_jmp) {
          vhc->cpu_exec_exit(cpu->vhyp, cpu);
      }
  }
 -#endif
 +#endif /* CONFIG_TCG */
 +
 +#endif /* !CONFIG_USER_ONLY */
  static void ppc_cpu_instance_init(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
      cc->class_by_name = ppc_cpu_class_by_name;
      cc->has_work = ppc_cpu_has_work;
      cc->do_interrupt = ppc_cpu_do_interrupt;
 -    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
      cc->dump_state = ppc_cpu_dump_state;
      cc->dump_statistics = ppc_cpu_dump_statistics;
      cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
  #endif
  #ifdef CONFIG_TCG
      cc->tcg_ops.initialize = ppc_translate_init;
 +    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
      cc->tlb_fill = ppc_cpu_tlb_fill;
 -#endif
  #ifndef CONFIG_USER_ONLY
 -    cc->cpu_exec_enter = ppc_cpu_exec_enter;
 -    cc->cpu_exec_exit = ppc_cpu_exec_exit;
 -#endif
 +    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
 +    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
 +#endif /* !CONFIG_USER_ONLY */
 +#endif /* CONFIG_TCG */
      cc->disas_set_info = ppc_disas_set_info;
 --
-.25.1
+.34.1

-[PULL 36/46] target/arm: do not use cc->do_interrupt for KVM directly
+Deleted patch
-From: Claudio Fontana <cfontana@suse.de>
-cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
-to prepare the emulated architecture to take an interrupt as defined
-in the hardware specifications,
-but in reality the _do_interrupt style of functions in targets are
-also occasionally reused by KVM to prepare the architecture state in a
-similar way where userspace code has identified that it needs to
-deliver an exception to the guest.
-In the case of ARM, that includes:
-) the vcpu thread got a SIGBUS indicating a memory error,
-   and we need to deliver a Synchronous External Abort to the guest to
-   let it know about the error.
-) the kernel told us about a debug exception (breakpoint, watchpoint)
-   but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
-   so it must be a breakpoint the guest itself has set up, therefore
-   we need to deliver it to the guest.
-So in order to reuse code, the same arm_do_interrupt function is used.
-This is all fine, but we need to avoid calling it using the callback
-registered in CPUClass, since that one is now TCG-only.
-Fortunately this is easily solved by replacing calls to
-CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Message-Id: <20210204163931.7358-9-cfontana@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/arm/helper.c | 4 ++++
- target/arm/kvm64.c  | 6 ++----
-files changed, 6 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
-  * Do any appropriate logging, handle PSCI calls, and then hand off
-  * to the AArch64-entry or AArch32-entry function depending on the
-  * target exception level's register width.
-+ *
-+ * Note: this is used for both TCG (as the do_interrupt tcg op),
-+ *       and KVM to re-inject guest debug exceptions, and to
-+ *       inject a Synchronous-External-Abort.
-  */
- void arm_cpu_do_interrupt(CPUState *cs)
- {
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
- {
-     ARMCPU *cpu = ARM_CPU(c);
-     CPUARMState *env = &cpu->env;
--    CPUClass *cc = CPU_GET_CLASS(c);
-     uint32_t esr;
-     bool same_el;
-@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
-     env->exception.syndrome = esr;
--    cc->do_interrupt(c);
-+    arm_cpu_do_interrupt(c);
- }
- #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
- {
-     int hsr_ec = syn_get_ec(debug_exit->hsr);
-     ARMCPU *cpu = ARM_CPU(cs);
--    CPUClass *cc = CPU_GET_CLASS(cs);
-     CPUARMState *env = &cpu->env;
-     /* Ensure PC is synchronised */
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
-     env->exception.vaddress = debug_exit->far;
-     env->exception.target_el = 1;
-     qemu_mutex_lock_iothread();
--    cc->do_interrupt(cs);
-+    arm_cpu_do_interrupt(cs);
-     qemu_mutex_unlock_iothread();
-     return false;
---
-.25.1

-[PULL 38/46] cpu: move cc->transaction_failed to tcg_ops
+Deleted patch
-From: Claudio Fontana <cfontana@suse.de>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]
-avoiding its use in headers used by common_ss code (should be poisoned).
-Note: need to be careful with the use of CONFIG_USER_ONLY,
-Message-Id: <20210204163931.7358-11-cfontana@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/hw/core/cpu.h     | 28 +++++++++++++---------------
- hw/mips/jazz.c            |  9 +++++++--
- target/alpha/cpu.c        |  2 +-
- target/arm/cpu.c          |  4 ++--
- target/m68k/cpu.c         |  2 +-
- target/microblaze/cpu.c   |  2 +-
- target/mips/cpu.c         |  4 +++-
- target/riscv/cpu.c        |  2 +-
- target/riscv/cpu_helper.c |  2 +-
- target/sparc/cpu.c        |  2 +-
- target/xtensa/cpu.c       |  2 +-
- target/xtensa/helper.c    |  4 ++--
-files changed, 34 insertions(+), 29 deletions(-)
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-     /** @debug_excp_handler: Callback for handling debug exceptions */
-     void (*debug_excp_handler)(CPUState *cpu);
-+    /**
-+     * @do_transaction_failed: Callback for handling failed memory transactions
-+     * (ie bus faults or external aborts; not MMU faults)
-+     */
-+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-+                                  unsigned size, MMUAccessType access_type,
-+                                  int mmu_idx, MemTxAttrs attrs,
-+                                  MemTxResult response, uintptr_t retaddr);
- } TcgCpuOperations;
- /**
-@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
-  * @has_work: Callback for checking if there is work to do.
-  * @do_unaligned_access: Callback for unaligned access handling, if
-  * the target defines #TARGET_ALIGNED_ONLY.
-- * @do_transaction_failed: Callback for handling failed memory transactions
-- * (ie bus faults or external aborts; not MMU faults)
-  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
-  * runtime configurable endianness is currently big-endian. Non-configurable
-  * CPUs can use the default implementation of this method. This method should
-@@ -XXX,XX +XXX,XX @@ struct CPUClass {
-     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                 MMUAccessType access_type,
-                                 int mmu_idx, uintptr_t retaddr);
--    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
--                                  unsigned size, MMUAccessType access_type,
--                                  int mmu_idx, MemTxAttrs attrs,
--                                  MemTxResult response, uintptr_t retaddr);
-     bool (*virtio_is_big_endian)(CPUState *cpu);
-     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
-                            uint8_t *buf, int len, bool is_write);
-@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
- void cpu_interrupt(CPUState *cpu, int mask);
--#ifdef NEED_CPU_H
--
--#ifdef CONFIG_SOFTMMU
- static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-                                         MMUAccessType access_type,
-                                         int mmu_idx, uintptr_t retaddr)
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
- {
-     CPUClass *cc = CPU_GET_CLASS(cpu);
--    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
--        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
--                                  mmu_idx, attrs, response, retaddr);
-+    if (!cpu->ignore_memory_transaction_failures &&
-+        cc->tcg_ops.do_transaction_failed) {
-+        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
-+                                          access_type, mmu_idx, attrs,
-+                                          response, retaddr);
-     }
- }
--#endif
--
--#endif /* NEED_CPU_H */
- /**
-  * cpu_set_pc:
-diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/jazz.c
-+++ b/hw/mips/jazz.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
- #define MAGNUM_BIOS_SIZE_MAX 0x7e000
- #define MAGNUM_BIOS_SIZE                                                       \
-         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
-+
-+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
- static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
-                                           vaddr addr, unsigned size,
-                                           MMUAccessType access_type,
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
-     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
-                                   mmu_idx, attrs, response, retaddr);
- }
-+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
- static void mips_jazz_init(MachineState *machine,
-                            enum jazz_model_e jazz_model)
-@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
-      * memory region that catches all memory accesses, as we do on Malta.
-      */
-     cc = CPU_GET_CLASS(cpu);
--    real_do_transaction_failed = cc->do_transaction_failed;
--    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
-+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-+    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
-+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-     /* allocate RAM */
-     memory_region_add_subregion(address_space, 0, machine->ram);
-diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/alpha/cpu.c
-+++ b/target/alpha/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_alpha_cpu;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
-     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
- #if !defined(CONFIG_USER_ONLY)
--    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
-     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
- #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
--#endif
-+#endif /* CONFIG_TCG */
- }
- #ifdef CONFIG_KVM
-diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/cpu.c
-+++ b/target/m68k/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
- #if defined(CONFIG_SOFTMMU)
--    cc->do_transaction_failed = m68k_cpu_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
-     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
-     dc->vmsd = &vmstate_m68k_cpu;
- #endif
-diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/microblaze/cpu.c
-+++ b/target/microblaze/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = mb_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = mb_cpu_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
-     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
-     dc->vmsd = &vmstate_mb_cpu;
- #endif
-diff --git a/target/mips/cpu.c b/target/mips/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/mips/cpu.c
-+++ b/target/mips/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_read_register = mips_cpu_gdb_read_register;
-     cc->gdb_write_register = mips_cpu_gdb_write_register;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
-     cc->do_unaligned_access = mips_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_mips_cpu;
-@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
-     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-+#ifndef CONFIG_USER_ONLY
-+    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
-+#endif /* CONFIG_USER_ONLY */
- #endif /* CONFIG_TCG */
-     cc->gdb_num_core_regs = 73;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
-     cc->gdb_stop_before_watchpoint = true;
-     cc->disas_set_info = riscv_cpu_disas_set_info;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-     cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
-     /* For now, mark unmigratable: */
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-     env->badaddr = addr;
-     riscv_raise_exception(env, cs->exception_index, retaddr);
- }
--#endif
-+#endif /* !CONFIG_USER_ONLY */
- bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                         MMUAccessType access_type, int mmu_idx,
-diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/sparc/cpu.c
-+++ b/target/sparc/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
-     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
- #ifndef CONFIG_USER_ONLY
--    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
-     cc->vmsd = &vmstate_sparc_cpu;
-diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/cpu.c
-+++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
- #ifndef CONFIG_USER_ONLY
-     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
-     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
--    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
-+    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
- #endif
-     cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
-     cc->disas_set_info = xtensa_cpu_disas_set_info;
-diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/helper.c
-+++ b/target/xtensa/helper.c
-@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     cpu_loop_exit_restore(cs, retaddr);
- }
--#else
-+#else /* !CONFIG_USER_ONLY */
- void xtensa_cpu_do_unaligned_access(CPUState *cs,
-                                     vaddr addr, MMUAccessType access_type,
-@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
-         qemu_cpu_kick(cpu);
-     }
- }
--#endif
-+#endif /* !CONFIG_USER_ONLY */
---
-.25.1

-[PULL 44/46] accel: extend AccelState and AccelClass to user-mode
+Deleted patch
-From: Claudio Fontana <cfontana@suse.de>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-[claudio: rebased on Richard's splitwx work]
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Message-Id: <20210204163931.7358-17-cfontana@suse.de>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
----
- include/hw/boards.h                |  2 +-
- include/{sysemu => qemu}/accel.h   | 14 +++++----
- include/sysemu/hvf.h               |  2 +-
- include/sysemu/kvm.h               |  2 +-
- include/sysemu/kvm_int.h           |  2 +-
- target/i386/hvf/hvf-i386.h         |  2 +-
- accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
- accel/{accel.c => accel-softmmu.c} | 27 ++--------------
- accel/accel-user.c                 | 24 ++++++++++++++
- accel/qtest/qtest.c                |  2 +-
- accel/tcg/tcg-all.c                | 15 +++++++--
- accel/xen/xen-all.c                |  2 +-
- bsd-user/main.c                    |  6 +++-
- linux-user/main.c                  |  6 +++-
- softmmu/memory.c                   |  2 +-
- softmmu/qtest.c                    |  2 +-
- softmmu/vl.c                       |  2 +-
- target/i386/hax/hax-all.c          |  2 +-
- target/i386/hvf/hvf.c              |  2 +-
- target/i386/hvf/x86_task.c         |  2 +-
- target/i386/whpx/whpx-all.c        |  2 +-
- MAINTAINERS                        |  2 +-
- accel/meson.build                  |  4 ++-
- accel/tcg/meson.build              |  2 +-
-files changed, 125 insertions(+), 53 deletions(-)
- rename include/{sysemu => qemu}/accel.h (95%)
- create mode 100644 accel/accel-common.c
- rename accel/{accel.c => accel-softmmu.c} (75%)
- create mode 100644 accel/accel-user.c
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -XXX,XX +XXX,XX @@
- #include "exec/memory.h"
- #include "sysemu/hostmem.h"
- #include "sysemu/blockdev.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "qapi/qapi-types-machine.h"
- #include "qemu/module.h"
- #include "qom/object.h"
-diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
-similarity index 95%
-rename from include/sysemu/accel.h
-rename to include/qemu/accel.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/accel.h
-+++ b/include/qemu/accel.h
-@@ -XXX,XX +XXX,XX @@
-  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-  * THE SOFTWARE.
-  */
--#ifndef HW_ACCEL_H
--#define HW_ACCEL_H
-+#ifndef QEMU_ACCEL_H
-+#define QEMU_ACCEL_H
- #include "qom/object.h"
- #include "exec/hwaddr.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
-     /*< public >*/
-     const char *name;
--#ifndef CONFIG_USER_ONLY
-     int (*init_machine)(MachineState *ms);
-+#ifndef CONFIG_USER_ONLY
-     void (*setup_post)(MachineState *ms, AccelState *accel);
-     bool (*has_memory)(MachineState *ms, AddressSpace *as,
-                        hwaddr start_addr, hwaddr size);
-@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
-     OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
- AccelClass *accel_find(const char *opt_name);
-+AccelState *current_accel(void);
-+
-+#ifndef CONFIG_USER_ONLY
- int accel_init_machine(AccelState *accel, MachineState *ms);
- /* Called just before os_setup_post (ie just before drop OS privs) */
- void accel_setup_post(MachineState *ms);
-+#endif /* !CONFIG_USER_ONLY */
--AccelState *current_accel(void);
--
--#endif
-+#endif /* QEMU_ACCEL_H */
-diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/hvf.h
-+++ b/include/sysemu/hvf.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef HVF_H
- #define HVF_H
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "qom/object.h"
- #ifdef CONFIG_HVF
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
-+++ b/include/sysemu/kvm.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/queue.h"
- #include "hw/core/cpu.h"
- #include "exec/memattrs.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "qom/object.h"
- #ifdef NEED_CPU_H
-diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm_int.h
-+++ b/include/sysemu/kvm_int.h
-@@ -XXX,XX +XXX,XX @@
- #define QEMU_KVM_INT_H
- #include "exec/memory.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/kvm.h"
- typedef struct KVMSlot
-diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/hvf/hvf-i386.h
-+++ b/target/i386/hvf/hvf-i386.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef HVF_I386_H
- #define HVF_I386_H
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/hvf.h"
- #include "cpu.h"
- #include "x86.h"
-diff --git a/accel/accel-common.c b/accel/accel-common.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/accel/accel-common.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU accel class, components common to system emulation and user mode
-+ *
-+ * Copyright (c) 2003-2008 Fabrice Bellard
-+ * Copyright (c) 2014 Red Hat Inc.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/accel.h"
-+
-+static const TypeInfo accel_type = {
-+    .name = TYPE_ACCEL,
-+    .parent = TYPE_OBJECT,
-+    .class_size = sizeof(AccelClass),
-+    .instance_size = sizeof(AccelState),
-+};
-+
-+/* Lookup AccelClass from opt_name. Returns NULL if not found */
-+AccelClass *accel_find(const char *opt_name)
-+{
-+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
-+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
-+    g_free(class_name);
-+    return ac;
-+}
-+
-+static void register_accel_types(void)
-+{
-+    type_register_static(&accel_type);
-+}
-+
-+type_init(register_accel_types);
-diff --git a/accel/accel.c b/accel/accel-softmmu.c
-similarity index 75%
-rename from accel/accel.c
-rename to accel/accel-softmmu.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/accel.c
-+++ b/accel/accel-softmmu.c
-@@ -XXX,XX +XXX,XX @@
- /*
-- * QEMU System Emulator, accelerator interfaces
-+ * QEMU accel class, system emulation components
-  *
-  * Copyright (c) 2003-2008 Fabrice Bellard
-  * Copyright (c) 2014 Red Hat Inc.
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "hw/boards.h"
- #include "sysemu/arch_init.h"
- #include "sysemu/sysemu.h"
- #include "qom/object.h"
--static const TypeInfo accel_type = {
--    .name = TYPE_ACCEL,
--    .parent = TYPE_OBJECT,
--    .class_size = sizeof(AccelClass),
--    .instance_size = sizeof(AccelState),
--};
--
--/* Lookup AccelClass from opt_name. Returns NULL if not found */
--AccelClass *accel_find(const char *opt_name)
--{
--    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
--    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
--    g_free(class_name);
--    return ac;
--}
--
- int accel_init_machine(AccelState *accel, MachineState *ms)
- {
-     AccelClass *acc = ACCEL_GET_CLASS(accel);
-@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
-         acc->setup_post(ms, accel);
-     }
- }
--
--static void register_accel_types(void)
--{
--    type_register_static(&accel_type);
--}
--
--type_init(register_accel_types);
-diff --git a/accel/accel-user.c b/accel/accel-user.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/accel/accel-user.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU accel class, user-mode components
-+ *
-+ * Copyright 2021 SUSE LLC
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/accel.h"
-+
-+AccelState *current_accel(void)
-+{
-+    static AccelState *accel;
-+
-+    if (!accel) {
-+        AccelClass *ac = accel_find("tcg");
-+
-+        g_assert(ac != NULL);
-+        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
-+    }
-+    return accel;
-+}
-diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/qtest/qtest.c
-+++ b/accel/qtest/qtest.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/module.h"
- #include "qemu/option.h"
- #include "qemu/config-file.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/qtest.h"
- #include "sysemu/cpus.h"
- #include "sysemu/cpu-timers.h"
-diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/tcg-all.c
-+++ b/accel/tcg/tcg-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "tcg/tcg.h"
- #include "qapi/error.h"
- #include "qemu/error-report.h"
--#include "hw/boards.h"
-+#include "qemu/accel.h"
- #include "qapi/qapi-builtin-visit.h"
-+
-+#ifndef CONFIG_USER_ONLY
- #include "tcg-cpus.h"
-+#endif /* CONFIG_USER_ONLY */
- struct TCGState {
-     AccelState parent_obj;
-@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
-     s->mttcg_enabled = default_mttcg_enabled();
-     /* If debugging enabled, default "auto on", otherwise off. */
--#ifdef CONFIG_DEBUG_TCG
-+#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
-     s->splitwx_enabled = -1;
- #else
-     s->splitwx_enabled = 0;
-@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
-     mttcg_enabled = s->mttcg_enabled;
-     /*
--     * Initialize TCG regions
-+     * Initialize TCG regions only for softmmu.
-+     *
-+     * This needs to be done later for user mode, because the prologue
-+     * generation needs to be delayed so that GUEST_BASE is already set.
-      */
-+#ifndef CONFIG_USER_ONLY
-     tcg_region_init();
-     if (mttcg_enabled) {
-@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
-     } else {
-         cpus_register_accel(&tcg_cpus_rr);
-     }
-+#endif /* !CONFIG_USER_ONLY */
-+
-     return 0;
- }
-diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/xen/xen-all.c
-+++ b/accel/xen/xen-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/xen/xen-legacy-backend.h"
- #include "hw/xen/xen_pt.h"
- #include "chardev/char.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/cpus.h"
- #include "sysemu/xen.h"
- #include "sysemu/runstate.h"
-diff --git a/bsd-user/main.c b/bsd-user/main.c
-index XXXXXXX..XXXXXXX 100644
---- a/bsd-user/main.c
-+++ b/bsd-user/main.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
- #include "qemu/units.h"
-+#include "qemu/accel.h"
- #include "sysemu/tcg.h"
- #include "qemu-version.h"
- #include <machine/trap.h>
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-     }
-     /* init tcg before creating CPUs and to get qemu_host_page_size */
--    tcg_exec_init(0, false);
-+    {
-+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
-+        ac->init_machine(NULL);
-+    }
-     cpu_type = parse_cpu_option(cpu_model);
-     cpu = cpu_create(cpu_type);
-     env = cpu->env_ptr;
-diff --git a/linux-user/main.c b/linux-user/main.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/main.c
-+++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
- #include "qemu/units.h"
-+#include "qemu/accel.h"
- #include "sysemu/tcg.h"
- #include "qemu-version.h"
- #include <sys/syscall.h>
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
-     cpu_type = parse_cpu_option(cpu_model);
-     /* init tcg before creating CPUs and to get qemu_host_page_size */
--    tcg_exec_init(0, false);
-+    {
-+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
-+        ac->init_machine(NULL);
-+    }
-     cpu = cpu_create(cpu_type);
-     env = cpu->env_ptr;
-     cpu_reset(cpu);
-diff --git a/softmmu/memory.c b/softmmu/memory.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/memory.c
-+++ b/softmmu/memory.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/kvm.h"
- #include "sysemu/runstate.h"
- #include "sysemu/tcg.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "hw/boards.h"
- #include "migration/vmstate.h"
-diff --git a/softmmu/qtest.c b/softmmu/qtest.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/qtest.c
-+++ b/softmmu/qtest.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/ioport.h"
- #include "exec/memory.h"
- #include "hw/irq.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/cpu-timers.h"
- #include "qemu/config-file.h"
- #include "qemu/option.h"
-diff --git a/softmmu/vl.c b/softmmu/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/vl.c
-+++ b/softmmu/vl.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/error-report.h"
- #include "qemu/sockets.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "hw/usb.h"
- #include "hw/isa/isa.h"
- #include "hw/scsi/scsi.h"
-diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/hax/hax-all.c
-+++ b/target/i386/hax/hax-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "qemu-common.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/reset.h"
- #include "sysemu/runstate.h"
- #include "hw/boards.h"
-diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/hvf/hvf.c
-+++ b/target/i386/hvf/hvf.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "hw/i386/apic_internal.h"
- #include "qemu/main-loop.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "target/i386/cpu.h"
- #include "hvf-cpus.h"
-diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/hvf/x86_task.c
-+++ b/target/i386/hvf/x86_task.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/i386/apic_internal.h"
- #include "qemu/main-loop.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "target/i386/cpu.h"
- // TODO: taskswitch handling
-diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/whpx/whpx-all.c
-+++ b/target/i386/whpx/whpx-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "exec/ioport.h"
- #include "qemu-common.h"
--#include "sysemu/accel.h"
-+#include "qemu/accel.h"
- #include "sysemu/whpx.h"
- #include "sysemu/cpus.h"
- #include "sysemu/runstate.h"
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ Overall
- M: Richard Henderson <richard.henderson@linaro.org>
- R: Paolo Bonzini <pbonzini@redhat.com>
- S: Maintained
--F: include/sysemu/accel.h
-+F: include/qemu/accel.h
- F: accel/accel.c
- F: accel/Makefile.objs
- F: accel/stubs/Makefile.objs
-diff --git a/accel/meson.build b/accel/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/accel/meson.build
-+++ b/accel/meson.build
-@@ -XXX,XX +XXX,XX @@
--softmmu_ss.add(files('accel.c'))
-+specific_ss.add(files('accel-common.c'))
-+softmmu_ss.add(files('accel-softmmu.c'))
-+user_ss.add(files('accel-user.c'))
- subdir('qtest')
- subdir('kvm')
-diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/meson.build
-+++ b/accel/tcg/meson.build
-@@ -XXX,XX +XXX,XX @@
- tcg_ss = ss.source_set()
- tcg_ss.add(files(
-+  'tcg-all.c',
-   'cpu-exec-common.c',
-   'cpu-exec.c',
-   'tcg-runtime-gvec.c',
-@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
- specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
- specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
--  'tcg-all.c',
-   'cputlb.c',
-   'tcg-cpus.c',
-   'tcg-cpus-mttcg.c',
---
-.25.1

The following changes since commit d0dddab40e472ba62b5f43f11cc7dba085dabe71:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-02-05 15:27:02 +0000)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20210205

for you to fetch changes up to fb6916dd6ca8bb4b42d44baba9c67ecaf2279577:

accel: introduce AccelCPUClass extending CPUClass (2021-02-05 10:24:15 -1000)

----------------------------------------------------------------
TCGCPUOps cleanups (claudio)
tcg/s390 compare fix (phil)
tcg/aarch64 rotli_vec fix
tcg/tci cleanups and fixes

----------------------------------------------------------------
Claudio Fontana (13):
      target/riscv: remove CONFIG_TCG, as it is always TCG
      accel/tcg: split TCG-only code from cpu_exec_realizefn
      target/arm: do not use cc->do_interrupt for KVM directly
      cpu: move cc->do_interrupt to tcg_ops
      cpu: move cc->transaction_failed to tcg_ops
      cpu: move do_unaligned_access to tcg_ops
      physmem: make watchpoint checking code TCG-only
      cpu: move adjust_watchpoint_address to tcg_ops
      cpu: move debug_check_watchpoint to tcg_ops
      cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClass
      accel: extend AccelState and AccelClass to user-mode
      accel: replace struct CpusAccel with AccelOpsClass
      accel: introduce AccelCPUClass extending CPUClass

Eduardo Habkost (5):
      cpu: Introduce TCGCpuOperations struct
      cpu: Move synchronize_from_tb() to tcg_ops
      cpu: Move cpu_exec_* to tcg_ops
      cpu: Move tlb_fill to tcg_ops
      cpu: Move debug_excp_handler to tcg_ops

Philippe Mathieu-Daudé (2):
      tcg/s390: Fix compare instruction from extended-immediate facility
      exec/cpu-defs: Remove TCG backends dependency

Richard Henderson (24):
      tcg/aarch64: Do not convert TCGArg to temps that are not temps
      configure: Fix --enable-tcg-interpreter
      tcg/tci: Make tci_tb_ptr thread-local
      tcg/tci: Inline tci_write_reg32s into the only caller
      tcg/tci: Inline tci_write_reg8 into its callers
      tcg/tci: Inline tci_write_reg16 into the only caller
      tcg/tci: Inline tci_write_reg32 into all callers
      tcg/tci: Inline tci_write_reg64 into 64-bit callers
      tcg/tci: Merge INDEX_op_ld8u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld8s_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16u_{i32,i64}
      tcg/tci: Merge INDEX_op_ld16s_{i32,i64}
      tcg/tci: Merge INDEX_op_{ld_i32,ld32u_i64}
      tcg/tci: Merge INDEX_op_st8_{i32,i64}
      tcg/tci: Merge INDEX_op_st16_{i32,i64}
      tcg/tci: Move stack bounds check to compile-time
      tcg/tci: Merge INDEX_op_{st_i32,st32_i64}
      tcg/tci: Use g_assert_not_reached
      tcg/tci: Remove dead code for TCG_TARGET_HAS_div2_*
      tcg/tci: Implement 64-bit division
      tcg/tci: Remove TODO as unused
      tcg/tci: Restrict TCG_TARGET_NB_REGS to 16
      tcg/tci: Fix TCG_REG_R4 misusage
      tcg/tci: Remove TCG_CONST

Stefan Weil (2):
      tcg/tci: Implement INDEX_op_ld16s_i32
      tcg/tci: Implement INDEX_op_ld8s_i64

configure                                          |   5 +-
 accel/accel-softmmu.h                              |  15 +
 accel/kvm/kvm-cpus.h                               |   2 -
 .../{tcg-cpus-icount.h => tcg-accel-ops-icount.h}  |   2 +
 accel/tcg/tcg-accel-ops-mttcg.h                    |  19 +
 accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h}    |   0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}          |   6 +-
 include/exec/cpu-all.h                             |  11 +-
 include/exec/cpu-defs.h                            |   3 -
 include/exec/exec-all.h                            |   2 +-
 include/hw/boards.h                                |   2 +-
 include/hw/core/accel-cpu.h                        |  38 ++
 include/hw/core/cpu.h                              |  86 +---
 include/hw/core/tcg-cpu-ops.h                      |  97 +++++
 include/{sysemu => qemu}/accel.h                   |  16 +-
 include/sysemu/accel-ops.h                         |  45 ++
 include/sysemu/cpus.h                              |  26 +-
 include/sysemu/hvf.h                               |   2 +-
 include/sysemu/kvm.h                               |   2 +-
 include/sysemu/kvm_int.h                           |   2 +-
 target/arm/internals.h                             |   6 +
 target/i386/hax/{hax-cpus.h => hax-accel-ops.h}    |   2 -
 target/i386/hax/hax-windows.h                      |   2 +-
 target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}    |   2 -
 target/i386/hvf/hvf-i386.h                         |   2 +-
 target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} |   2 -
 tcg/tci/tcg-target-con-set.h                       |   6 +-
 tcg/tci/tcg-target.h                               |  37 +-
 accel/accel-common.c                               | 105 +++++
 accel/{accel.c => accel-softmmu.c}                 |  61 ++-
 accel/accel-user.c                                 |  24 ++
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}          |  28 +-
 accel/kvm/kvm-all.c                                |   2 -
 accel/qtest/qtest.c                                |  25 +-
 accel/tcg/cpu-exec.c                               |  53 ++-
 accel/tcg/cputlb.c                                 |  34 +-
 .../{tcg-cpus-icount.c => tcg-accel-ops-icount.c}  |  21 +-
 .../{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c}    |  14 +-
 accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c}    |  13 +-
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}          |  47 +-
 accel/tcg/tcg-all.c                                |  19 +-
 accel/tcg/user-exec.c                              |   8 +-
 accel/xen/xen-all.c                                |  26 +-
 bsd-user/main.c                                    |  11 +-
 cpu.c                                              |  66 +--
 hw/core/cpu.c                                      |  21 +-
 hw/mips/jazz.c                                     |  12 +-
 linux-user/main.c                                  |   7 +-
 softmmu/cpus.c                                     |  12 +-
 softmmu/memory.c                                   |   2 +-
 softmmu/physmem.c                                  | 149 ++++---
 softmmu/qtest.c                                    |   2 +-
 softmmu/vl.c                                       |   9 +-
 target/alpha/cpu.c                                 |  21 +-
 target/arm/cpu.c                                   |  45 +-
 target/arm/cpu64.c                                 |   4 +-
 target/arm/cpu_tcg.c                               |  32 +-
 target/arm/helper.c                                |   4 +
 target/arm/kvm64.c                                 |   6 +-
 target/avr/cpu.c                                   |  19 +-
 target/avr/helper.c                                |   5 +-
 target/cris/cpu.c                                  |  43 +-
 target/cris/helper.c                               |   5 +-
 target/hppa/cpu.c                                  |  24 +-
 target/i386/hax/{hax-cpus.c => hax-accel-ops.c}    |  33 +-
 target/i386/hax/hax-all.c                          |   7 +-
 target/i386/hax/hax-mem.c                          |   2 +-
 target/i386/hax/hax-posix.c                        |   2 +-
 target/i386/hax/hax-windows.c                      |   2 +-
 target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}    |  29 +-
 target/i386/hvf/hvf.c                              |   5 +-
 target/i386/hvf/x86_task.c                         |   2 +-
 target/i386/hvf/x86hvf.c                           |   2 +-
 target/i386/tcg/tcg-cpu.c                          |  26 +-
 target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} |  33 +-
 target/i386/whpx/whpx-all.c                        |   9 +-
 target/lm32/cpu.c                                  |  19 +-
 target/m68k/cpu.c                                  |  19 +-
 target/microblaze/cpu.c                            |  25 +-
 target/mips/cpu.c                                  |  35 +-
 target/moxie/cpu.c                                 |  15 +-
 target/nios2/cpu.c                                 |  18 +-
 target/openrisc/cpu.c                              |  17 +-
 target/riscv/cpu.c                                 |  26 +-
 target/riscv/cpu_helper.c                          |   2 +-
 target/rx/cpu.c                                    |  20 +-
 target/s390x/cpu.c                                 |  33 +-
 target/s390x/excp_helper.c                         |   2 +-
 target/sh4/cpu.c                                   |  21 +-
 target/sparc/cpu.c                                 |  25 +-
 target/tilegx/cpu.c                                |  17 +-
 target/tricore/cpu.c                               |  12 +-
 target/unicore32/cpu.c                             |  17 +-
 target/xtensa/cpu.c                                |  23 +-
 target/xtensa/helper.c                             |   4 +-
 tcg/tcg-common.c                                   |   4 -
 tcg/tci.c                                          | 479 ++++++++-------------
 target/ppc/translate_init.c.inc                    |  39 +-
 tcg/aarch64/tcg-target.c.inc                       |   7 +-
 tcg/s390/tcg-target.c.inc                          |   2 +-
 tcg/tci/tcg-target.c.inc                           | 149 ++-----
 MAINTAINERS                                        |   7 +-
 accel/kvm/meson.build                              |   2 +-
 accel/meson.build                                  |   4 +-
 accel/tcg/meson.build                              |  10 +-
 target/i386/hax/meson.build                        |   2 +-
 target/i386/hvf/meson.build                        |   2 +-
 target/i386/whpx/meson.build                       |   2 +-
 108 files changed, 1565 insertions(+), 1065 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/hw/core/accel-cpu.h
 create mode 100644 include/hw/core/tcg-cpu-ops.h
 rename include/{sysemu => qemu}/accel.h (94%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (64%)
 create mode 100644 accel/accel-user.c
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The code is currently comparing c2 to the type promotion of
uint32_t and int32_t. That is, the conversion rules are as:

(common_type) c2 == (common_type) (uint32_t)
                        (is_unsigned
                        ? (uint32_t)c2
                        : (uint32_t)(int32_t)c2)

In the signed case we lose the desired sign extensions because
of the argument promotion rules of the ternary operator.

Solve the problem by doing the round-trip parsing through the
intermediate type and back to the desired common type (all at
one expression).

Fixes: a534bb15f30 ("tcg/s390: Use constant pool for cmpi")
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204182902.1742826-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/s390/tcg-target.c.inc
+++ b/tcg/s390/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
                 op = (is_unsigned ? RIL_CLFI : RIL_CFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-            } else if (c2 == (is_unsigned ? (uint32_t)c2 : (int32_t)c2)) {
+            } else if (c2 == (is_unsigned ? (TCGArg)(uint32_t)c2 : (TCGArg)(int32_t)c2)) {
                 op = (is_unsigned ? RIL_CLGFI : RIL_CGFI);
                 tcg_out_insn_RIL(s, op, r1, c2);
                 goto exit;
-- 
2.25.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

"exec/cpu-defs.h" contains generic CPU definitions for the
TCG frontends (mostly related to TLB). TCG backends definitions
aren't relevant here.

See tcg/README description:

4) Backend

tcg-target.h contains the target specific definitions. tcg-target.c.inc
  contains the target specific code; it is #included by tcg/tcg.c, rather
  than being a standalone C file.

So far only "tcg/tcg.h" requires these headers.

Remove the "target-tcg.h" header dependency on TCG frontends, so we
don't have to rebuild all frontends when hacking a single backend.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210204191423.1754158-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/host-utils.h"
 #include "qemu/thread.h"
-#ifdef CONFIG_TCG
-#include "tcg-target.h"
-#endif
 #ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
 #endif
-- 
2.25.1

Fixes INDEX_op_rotli_vec for aarch64 host, where the 3rd
argument is an integer, not a temporary, which now tickles
an assert added in e89b28a6350.

Previously, the value computed into v2 would be garbage for
rotli_vec, but as the value was unused it caused no harm.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     v0 = temp_tcgv_vec(arg_temp(a0));
     v1 = temp_tcgv_vec(arg_temp(va_arg(va, TCGArg)));
     a2 = va_arg(va, TCGArg);
-    v2 = temp_tcgv_vec(arg_temp(a2));
+    va_end(va);
 
     switch (opc) {
     case INDEX_op_rotli_vec:
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     case INDEX_op_shrv_vec:
     case INDEX_op_sarv_vec:
         /* Right shifts are negative left shifts for AArch64.  */
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         tcg_gen_neg_vec(vece, t1, v2);
         opc = (opc == INDEX_op_shrv_vec
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotlv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
         tcg_gen_sub_vec(vece, t1, v2, c1);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
         break;
 
     case INDEX_op_rotrv_vec:
+        v2 = temp_tcgv_vec(arg_temp(a2));
         t1 = tcg_temp_new_vec(type);
         t2 = tcg_temp_new_vec(type);
         c1 = tcg_constant_vec(type, vece, 8 << vece);
@@ -XXX,XX +XXX,XX @@ void tcg_expand_vec_op(TCGOpcode opc, TCGType type, unsigned vece,
     default:
         g_assert_not_reached();
     }
-
-    va_end(va);
 }
 
 static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
-- 
2.25.1

The configure option was backward, and we failed to
pass the value on to meson.

Fixes: 23a77b2d18b ("build-system: clean up TCG/TCI configury")
Tested-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-whpx) whpx="enabled"
   ;;
-  --disable-tcg-interpreter) tcg_interpreter="true"
+  --disable-tcg-interpreter) tcg_interpreter="false"
   ;;
-  --enable-tcg-interpreter) tcg_interpreter="false"
+  --enable-tcg-interpreter) tcg_interpreter="true"
   ;;
   --disable-cap-ng)  cap_ng="disabled"
   ;;
@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
         -Dvhost_user_blk_server=$vhost_user_blk_server \
         -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
+	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
         "$PWD" "$source_path"
 
-- 
2.25.1

Each thread must have its own pc, even under TCI.

Remove the GETPC ifdef, because GETPC is always available for
helpers, and thus is always required.  Move the assignment
under INDEX_op_call, because the value is only visible when
we make a call to a helper function.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204014509.882821-6-richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 2 +-
 tcg/tcg-common.c        | 4 ----
 tcg/tci.c               | 7 +++----
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 /* GETPC is the true target of the return instruction that we'll execute.  */
 #if defined(CONFIG_TCG_INTERPRETER)
-extern uintptr_t tci_tb_ptr;
+extern __thread uintptr_t tci_tb_ptr;
 # define GETPC() tci_tb_ptr
 #else
 # define GETPC() \
diff --git a/tcg/tcg-common.c b/tcg/tcg-common.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-common.c
+++ b/tcg/tcg-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "tcg/tcg.h"
 
-#if defined(CONFIG_TCG_INTERPRETER)
-uintptr_t tci_tb_ptr;
-#endif
-
 TCGOpDef tcg_op_defs[] = {
 #define DEF(s, oargs, iargs, cargs, flags) \
          { #s, oargs, iargs, cargs, iargs + oargs + cargs, flags },
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*helper_function)(tcg_target_ulong, tcg_target_ulong,
                                     tcg_target_ulong, tcg_target_ulong);
 #endif
 
+__thread uintptr_t tci_tb_ptr;
+
 static tcg_target_ulong tci_read_reg(const tcg_target_ulong *regs, TCGReg index)
 {
     tci_assert(index < TCG_TARGET_NB_REGS);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         TCGMemOpIdx oi;
 
-#if defined(GETPC)
-        tci_tb_ptr = (uintptr_t)tb_ptr;
-#endif
-
         /* Skip opcode and size entry. */
         tb_ptr += 2;
 
         switch (opc) {
         case INDEX_op_call:
             t0 = tci_read_ri(regs, &tb_ptr);
+            tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
                                           tci_read_reg(regs, TCG_REG_R1),
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128024814.2056958-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             TODO();
             break;
         case INDEX_op_ld16s_i32:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
             t0 = *tb_ptr++;
-- 
2.25.1

From: Stefan Weil <sw@weilnetz.de>

That TCG opcode is used by debian-buster (arm64) running ffmpeg:

qemu-aarch64 /usr/bin/ffmpeg -i theora.mkv theora.webm

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20210128020425.2055454-1-sw@weilnetz.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg8(regs, t0, *(uint8_t *)(t1 + t2));
             break;
         case INDEX_op_ld8s_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

For a 64-bit TCI, the upper bits of a 32-bit operation are
undefined (much like a native ppc64 32-bit operation).  It
simplifies everything if we don't force-extend the result.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 66 +++++++++++++++++++++++++------------------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_write_reg(tcg_target_ulong *regs, TCGReg index, tcg_target_ulong value)
     regs[index] = value;
 }
 
-static void
-tci_write_reg32(tcg_target_ulong *regs, TCGReg index, uint32_t value)
-{
-    tci_write_reg(regs, index, value);
-}
-
 #if TCG_TARGET_REG_BITS == 32
 static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
                             uint32_t low_index, uint64_t value)
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare32(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp64 = tci_read_r64(regs, &tb_ptr);
             v64 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg32(regs, t0, tci_compare64(tmp64, v64, condition));
+            tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
 #elif TCG_TARGET_REG_BITS == 64
         case INDEX_op_setcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_i32(&tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i32:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 / (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 / t2);
+            tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, (int32_t)t1 % (int32_t)t2);
+            tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 % t2);
+            tci_write_reg(regs, t0, t1 % t2);
             break;
 #elif TCG_TARGET_HAS_div2_i32
         case INDEX_op_div2_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (32 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 << (t2 & 31));
+            tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1 >> (t2 & 31));
+            tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ((int32_t)t1 >> (t2 & 31)));
+            tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, rol32(t1, t2 & 31));
+            tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
             t2 = tci_read_ri32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ror32(t1, t2 & 31));
+            tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp32 = (((1 << tmp8) - 1) << tmp16);
-            tci_write_reg32(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
+            tci_write_reg(regs, t0, (t1 & ~tmp32) | ((t2 << tmp16) & tmp32));
             break;
 #endif
         case INDEX_op_brcond_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i32
         case INDEX_op_ext16s_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8u_i32
         case INDEX_op_ext8u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i32
         case INDEX_op_ext16u_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_bswap16_i32
         case INDEX_op_bswap16_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i32
         case INDEX_op_bswap32_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i32
         case INDEX_op_not_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i32
         case INDEX_op_neg_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg32(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #if TCG_TARGET_REG_BITS == 64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg32(regs, t0, *(uint32_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
-- 
2.25.1

Note that we had two functions of the same name: a 32-bit version
which took two register numbers and a 64-bit version which was a
no-op wrapper for tcg_write_reg.  After this, we are left with
only the 32-bit version.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 60 +++++++++++++++++++++++++------------------------------
 1 file changed, 27 insertions(+), 33 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static void tci_write_reg64(tcg_target_ulong *regs, uint32_t high_index,
     tci_write_reg(regs, low_index, value);
     tci_write_reg(regs, high_index, value >> 32);
 }
-#elif TCG_TARGET_REG_BITS == 64
-static void
-tci_write_reg64(tcg_target_ulong *regs, TCGReg index, uint64_t value)
-{
-    tci_write_reg(regs, index, value);
-}
 #endif
 
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t1 = tci_read_r64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
             condition = *tb_ptr++;
-            tci_write_reg64(regs, t0, tci_compare64(t1, t2, condition));
+            tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
 #endif
         case INDEX_op_mov_i32:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_mov_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
         case INDEX_op_tci_movi_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_i64(&tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 
             /* Load/store operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg64(regs, t0, *(uint64_t *)(t1 + t2));
+            tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
         case INDEX_op_st8_i64:
             t0 = tci_read_r8(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 + t2);
+            tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 - t2);
+            tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 * t2);
+            tci_write_reg(regs, t0, t1 * t2);
             break;
 #if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 & t2);
+            tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 | t2);
+            tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 ^ t2);
+            tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
             /* Shift/rotate operations (64 bit). */
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 << (t2 & 63));
+            tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1 >> (t2 & 63));
+            tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ((int64_t)t1 >> (t2 & 63)));
+            tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, rol64(t1, t2 & 63));
+            tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
             t2 = tci_read_ri64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ror64(t1, t2 & 63));
+            tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
 #if TCG_TARGET_HAS_deposit_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp16 = *tb_ptr++;
             tmp8 = *tb_ptr++;
             tmp64 = (((1ULL << tmp8) - 1) << tmp16);
-            tci_write_reg64(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
+            tci_write_reg(regs, t0, (t1 & ~tmp64) | ((t2 << tmp16) & tmp64));
             break;
 #endif
         case INDEX_op_brcond_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext8u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext8s_i64
         case INDEX_op_ext8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r8s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16s_i64
         case INDEX_op_ext16s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext16u_i64
         case INDEX_op_ext16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #endif
 #if TCG_TARGET_HAS_ext32s_i64
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_ext_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32s(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_ext32u_i64
         case INDEX_op_ext32u_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_extu_i32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, t1);
+            tci_write_reg(regs, t0, t1);
             break;
 #if TCG_TARGET_HAS_bswap16_i64
         case INDEX_op_bswap16_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r16(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap16(t1));
+            tci_write_reg(regs, t0, bswap16(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap32_i64
         case INDEX_op_bswap32_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap32(t1));
+            tci_write_reg(regs, t0, bswap32(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_bswap64_i64
         case INDEX_op_bswap64_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, bswap64(t1));
+            tci_write_reg(regs, t0, bswap64(t1));
             break;
 #endif
 #if TCG_TARGET_HAS_not_i64
         case INDEX_op_not_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, ~t1);
+            tci_write_reg(regs, t0, ~t1);
             break;
 #endif
 #if TCG_TARGET_HAS_neg_i64
         case INDEX_op_neg_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            tci_write_reg64(regs, t0, -t1);
+            tci_write_reg(regs, t0, -t1);
             break;
 #endif
 #endif /* TCG_TARGET_REG_BITS == 64 */
-- 
2.25.1

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
 # define qemu_st_beq(X)  stq_be_p(g2h(taddr), X)
 #endif
 
+#if TCG_TARGET_REG_BITS == 64
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i64): \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x) \
+        case glue(glue(INDEX_op_, x), _i64):
+#else
+# define CASE_32_64(x) \
+        case glue(glue(INDEX_op_, x), _i32):
+# define CASE_64(x)
+#endif
+
 /* Interpret pseudo code in tb. */
 /*
  * Disable CFI checks.
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (32 bit). */
 
-        case INDEX_op_ld8u_i32:
+        CASE_32_64(ld8u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld8s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld8s_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld8s_i32:
-            TODO();
+        CASE_32_64(ld8s)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
         case INDEX_op_ld16u_i32:
             TODO();
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld8s_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Eliminating a TODO for ld16u_i32.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(int8_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16u_i32:
-            TODO();
+        CASE_32_64(ld16u)
+            t0 = *tb_ptr++;
+            t1 = tci_read_r(regs, &tb_ptr);
+            t2 = tci_read_s32(&tb_ptr);
+            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
         case INDEX_op_ld16s_i32:
             t0 = *tb_ptr++;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
-            break;
         case INDEX_op_ld16s_i64:
             TODO();
             break;
-- 
2.25.1

Eliminating a TODO for ld16s_i64.

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint16_t *)(t1 + t2));
             break;
-        case INDEX_op_ld16s_i32:
+        CASE_32_64(ld16s)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld16s_i64:
-            TODO();
-            break;
         case INDEX_op_ld32u_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg(regs, t0, *(int16_t *)(t1 + t2));
             break;
         case INDEX_op_ld_i32:
+        CASE_64(ld32u)
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld32u_i64:
-            t0 = *tb_ptr++;
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
-            break;
         case INDEX_op_ld32s_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint32_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i32:
+        CASE_32_64(st8)
             t0 = tci_read_r8(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st8_i64:
-            t0 = tci_read_r8(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint8_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st16_i64:
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             *(uint8_t *)(t1 + t2) = t0;
             break;
-        case INDEX_op_st16_i32:
+        CASE_32_64(st16)
             t0 = tci_read_r16(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st16_i64:
-            t0 = tci_read_r16(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint16_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st32_i64:
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

The existing check was incomplete:
(1) Only applied to two of the 7 stores, and not to the loads at all.
(2) Only checked the upper, but not the lower bound of the stack.

Doing this at compile time means that we don't need to do it
at runtime as well.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                |  2 --
 tcg/tci/tcg-target.c.inc | 13 +++++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint32_t *)(t1 + t2) = t0;
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
-            tci_assert(t1 != sp_value || (int32_t)t2 < 0);
             *(uint64_t *)(t1 + t2) = t0;
             break;
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tci_out_label(TCGContext *s, TCGLabel *label)
     }
 }
 
+static void stack_bounds_check(TCGReg base, target_long offset)
+{
+    if (base == TCG_REG_CALL_STACK) {
+        tcg_debug_assert(offset < 0);
+        tcg_debug_assert(offset >= -(CPU_TEMP_BUF_NLONGS * sizeof(long)));
+    }
+}
+
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_ld_i32);
         tcg_out_r(s, ret);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
+        stack_bounds_check(args[1], args[2]);
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_debug_assert(args[2] == (int32_t)args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,
                        intptr_t arg2)
 {
     uint8_t *old_code_ptr = s->code_ptr;
+
+    stack_bounds_check(arg1, arg2);
     if (type == TCG_TYPE_I32) {
         tcg_out_op_t(s, INDEX_op_st_i32);
         tcg_out_r(s, arg);
-- 
2.25.1

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             *(uint16_t *)(t1 + t2) = t0;
             break;
         case INDEX_op_st_i32:
+        CASE_64(st32)
             t0 = tci_read_r32(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
             t2 = tci_read_s32(&tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_s32(&tb_ptr);
             tci_write_reg(regs, t0, *(uint64_t *)(t1 + t2));
             break;
-        case INDEX_op_st32_i64:
-            t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_r(regs, &tb_ptr);
-            t2 = tci_read_s32(&tb_ptr);
-            *(uint32_t *)(t1 + t2) = t0;
-            break;
         case INDEX_op_st_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
             t1 = tci_read_r(regs, &tb_ptr);
-- 
2.25.1

Three TODO instances are never happen cases.
Other uses of tcg_abort are also indicating unreachable cases.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ static bool tci_compare64(uint64_t u0, uint64_t u1, TCGCond condition)
         result = (u0 > u1);
         break;
     default:
-        TODO();
+        g_assert_not_reached();
     }
     return result;
 }
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp32 = qemu_ld_beul;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp32);
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tmp64 = qemu_ld_beq;
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             tci_write_reg(regs, t0, tmp64);
             if (TCG_TARGET_REG_BITS == 32) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_bel(t0);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_qemu_st_i64:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 qemu_st_beq(tmp64);
                 break;
             default:
-                tcg_abort();
+                g_assert_not_reached();
             }
             break;
         case INDEX_op_mb:
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             smp_mb();
             break;
         default:
-            TODO();
-            break;
+            g_assert_not_reached();
         }
         tci_assert(tb_ptr == old_code_ptr + op_size);
     }
-- 
2.25.1

We do not simultaneously support div and div2 -- it's one
or the other.  TCI is already using div, so remove div2.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 12 ------------
 tcg/tci/tcg-target.c.inc |  8 --------
 2 files changed, 20 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i32
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
-#elif TCG_TARGET_HAS_div2_i32
-        case INDEX_op_div2_i32:
-        case INDEX_op_divu2_i32:
-            TODO();
-            break;
-#endif
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_ri32(regs, &tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_remu_i64:
             TODO();
             break;
-#elif TCG_TARGET_HAS_div2_i64
-        case INDEX_op_div2_i64:
-        case INDEX_op_divu2_i64:
-            TODO();
-            break;
 #endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         TODO();
         break;
-    case INDEX_op_div2_i64:     /* Optional (TCG_TARGET_HAS_div2_i64). */
-    case INDEX_op_divu2_i64:    /* Optional (TCG_TARGET_HAS_div2_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_ri32(s, const_args[1], args[1]);
         tcg_out_ri32(s, const_args[2], args[2]);
         break;
-    case INDEX_op_div2_i32:     /* Optional (TCG_TARGET_HAS_div2_i32). */
-    case INDEX_op_divu2_i32:    /* Optional (TCG_TARGET_HAS_div2_i32). */
-        TODO();
-        break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
-- 
2.25.1

Trivially implemented like other arithmetic.
Tested via check-tcg and the ppc64 target.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     |  4 ++--
 tcg/tci.c                | 28 ++++++++++++++++++++++------
 tcg/tci/tcg-target.c.inc | 10 ++++------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_div_i64          0
-#define TCG_TARGET_HAS_rem_i64          0
+#define TCG_TARGET_HAS_div_i64          1
+#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             t2 = tci_read_ri64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
-#if TCG_TARGET_HAS_div_i64
         case INDEX_op_div_i64:
-        case INDEX_op_divu_i64:
-        case INDEX_op_rem_i64:
-        case INDEX_op_remu_i64:
-            TODO();
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
+            break;
+        case INDEX_op_divu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
+            break;
+        case INDEX_op_rem_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
+            break;
+        case INDEX_op_remu_i64:
+            t0 = *tb_ptr++;
+            t1 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_ri64(regs, &tb_ptr);
+            tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
-#endif
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_ri64(regs, &tb_ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
     case INDEX_op_rotr_i64:     /* Optional (TCG_TARGET_HAS_rot_i64). */
+    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
+    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
         tcg_out_ri64(s, const_args[2], args[2]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_debug_assert(args[4] <= UINT8_MAX);
         tcg_out8(s, args[4]);
         break;
-    case INDEX_op_div_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_divu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
-    case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
-        TODO();
-        break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_ri64(s, const_args[1], args[1]);
-- 
2.25.1

As noted in several comments, 8 regs is not enough for 32-bit
to perform calls, as currently implemented.  Shortly, we will
rearrange the encoding which will make 32 regs impossible.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target.h     | 32 +++++---------------------------
 tcg/tci/tcg-target.c.inc | 26 --------------------------
 2 files changed, 5 insertions(+), 53 deletions(-)

diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@
 #define TCG_TARGET_HAS_mulu2_i32        1
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
-/* Number of registers available.
-   For 32 bit hosts, we need more than 8 registers (call arguments). */
-/* #define TCG_TARGET_NB_REGS 8 */
+/* Number of registers available. */
 #define TCG_TARGET_NB_REGS 16
-/* #define TCG_TARGET_NB_REGS 32 */
 
 /* List of registers which are used by TCG. */
 typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#if TCG_TARGET_NB_REGS >= 32
-    TCG_REG_R16,
-    TCG_REG_R17,
-    TCG_REG_R18,
-    TCG_REG_R19,
-    TCG_REG_R20,
-    TCG_REG_R21,
-    TCG_REG_R22,
-    TCG_REG_R23,
-    TCG_REG_R24,
-    TCG_REG_R25,
-    TCG_REG_R26,
-    TCG_REG_R27,
-    TCG_REG_R28,
-    TCG_REG_R29,
-    TCG_REG_R30,
-    TCG_REG_R31,
-#endif
-#endif
+
+    TCG_AREG0 = TCG_REG_R14,
+    TCG_REG_CALL_STACK = TCG_REG_R15,
+
     /* Special value UINT8_MAX is used by TCI to encode constant values. */
     TCG_CONST = UINT8_MAX
 } TCGReg;
 
-#define TCG_AREG0                       (TCG_TARGET_NB_REGS - 2)
-
 /* Used for function call generation. */
-#define TCG_REG_CALL_STACK              (TCG_TARGET_NB_REGS - 1)
 #define TCG_TARGET_CALL_STACK_OFFSET    0
 #define TCG_TARGET_STACK_ALIGN          16
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R13,
     TCG_REG_R14,
     TCG_REG_R15,
-#endif
 };
 
 #if MAX_OPC_PARAM_IARGS != 6
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
     TCG_REG_R7,
-#if TCG_TARGET_NB_REGS >= 16
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
     TCG_REG_R12,
-#else
-# error Too few input registers available
-#endif
 #endif
 };
 
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r05",
     "r06",
     "r07",
-#if TCG_TARGET_NB_REGS >= 16
     "r08",
     "r09",
     "r10",
@@ -XXX,XX +XXX,XX @@ static const char *const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "r13",
     "r14",
     "r15",
-#if TCG_TARGET_NB_REGS >= 32
-    "r16",
-    "r17",
-    "r18",
-    "r19",
-    "r20",
-    "r21",
-    "r22",
-    "r23",
-    "r24",
-    "r25",
-    "r26",
-    "r27",
-    "r28",
-    "r29",
-    "r30",
-    "r31"
-#endif
-#endif
 };
 #endif
 
-- 
2.25.1

This was removed from tcg_target_reg_alloc_order and
tcg_target_call_iarg_regs on the assumption that it
was the stack.  This was incorrectly copied from i386.
For tci, the stack is R15.

By adding R4 back to tcg_target_call_iarg_regs, adjust the other
entries so that 6 (or 12) entries are still present in the array,
and adjust the numbers in the interpreter.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                | 8 ++++----
 tcg/tci/tcg-target.c.inc | 7 +------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
+                                          tci_read_reg(regs, TCG_REG_R4),
                                           tci_read_reg(regs, TCG_REG_R5),
                                           tci_read_reg(regs, TCG_REG_R6),
                                           tci_read_reg(regs, TCG_REG_R7),
                                           tci_read_reg(regs, TCG_REG_R8),
                                           tci_read_reg(regs, TCG_REG_R9),
                                           tci_read_reg(regs, TCG_REG_R10),
-                                          tci_read_reg(regs, TCG_REG_R11),
-                                          tci_read_reg(regs, TCG_REG_R12));
+                                          tci_read_reg(regs, TCG_REG_R11));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
             tci_write_reg(regs, TCG_REG_R1, tmp64 >> 32);
 #else
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                                           tci_read_reg(regs, TCG_REG_R1),
                                           tci_read_reg(regs, TCG_REG_R2),
                                           tci_read_reg(regs, TCG_REG_R3),
-                                          tci_read_reg(regs, TCG_REG_R5),
-                                          tci_read_reg(regs, TCG_REG_R6));
+                                          tci_read_reg(regs, TCG_REG_R4),
+                                          tci_read_reg(regs, TCG_REG_R5));
             tci_write_reg(regs, TCG_REG_R0, tmp64);
 #endif
             break;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_reg_alloc_order[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
     TCG_REG_R6,
     TCG_REG_R7,
@@ -XXX,XX +XXX,XX @@ static const int tcg_target_call_iarg_regs[] = {
     TCG_REG_R1,
     TCG_REG_R2,
     TCG_REG_R3,
-#if 0 /* used for TCG_REG_CALL_STACK */
     TCG_REG_R4,
-#endif
     TCG_REG_R5,
-    TCG_REG_R6,
 #if TCG_TARGET_REG_BITS == 32
     /* 32 bit hosts need 2 * MAX_OPC_PARAM_IARGS registers. */
+    TCG_REG_R6,
     TCG_REG_R7,
     TCG_REG_R8,
     TCG_REG_R9,
     TCG_REG_R10,
     TCG_REG_R11,
-    TCG_REG_R12,
 #endif
 };
 
-- 
2.25.1

Restrict all operands to registers.  All constants will be forced
into registers by the middle-end.  Removing the difference in how
immediate integers were encoded will allow more code to be shared
between 32-bit and 64-bit operations.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target-con-set.h |   6 +-
 tcg/tci/tcg-target.h         |   3 -
 tcg/tci.c                    | 189 +++++++++++++----------------------
 tcg/tci/tcg-target.c.inc     |  85 ++++------------
 4 files changed, 89 insertions(+), 194 deletions(-)

diff --git a/tcg/tci/tcg-target-con-set.h b/tcg/tci/tcg-target-con-set.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target-con-set.h
+++ b/tcg/tci/tcg-target-con-set.h
@@ -XXX,XX +XXX,XX @@
  * tcg-target-con-str.h; the constraint combination is inclusive or.
  */
 C_O0_I2(r, r)
-C_O0_I2(r, ri)
 C_O0_I3(r, r, r)
-C_O0_I4(r, r, ri, ri)
 C_O0_I4(r, r, r, r)
 C_O1_I1(r, r)
 C_O1_I2(r, 0, r)
-C_O1_I2(r, ri, ri)
 C_O1_I2(r, r, r)
-C_O1_I2(r, r, ri)
-C_O1_I4(r, r, r, ri, ri)
+C_O1_I4(r, r, r, r, r)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, r, r, r, r)
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
     TCG_AREG0 = TCG_REG_R14,
     TCG_REG_CALL_STACK = TCG_REG_R15,
-
-    /* Special value UINT8_MAX is used by TCI to encode constant values. */
-    TCG_CONST = UINT8_MAX
 } TCGReg;
 
 /* Used for function call generation. */
diff --git a/tcg/tci.c b/tcg/tci.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -XXX,XX +XXX,XX @@ tci_read_ulong(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
     return taddr;
 }
 
-/* Read indexed register or constant (native size) from bytecode. */
-static tcg_target_ulong
-tci_read_ri(const tcg_target_ulong *regs, const uint8_t **tb_ptr)
-{
-    tcg_target_ulong value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i(tb_ptr);
-    } else {
-        value = tci_read_reg(regs, r);
-    }
-    return value;
-}
-
-/* Read indexed register or constant (32 bit) from bytecode. */
-static uint32_t tci_read_ri32(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i32(tb_ptr);
-    } else {
-        value = tci_read_reg32(regs, r);
-    }
-    return value;
-}
-
-#if TCG_TARGET_REG_BITS == 32
-/* Read two indexed registers or constants (2 * 32 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint32_t low = tci_read_ri32(regs, tb_ptr);
-    return tci_uint64(tci_read_ri32(regs, tb_ptr), low);
-}
-#elif TCG_TARGET_REG_BITS == 64
-/* Read indexed register or constant (64 bit) from bytecode. */
-static uint64_t tci_read_ri64(const tcg_target_ulong *regs,
-                              const uint8_t **tb_ptr)
-{
-    uint64_t value;
-    TCGReg r = **tb_ptr;
-    *tb_ptr += 1;
-    if (r == TCG_CONST) {
-        value = tci_read_i64(tb_ptr);
-    } else {
-        value = tci_read_reg64(regs, r);
-    }
-    return value;
-}
-#endif
-
 static tcg_target_ulong tci_read_label(const uint8_t **tb_ptr)
 {
     tcg_target_ulong label = tci_read_i(tb_ptr);
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         switch (opc) {
         case INDEX_op_call:
-            t0 = tci_read_ri(regs, &tb_ptr);
+            t0 = tci_read_i(&tb_ptr);
             tci_tb_ptr = (uintptr_t)tb_ptr;
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = ((helper_function)t0)(tci_read_reg(regs, TCG_REG_R0),
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i32:
             t0 = *tb_ptr++;
             t1 = tci_read_r32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare32(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond2_i32:
             t0 = *tb_ptr++;
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(tmp64, v64, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
         case INDEX_op_setcond_i64:
             t0 = *tb_ptr++;
             t1 = tci_read_r64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             tci_write_reg(regs, t0, tci_compare64(t1, t2, condition));
             break;
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 / (int32_t)t2);
             break;
         case INDEX_op_divu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 / t2);
             break;
         case INDEX_op_rem_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int32_t)t1 % (int32_t)t2);
             break;
         case INDEX_op_remu_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 % t2);
             break;
         case INDEX_op_and_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 31));
             break;
         case INDEX_op_shr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 31));
             break;
         case INDEX_op_sar_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int32_t)t1 >> (t2 & 31)));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol32(t1, t2 & 31));
             break;
         case INDEX_op_rotr_i32:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri32(regs, &tb_ptr);
-            t2 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
+            t2 = tci_read_r32(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror32(t1, t2 & 31));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i32:
             t0 = tci_read_r32(regs, &tb_ptr);
-            t1 = tci_read_ri32(regs, &tb_ptr);
+            t1 = tci_read_r32(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare32(t0, t1, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
         case INDEX_op_brcond2_i32:
             tmp64 = tci_read_r64(regs, &tb_ptr);
-            v64 = tci_read_ri64(regs, &tb_ptr);
+            v64 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(tmp64, v64, condition)) {
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_add_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 + t2);
             break;
         case INDEX_op_sub_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 - t2);
             break;
         case INDEX_op_mul_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 * t2);
             break;
         case INDEX_op_div_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 / (int64_t)t2);
             break;
         case INDEX_op_divu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 / (uint64_t)t2);
             break;
         case INDEX_op_rem_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (int64_t)t1 % (int64_t)t2);
             break;
         case INDEX_op_remu_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, (uint64_t)t1 % (uint64_t)t2);
             break;
         case INDEX_op_and_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 & t2);
             break;
         case INDEX_op_or_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 | t2);
             break;
         case INDEX_op_xor_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 ^ t2);
             break;
 
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
         case INDEX_op_shl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 << (t2 & 63));
             break;
         case INDEX_op_shr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, t1 >> (t2 & 63));
             break;
         case INDEX_op_sar_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ((int64_t)t1 >> (t2 & 63)));
             break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, rol64(t1, t2 & 63));
             break;
         case INDEX_op_rotr_i64:
             t0 = *tb_ptr++;
-            t1 = tci_read_ri64(regs, &tb_ptr);
-            t2 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
+            t2 = tci_read_r64(regs, &tb_ptr);
             tci_write_reg(regs, t0, ror64(t1, t2 & 63));
             break;
 #endif
@@ -XXX,XX +XXX,XX @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #endif
         case INDEX_op_brcond_i64:
             t0 = tci_read_r64(regs, &tb_ptr);
-            t1 = tci_read_ri64(regs, &tb_ptr);
+            t1 = tci_read_r64(regs, &tb_ptr);
             condition = *tb_ptr++;
             label = tci_read_label(&tb_ptr);
             if (tci_compare64(t0, t1, condition)) {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_add_i32:
     case INDEX_op_add_i64:
     case INDEX_op_sub_i32:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
-        /* TODO: Does R, RI, RI result in faster code than R, R, RI? */
-        return C_O1_I2(r, ri, ri);
+    case INDEX_op_setcond_i32:
+    case INDEX_op_setcond_i64:
+        return C_O1_I2(r, r, r);
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
-        return C_O0_I2(r, ri);
-
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        return C_O1_I2(r, r, ri);
+        return C_O0_I2(r, r);
 
 #if TCG_TARGET_REG_BITS == 32
     /* TODO: Support R, R, R, R, RI, RI? Will it be faster? */
@@ -XXX,XX +XXX,XX @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, r, r, r, r);
     case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, ri, ri);
+        return C_O0_I4(r, r, r, r);
     case INDEX_op_mulu2_i32:
         return C_O2_I2(r, r, r, r);
     case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, ri, ri);
+        return C_O1_I4(r, r, r, r, r);
 #endif
 
     case INDEX_op_qemu_ld_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_r(TCGContext *s, TCGArg t0)
     tcg_out8(s, t0);
 }
 
-/* Write register or constant (native size). */
-static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out_i(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-/* Write register or constant (32 bit). */
-static void tcg_out_ri32(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out32(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-
-#if TCG_TARGET_REG_BITS == 64
-/* Write register or constant (64 bit). */
-static void tcg_out_ri64(TCGContext *s, int const_arg, TCGArg arg)
-{
-    if (const_arg) {
-        tcg_debug_assert(const_arg == 1);
-        tcg_out8(s, TCG_CONST);
-        tcg_out64(s, arg);
-    } else {
-        tcg_out_r(s, arg);
-    }
-}
-#endif
-
 /* Write label. */
 static void tci_out_label(TCGContext *s, TCGLabel *label)
 {
@@ -XXX,XX +XXX,XX @@ static inline void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg)
 {
     uint8_t *old_code_ptr = s->code_ptr;
     tcg_out_op_t(s, INDEX_op_call);
-    tcg_out_ri(s, 1, (uintptr_t)arg);
+    tcg_out_i(s, (uintptr_t)arg);
     old_code_ptr[1] = s->code_ptr - old_code_ptr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_setcond_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
         tcg_out_r(s, args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
-        tcg_out_ri32(s, const_args[4], args[4]);
+        tcg_out_r(s, args[3]);
+        tcg_out_r(s, args[4]);
         tcg_out8(s, args[5]);   /* condition */
         break;
 #elif TCG_TARGET_REG_BITS == 64
     case INDEX_op_setcond_i64:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[2]);
         tcg_out8(s, args[3]);   /* condition */
         break;
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rotl_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
     case INDEX_op_rotr_i32:     /* Optional (TCG_TARGET_HAS_rot_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i32:  /* Optional (TCG_TARGET_HAS_deposit_i32). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i64:      /* Optional (TCG_TARGET_HAS_div_i64). */
     case INDEX_op_remu_i64:     /* Optional (TCG_TARGET_HAS_div_i64). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
-        tcg_out_ri64(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
     case INDEX_op_deposit_i64:  /* Optional (TCG_TARGET_HAS_deposit_i64). */
         tcg_out_r(s, args[0]);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         break;
     case INDEX_op_brcond_i64:
         tcg_out_r(s, args[0]);
-        tcg_out_ri64(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_rem_i32:      /* Optional (TCG_TARGET_HAS_div_i32). */
     case INDEX_op_remu_i32:     /* Optional (TCG_TARGET_HAS_div_i32). */
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
+        tcg_out_r(s, args[1]);
+        tcg_out_r(s, args[2]);
         break;
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_add2_i32:
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_brcond2_i32:
         tcg_out_r(s, args[0]);
         tcg_out_r(s, args[1]);
-        tcg_out_ri32(s, const_args[2], args[2]);
-        tcg_out_ri32(s, const_args[3], args[3]);
+        tcg_out_r(s, args[2]);
+        tcg_out_r(s, args[3]);
         tcg_out8(s, args[4]);           /* condition */
         tci_out_label(s, arg_label(args[5]));
         break;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 #endif
     case INDEX_op_brcond_i32:
         tcg_out_r(s, args[0]);
-        tcg_out_ri32(s, const_args[1], args[1]);
+        tcg_out_r(s, args[1]);
         tcg_out8(s, args[2]);           /* condition */
         tci_out_label(s, arg_label(args[3]));
         break;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

The TCG-specific CPU methods will be moved to a separate struct,
to make it easier to move accel-specific code outside generic CPU
code in the future.  Start by moving tcg_initialize().

The new CPUClass.tcg_opts field may eventually become a pointer,
but keep it an embedded struct for now, to make code conversion
easier.

From: Claudio Fontana <cfontana@suse.de>

for now only TCG is allowed as an accelerator for riscv,
so remove the CONFIG_TCG use.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-3-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-#ifdef CONFIG_TCG
     cc->tcg_ops.initialize = riscv_translate_init;
     cc->tlb_fill = riscv_cpu_tlb_fill;
-#endif
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

move away TCG-only code, make it compile only on TCG.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[claudio: moved the prototypes from hw/core/cpu.h to exec/cpu-all.h]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-4-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 11 +++++--
 include/hw/core/cpu.h  |  2 ++
 accel/tcg/cpu-exec.c   | 28 +++++++++++++++++
 cpu.c                  | 70 ++++++++++++++++++++----------------------
 hw/core/cpu.c          |  6 +++-
 5 files changed, 77 insertions(+), 40 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -XXX,XX +XXX,XX @@ static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
 }
 
 #ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
 void dump_drift_info(void);
+/* accel/tcg/translate-all.c */
 void dump_exec_info(void);
 void dump_opcount_info(void);
 #endif /* CONFIG_TCG */
 
 #endif /* !CONFIG_USER_ONLY */
 
+#ifdef CONFIG_TCG
+/* accel/tcg/cpu-exec.c */
+int cpu_exec(CPUState *cpu);
+void tcg_exec_realizefn(CPUState *cpu, Error **errp);
+void tcg_exec_unrealizefn(CPUState *cpu);
+#endif /* CONFIG_TCG */
+
 /* Returns: 0 on success, -1 on error */
 int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         void *ptr, target_ulong len, bool is_write);
 
-int cpu_exec(CPUState *cpu);
-
 /**
  * cpu_set_cpustate_pointers(cpu)
  * @cpu: The cpu object
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
 
 void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
+
+/* $(top_srcdir)/cpu.c */
 void cpu_exec_initfn(CPUState *cpu);
 void cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
     return ret;
 }
 
+void tcg_exec_realizefn(CPUState *cpu, Error **errp)
+{
+    static bool tcg_target_initialized;
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!tcg_target_initialized) {
+        cc->tcg_ops.initialize();
+        tcg_target_initialized = true;
+    }
+    tlb_init(cpu);
+    qemu_plugin_vcpu_init_hook(cpu);
+
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_init_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+}
+
+/* undo the initializations in reverse order */
+void tcg_exec_unrealizefn(CPUState *cpu)
+{
+#ifndef CONFIG_USER_ONLY
+    tcg_iommu_free_notifier_list(cpu);
+#endif /* !CONFIG_USER_ONLY */
+
+    qemu_plugin_vcpu_exit_hook(cpu);
+    tlb_destroy(cpu);
+}
+
 #ifndef CONFIG_USER_ONLY
 
 void dump_drift_info(void)
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
 };
 #endif
 
-void cpu_exec_unrealizefn(CPUState *cpu)
+void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    tlb_destroy(cpu);
-    cpu_list_remove(cpu);
+    cpu_list_add(cpu);
+
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_realizefn(cpu, errp);
+    }
+#endif /* CONFIG_TCG */
+
+#ifdef CONFIG_USER_ONLY
+    assert(cc->vmsd == NULL);
+#else
+    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
+        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
+    }
+    if (cc->vmsd != NULL) {
+        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
+    }
+#endif /* CONFIG_USER_ONLY */
+}
+
+void cpu_exec_unrealizefn(CPUState *cpu)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
 
 #ifdef CONFIG_USER_ONLY
     assert(cc->vmsd == NULL);
@@ -XXX,XX +XXX,XX @@ void cpu_exec_unrealizefn(CPUState *cpu)
     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
         vmstate_unregister(NULL, &vmstate_cpu_common, cpu);
     }
-    tcg_iommu_free_notifier_list(cpu);
 #endif
+#ifdef CONFIG_TCG
+    /* NB: errp parameter is unused currently */
+    if (tcg_enabled()) {
+        tcg_exec_unrealizefn(cpu);
+    }
+#endif /* CONFIG_TCG */
+
+    cpu_list_remove(cpu);
 }
 
 void cpu_exec_initfn(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 #endif
 }
 
-void cpu_exec_realizefn(CPUState *cpu, Error **errp)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-#ifdef CONFIG_TCG
-    static bool tcg_target_initialized;
-#endif /* CONFIG_TCG */
-
-    cpu_list_add(cpu);
-
-#ifdef CONFIG_TCG
-    if (tcg_enabled() && !tcg_target_initialized) {
-        tcg_target_initialized = true;
-        cc->tcg_ops.initialize();
-    }
-#endif /* CONFIG_TCG */
-    tlb_init(cpu);
-
-    qemu_plugin_vcpu_init_hook(cpu);
-
-#ifdef CONFIG_USER_ONLY
-    assert(cc->vmsd == NULL);
-#else /* !CONFIG_USER_ONLY */
-    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-        vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
-    }
-    if (cc->vmsd != NULL) {
-        vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
-    }
-
-    tcg_iommu_init_notifier_list(cpu);
-#endif
-}
-
 const char *parse_cpu_option(const char *cpu_option)
 {
     ObjectClass *oc;
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
     return target_words_bigendian();
 }
 
+/*
+ * XXX the following #if is always true because this is a common_ss
+ * module, so target CONFIG_* is never defined.
+ */
 #if !defined(CONFIG_USER_ONLY)
 GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 static void cpu_common_unrealizefn(DeviceState *dev)
 {
     CPUState *cpu = CPU(dev);
+
     /* NOTE: latest generic point before the cpu is fully unrealized */
     trace_fini_vcpu(cpu);
-    qemu_plugin_vcpu_exit_hook(cpu);
     cpu_exec_unrealizefn(cpu);
 }
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG, reworded comments]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-5-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 22 +++++++++++++---------
 accel/tcg/cpu-exec.c      |  4 ++--
 target/arm/cpu.c          |  4 +++-
 target/avr/cpu.c          |  2 +-
 target/hppa/cpu.c         |  2 +-
 target/i386/tcg/tcg-cpu.c |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/rx/cpu.c           |  2 +-
 target/sh4/cpu.c          |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/tricore/cpu.c      |  2 +-
 13 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      * Called when the first CPU is realized.
      */
     void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @synchronize_from_tb: Callback for synchronizing state from a TCG
- *       #TranslationBlock. This is called when we abandon execution
- *       of a TB before starting it, and must set all parts of the CPU
- *       state which the previous TB in the chain may not have updated.
- *       This always includes at least the program counter; some targets
- *       will need to do more. If this hook is not implemented then the
- *       default is to call @set_pc(tb->pc).
  * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
  *       address fault.  For system mode, if the access is valid, call
  *       tlb_set_page and return true; if the access is invalid, and
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->synchronize_from_tb) {
-            cc->synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops.synchronize_from_tb) {
+            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void arm_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_synchronize_from_tb(CPUState *cs,
         env->regs[15] = tb->pc;
     }
 }
+#endif /* CONFIG_TCG */
 
 static bool arm_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
-    cc->synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->synchronize_from_tb = avr_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->synchronize_from_tb = hppa_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
     cc->tlb_fill = hppa_cpu_tlb_fill;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->cpu_exec_enter = x86_cpu_exec_enter;
     cc->cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->synchronize_from_tb = mb_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tlb_fill = mb_cpu_tlb_fill;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+#ifdef CONFIG_TCG
 static void mips_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_synchronize_from_tb(CPUState *cs,
     env->hflags &= ~MIPS_HFLAG_BMASK;
     env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
 }
+#endif /* CONFIG_TCG */
 
 static bool mips_cpu_has_work(CPUState *cs)
 {
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
-    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->synchronize_from_tb = riscv_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->synchronize_from_tb = rx_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tlb_fill = superh_cpu_tlb_fill;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tlb_fill = sparc_cpu_tlb_fill;
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;
+    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
     cc->tlb_fill = tricore_cpu_tlb_fill;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[claudio: wrapped target code in CONFIG_TCG]
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-6-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 12 ++++++------
 accel/tcg/cpu-exec.c            | 12 ++++++------
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/arm/cpu64.c              |  5 ++++-
 target/arm/cpu_tcg.c            |  7 ++++++-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  6 +++---
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc | 16 ++++++++++------
 25 files changed, 54 insertions(+), 42 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     void (*synchronize_from_tb)(CPUState *cpu,
                                 const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_get_dynamic_xml: Callback to return dynamically generated XML for the
  *   gdb stub. Returns a pointer to the XML contents for the specified XML file
  *   or NULL if the CPU doesn't have a dynamically generated content for it.
- * @cpu_exec_enter: Callback for cpu_exec preparation.
- * @cpu_exec_exit: Callback for cpu_exec cleanup.
- * @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec.
  * @disas_set_info: Setup architecture specific components of disassembly info
  * @adjust_watchpoint_address: Perform a target-specific adjustment to an
  * address before attempting to match it against watchpoints.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char *gdb_core_xml_file;
     gchar * (*gdb_arch_name)(CPUState *cpu);
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
-    void (*cpu_exec_enter)(CPUState *cpu);
-    void (*cpu_exec_exit)(CPUState *cpu);
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_enter) {
-        cc->cpu_exec_enter(cpu);
+    if (cc->tcg_ops.cpu_exec_enter) {
+        cc->tcg_ops.cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->cpu_exec_exit) {
-        cc->cpu_exec_exit(cpu);
+    if (cc->tcg_ops.cpu_exec_exit) {
+        cc->tcg_ops.cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->cpu_exec_interrupt &&
-                cc->cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops.cpu_exec_interrupt &&
+                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
     cc->do_interrupt = alpha_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = alpha_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = arm_cpu_class_by_name;
     cc->has_work = arm_cpu_has_work;
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = arm_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = arm_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-    cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
+#ifdef CONFIG_TCG
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
     CPUClass *cc = CPU_GET_CLASS(cs);
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     }
     return ret;
 }
+#endif /* CONFIG_TCG */
 
 static void arm926_initfn(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = arm_v7m_cpu_do_interrupt;
 #endif
 
-    cc->cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifdef CONFIG_TCG
+    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#endif /* CONFIG_TCG */
+
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->has_work = avr_cpu_has_work;
     cc->do_interrupt = avr_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = avr_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
     cc->do_interrupt = cris_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = cris_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
     cc->do_interrupt = hppa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = hppa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
     cc->do_interrupt = x86_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->cpu_exec_enter = x86_cpu_exec_enter;
-    cc->cpu_exec_exit = x86_cpu_exec_exit;
+    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
     cc->do_interrupt = lm32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
     cc->do_interrupt = m68k_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = m68k_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = mb_cpu_has_work;
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
-    cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
     cc->do_interrupt = mips_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tlb_fill = mips_cpu_tlb_fill;
 #endif
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
     cc->do_interrupt = nios2_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = nios2_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
     cc->do_interrupt = riscv_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = riscv_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
     cc->do_interrupt = rx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = rx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
-    cc->cpu_exec_interrupt = s390_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
     cc->do_interrupt = superh_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
     cc->do_interrupt = sparc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = sparc_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
     cc->do_interrupt = tilegx_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
     cc->tlb_fill = tilegx_cpu_tlb_fill;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
     cc->do_interrupt = uc32_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = uc32_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
     cc->tlb_fill = uc32_cpu_tlb_fill;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
     cc->do_interrupt = xtensa_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
+    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset(DeviceState *dev)
 }
 
 #ifndef CONFIG_USER_ONLY
+
 static bool ppc_cpu_is_big_endian(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static bool ppc_cpu_is_big_endian(CPUState *cs)
     return !msr_le;
 }
 
+#ifdef CONFIG_TCG
 static void ppc_cpu_exec_enter(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_exec_exit(CPUState *cs)
         vhc->cpu_exec_exit(cpu->vhyp, cpu);
     }
 }
-#endif
+#endif /* CONFIG_TCG */
+
+#endif /* !CONFIG_USER_ONLY */
 
 static void ppc_cpu_instance_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
     cc->do_interrupt = ppc_cpu_do_interrupt;
-    cc->cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #endif
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
+    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
     cc->tlb_fill = ppc_cpu_tlb_fill;
-#endif
 #ifndef CONFIG_USER_ONLY
-    cc->cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->cpu_exec_exit = ppc_cpu_exec_exit;
-#endif
+    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
+    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+#endif /* !CONFIG_USER_ONLY */
+#endif /* CONFIG_TCG */
 
     cc->disas_set_info = ppc_disas_set_info;
 
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

[claudio: wrapped target code in CONFIG_TCG]

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-7-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h           | 21 ++++++++++++---------
 accel/tcg/cputlb.c              |  7 ++++---
 accel/tcg/user-exec.c           |  6 +++---
 target/alpha/cpu.c              |  2 +-
 target/arm/cpu.c                |  2 +-
 target/avr/cpu.c                |  2 +-
 target/cris/cpu.c               |  2 +-
 target/hppa/cpu.c               |  2 +-
 target/i386/tcg/tcg-cpu.c       |  2 +-
 target/lm32/cpu.c               |  2 +-
 target/m68k/cpu.c               |  2 +-
 target/microblaze/cpu.c         |  2 +-
 target/mips/cpu.c               |  2 +-
 target/moxie/cpu.c              |  2 +-
 target/nios2/cpu.c              |  2 +-
 target/openrisc/cpu.c           |  2 +-
 target/riscv/cpu.c              |  2 +-
 target/rx/cpu.c                 |  2 +-
 target/s390x/cpu.c              |  2 +-
 target/sh4/cpu.c                |  2 +-
 target/sparc/cpu.c              |  2 +-
 target/tilegx/cpu.c             |  2 +-
 target/tricore/cpu.c            |  2 +-
 target/unicore32/cpu.c          |  2 +-
 target/xtensa/cpu.c             |  2 +-
 target/ppc/translate_init.c.inc |  2 +-
 26 files changed, 42 insertions(+), 38 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
- * @tlb_fill: Callback for handling a softmmu tlb miss or user-only
- *       address fault.  For system mode, if the access is valid, call
- *       tlb_set_page and return true; if the access is invalid, and
- *       probe is true, return false; otherwise raise an exception and
- *       do not return.  For user-only mode, always raise an exception
- *       and do not return.
  * @get_phys_page_debug: Callback for obtaining a physical address.
  * @get_phys_page_attrs_debug: Callback for obtaining a physical address and the
  *       associated memory transaction attributes to use for the access.
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
     hwaddr (*get_phys_page_attrs_debug)(CPUState *cpu, vaddr addr,
                                         MemTxAttrs *attrs);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tlb_fill(cpu, addr, size, access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
+                              access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tlb_fill(cs, addr, fault_size, access_type,
-                              mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
+                                      mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tlb_fill(cpu, addr, fault_size, access_type,
-                         MMU_USER_IDX, false, ra);
+            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
+                                 MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tlb_fill = alpha_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.initialize = arm_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tlb_fill = arm_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tlb_fill = avr_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
     cc->tcg_ops.initialize = avr_cpu_tcg_init;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tlb_fill = cris_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tlb_fill = hppa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_hppa_cpu;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
     cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tlb_fill = x86_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->debug_excp_handler = breakpoint_handler;
 #endif
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tlb_fill = lm32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tlb_fill = m68k_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
     cc->do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tlb_fill = mb_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.initialize = mips_tcg_init;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tlb_fill = mips_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tlb_fill = moxie_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tlb_fill = nios2_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tlb_fill = openrisc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
     cc->tcg_ops.initialize = rx_translate_init;
-    cc->tlb_fill = rx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = s390_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tlb_fill = s390_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
 #endif
 
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tlb_fill = superh_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tlb_fill = sparc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tlb_fill = tilegx_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
     cc->tcg_ops.initialize = tilegx_tcg_init;
 }
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tlb_fill = uc32_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
     cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tlb_fill = xtensa_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tlb_fill = ppc_cpu_tlb_fill;
+    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-- 
2.25.1

From: Eduardo Habkost <ehabkost@redhat.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210204163931.7358-8-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 4 ++--
 accel/tcg/cpu-exec.c      | 4 ++--
 target/arm/cpu.c          | 2 +-
 target/i386/tcg/tcg-cpu.c | 2 +-
 target/lm32/cpu.c         | 2 +-
 target/s390x/cpu.c        | 2 +-
 target/xtensa/cpu.c       | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
 
 } TcgCpuOperations;
 
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @gdb_write_register: Callback for letting GDB write a register.
  * @debug_check_watchpoint: Callback: return true if the architectural
  *       watchpoint whose address has matched should really fire.
- * @debug_excp_handler: Callback for handling debug exceptions.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
     bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-    void (*debug_excp_handler)(CPUState *cpu);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->debug_excp_handler) {
-        cc->debug_excp_handler(cpu);
+    if (cc->tcg_ops.debug_excp_handler) {
+        cc->tcg_ops.debug_excp_handler(cpu);
     }
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->debug_excp_handler = arm_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void tcg_cpu_common_class_init(CPUClass *cc)
     cc->tcg_ops.initialize = tcg_x86_init;
     cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->debug_excp_handler = breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
 #endif
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->debug_excp_handler = lm32_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
     cc->tcg_ops.initialize = lm32_translate_init;
 }
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->write_elf64_note = s390_cpu_write_elf64_note;
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->debug_excp_handler = s390x_cpu_debug_excp_handler;
+    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
     cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->debug_excp_handler = xtensa_breakpoint_handler;
+    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
     cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cc->do_interrupt is in theory a TCG callback used in accel/tcg only,
to prepare the emulated architecture to take an interrupt as defined
in the hardware specifications,

but in reality the _do_interrupt style of functions in targets are
also occasionally reused by KVM to prepare the architecture state in a
similar way where userspace code has identified that it needs to
deliver an exception to the guest.

In the case of ARM, that includes:

1) the vcpu thread got a SIGBUS indicating a memory error,
   and we need to deliver a Synchronous External Abort to the guest to
   let it know about the error.
2) the kernel told us about a debug exception (breakpoint, watchpoint)
   but it is not for one of QEMU's own gdbstub breakpoints/watchpoints
   so it must be a breakpoint the guest itself has set up, therefore
   we need to deliver it to the guest.

So in order to reuse code, the same arm_do_interrupt function is used.
This is all fine, but we need to avoid calling it using the callback
registered in CPUClass, since that one is now TCG-only.

Fortunately this is easily solved by replacing calls to
CPUClass::do_interrupt() with explicit calls to arm_do_interrupt().

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210204163931.7358-9-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 4 ++++
 target/arm/kvm64.c  | 6 ++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void handle_semihosting(CPUState *cs)
  * Do any appropriate logging, handle PSCI calls, and then hand off
  * to the AArch64-entry or AArch32-entry function depending on the
  * target exception level's register width.
+ *
+ * Note: this is used for both TCG (as the do_interrupt tcg op),
+ *       and KVM to re-inject guest debug exceptions, and to
+ *       inject a Synchronous-External-Abort.
  */
 void arm_cpu_do_interrupt(CPUState *cs)
 {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 {
     ARMCPU *cpu = ARM_CPU(c);
     CPUARMState *env = &cpu->env;
-    CPUClass *cc = CPU_GET_CLASS(c);
     uint32_t esr;
     bool same_el;
 
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 
     env->exception.syndrome = esr;
 
-    cc->do_interrupt(c);
+    arm_cpu_do_interrupt(c);
 }
 
 #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
 {
     int hsr_ec = syn_get_ec(debug_exit->hsr);
     ARMCPU *cpu = ARM_CPU(cs);
-    CPUClass *cc = CPU_GET_CLASS(cs);
     CPUARMState *env = &cpu->env;
 
     /* Ensure PC is synchronised */
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
     env->exception.vaddress = debug_exit->far;
     env->exception.target_el = 1;
     qemu_mutex_lock_iothread();
-    cc->do_interrupt(cs);
+    arm_cpu_do_interrupt(cs);
     qemu_mutex_unlock_iothread();
 
     return false;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*cpu_exec_exit)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /** @do_interrupt: Callback for interrupt handling. */
+    void (*do_interrupt)(CPUState *cpu);
     /**
      * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
      *
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_interrupt: Callback for interrupt handling.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
  * @do_transaction_failed: Callback for handling failed memory transactions
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_interrupt)(CPUState *cpu);
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->do_interrupt(cpu);
+        cc->tcg_ops.do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->do_interrupt(cpu);
+            cc->tcg_ops.do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->do_interrupt = alpha_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->do_interrupt(cs);
+    cc->tcg_ops.do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_cpu_do_interrupt;
     cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug;
     cc->asidx_from_attrs = arm_asidx_from_attrs;
     cc->vmsd = &vmstate_arm_cpu;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif
 }
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
 
     acc->info = data;
-#ifndef CONFIG_USER_ONLY
-    cc->do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
-
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
+#endif
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->do_interrupt = avr_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
     cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
 }
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->do_interrupt = cris_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->do_interrupt(cs);
+        cc->tcg_ops.do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->do_interrupt(cs);
+            cc->tcg_ops.do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->do_interrupt = hppa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->do_interrupt = x86_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->do_interrupt = lm32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->do_interrupt = m68k_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->do_interrupt = mb_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
     cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = mips_cpu_class_by_name;
     cc->has_work = mips_cpu_has_work;
-    cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = mips_cpu_disas_set_info;
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = mips_tcg_init;
+    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#endif
+#endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->do_interrupt = moxie_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
     cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->do_interrupt = nios2_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->do_interrupt = openrisc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->do_interrupt = riscv_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->do_interrupt = rx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
 #ifdef CONFIG_TCG
-    cc->do_interrupt = s390_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
 #endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->do_interrupt = superh_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->do_interrupt = sparc_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->do_interrupt = tilegx_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->do_interrupt = uc32_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->do_interrupt = xtensa_cpu_do_interrupt;
+    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
     cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->has_work = ppc_cpu_has_work;
-    cc->do_interrupt = ppc_cpu_do_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.initialize = ppc_translate_init;
     cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
+    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
     cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

[claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY]

avoiding its use in headers used by common_ss code (should be poisoned).

Note: need to be careful with the use of CONFIG_USER_ONLY,
Message-Id: <20210204163931.7358-11-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h     | 28 +++++++++++++---------------
 hw/mips/jazz.c            |  9 +++++++--
 target/alpha/cpu.c        |  2 +-
 target/arm/cpu.c          |  4 ++--
 target/m68k/cpu.c         |  2 +-
 target/microblaze/cpu.c   |  2 +-
 target/mips/cpu.c         |  4 +++-
 target/riscv/cpu.c        |  2 +-
 target/riscv/cpu_helper.c |  2 +-
 target/sparc/cpu.c        |  2 +-
 target/xtensa/cpu.c       |  2 +-
 target/xtensa/helper.c    |  4 ++--
 12 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     /** @debug_excp_handler: Callback for handling debug exceptions */
     void (*debug_excp_handler)(CPUState *cpu);
 
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @has_work: Callback for checking if there is work to do.
  * @do_unaligned_access: Callback for unaligned access handling, if
  * the target defines #TARGET_ALIGNED_ONLY.
- * @do_transaction_failed: Callback for handling failed memory transactions
- * (ie bus faults or external aborts; not MMU faults)
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-#ifdef NEED_CPU_H
-
-#ifdef CONFIG_SOFTMMU
 static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                         MMUAccessType access_type,
                                         int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) {
-        cc->do_transaction_failed(cpu, physaddr, addr, size, access_type,
-                                  mmu_idx, attrs, response, retaddr);
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops.do_transaction_failed) {
+        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
+                                          access_type, mmu_idx, attrs,
+                                          response, retaddr);
     }
 }
-#endif
-
-#endif /* NEED_CPU_H */
 
 /**
  * cpu_set_pc:
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps dma_dummy_ops = {
 #define MAGNUM_BIOS_SIZE_MAX 0x7e000
 #define MAGNUM_BIOS_SIZE                                                       \
         (BIOS_SIZE < MAGNUM_BIOS_SIZE_MAX ? BIOS_SIZE : MAGNUM_BIOS_SIZE_MAX)
+
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static void (*real_do_transaction_failed)(CPUState *cpu, hwaddr physaddr,
                                           vaddr addr, unsigned size,
                                           MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     (*real_do_transaction_failed)(cs, physaddr, addr, size, access_type,
                                   mmu_idx, attrs, response, retaddr);
 }
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void mips_jazz_init(MachineState *machine,
                            enum jazz_model_e jazz_model)
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      * memory region that catches all memory accesses, as we do on Malta.
      */
     cc = CPU_GET_CLASS(cpu);
-    real_do_transaction_failed = cc->do_transaction_failed;
-    cc->do_transaction_failed = mips_jazz_do_transaction_failed;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
     memory_region_add_subregion(address_space, 0, machine->ram);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = alpha_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
     cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
     cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
-    cc->do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-#endif
+#endif /* CONFIG_TCG */
 }
 
 #ifdef CONFIG_KVM
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->do_transaction_failed = m68k_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = mb_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = mips_cpu_do_transaction_failed;
     cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
     cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
+#ifndef CONFIG_USER_ONLY
+    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+#endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
     cc->gdb_num_core_regs = 73;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = riscv_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
     cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     env->badaddr = addr;
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
 
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_transaction_failed = sparc_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
     cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->do_transaction_failed = xtensa_cpu_do_transaction_failed;
+    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
     cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -XXX,XX +XXX,XX @@ bool xtensa_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     cpu_loop_exit_restore(cs, retaddr);
 }
 
-#else
+#else /* !CONFIG_USER_ONLY */
 
 void xtensa_cpu_do_unaligned_access(CPUState *cs,
                                     vaddr addr, MMUAccessType access_type,
@@ -XXX,XX +XXX,XX @@ void xtensa_runstall(CPUXtensaState *env, bool runstall)
         qemu_cpu_kick(cpu);
     }
 }
-#endif
+#endif /* !CONFIG_USER_ONLY */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

make it consistently SOFTMMU-only.

[claudio: make the field presence in cpu.h unconditional, removing the ifdefs]
Message-Id: <20210204163931.7358-12-cfontana@suse.de>

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
                                   unsigned size, MMUAccessType access_type,
                                   int mmu_idx, MemTxAttrs attrs,
                                   MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @has_work: Callback for checking if there is work to do.
- * @do_unaligned_access: Callback for unaligned access handling, if
- * the target defines #TARGET_ALIGNED_ONLY.
  * @virtio_is_big_endian: Callback to return %true if a CPU which supports
  * runtime configurable endianness is currently big-endian. Non-configurable
  * CPUs can use the default implementation of this method. This method should
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
 
     int reset_dump_flags;
     bool (*has_work)(CPUState *cpu);
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
     bool (*virtio_is_big_endian)(CPUState *cpu);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, int len, bool is_write);
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
 }
 
 static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->do_unaligned_access = alpha_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
     cc->debug_check_watchpoint = arm_debug_check_watchpoint;
-    cc->do_unaligned_access = arm_cpu_do_unaligned_access;
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_disas_set_info(CPUState *cs, disassemble_info *info)
     info->print_insn = print_insn_hppa;
 }
 
+#ifndef CONFIG_USER_ONLY
 static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                          MMUAccessType access_type,
                                          int mmu_idx, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 
     cpu_loop_exit_restore(cs, retaddr);
 }
+#endif /* CONFIG_USER_ONLY */
 
 static void hppa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
+    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
-    cc->do_unaligned_access = hppa_cpu_do_unaligned_access;
     cc->disas_set_info = hppa_cpu_disas_set_info;
     cc->tcg_ops.initialize = hppa_translate_init;
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
     cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = mips_cpu_do_unaligned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_mips_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
+    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
+
 #endif /* CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->disas_set_info = nios2_cpu_disas_set_info;
     cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = nios2_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->do_unaligned_access = riscv_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 #ifdef CONFIG_TCG
     cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
     cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->do_unaligned_access = s390x_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
 #endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/excp_helper.c
+++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
     }
 }
 
-#endif /* CONFIG_USER_ONLY */
+#endif /* !CONFIG_USER_ONLY */
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = superh_cpu_gdb_write_register;
     cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = superh_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->do_unaligned_access = sparc_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;
+    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
     cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->set_pc = ppc_cpu_set_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
-    cc->do_unaligned_access = ppc_cpu_do_unaligned_access;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
     cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
+    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

cpu_check_watchpoint, watchpoint_address_matches are TCG-only.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-13-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/physmem.c | 141 +++++++++++++++++++++++-----------------------
 1 file changed, 72 insertions(+), 69 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
     }
 }
 
+#ifdef CONFIG_TCG
 /* Return true if this watchpoint address matches the specified
  * access (ie the address range covered by the watchpoint overlaps
  * partially or completely with the address range covered by the
@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len)
     return ret;
 }
 
+/* Generate a debug exception if a watchpoint has been hit.  */
+void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
+                          MemTxAttrs attrs, int flags, uintptr_t ra)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUWatchpoint *wp;
+
+    assert(tcg_enabled());
+    if (cpu->watchpoint_hit) {
+        /*
+         * We re-entered the check after replacing the TB.
+         * Now raise the debug interrupt so that it will
+         * trigger after the current instruction.
+         */
+        qemu_mutex_lock_iothread();
+        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
+        qemu_mutex_unlock_iothread();
+        return;
+    }
+
+    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
+        if (watchpoint_address_matches(wp, addr, len)
+            && (wp->flags & flags)) {
+            if (replay_running_debug()) {
+                /*
+                 * Don't process the watchpoints when we are
+                 * in a reverse debugging operation.
+                 */
+                replay_breakpoint();
+                return;
+            }
+            if (flags == BP_MEM_READ) {
+                wp->flags |= BP_WATCHPOINT_HIT_READ;
+            } else {
+                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
+            }
+            wp->hitaddr = MAX(addr, wp->vaddr);
+            wp->hitattrs = attrs;
+            if (!cpu->watchpoint_hit) {
+                if (wp->flags & BP_CPU &&
+                    !cc->debug_check_watchpoint(cpu, wp)) {
+                    wp->flags &= ~BP_WATCHPOINT_HIT;
+                    continue;
+                }
+                cpu->watchpoint_hit = wp;
+
+                mmap_lock();
+                tb_check_watchpoint(cpu, ra);
+                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
+                    cpu->exception_index = EXCP_DEBUG;
+                    mmap_unlock();
+                    cpu_loop_exit_restore(cpu, ra);
+                } else {
+                    /* Force execution of one insn next time.  */
+                    cpu->cflags_next_tb = 1 | curr_cflags();
+                    mmap_unlock();
+                    if (ra) {
+                        cpu_restore_state(cpu, ra, true);
+                    }
+                    cpu_loop_exit_noexc(cpu);
+                }
+            }
+        } else {
+            wp->flags &= ~BP_WATCHPOINT_HIT;
+        }
+    }
+}
+
+#endif /* CONFIG_TCG */
+
 /* Called from RCU critical section */
 static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
 {
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
     return block->offset + offset;
 }
 
-/* Generate a debug exception if a watchpoint has been hit.  */
-void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
-                          MemTxAttrs attrs, int flags, uintptr_t ra)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    CPUWatchpoint *wp;
-
-    assert(tcg_enabled());
-    if (cpu->watchpoint_hit) {
-        /*
-         * We re-entered the check after replacing the TB.
-         * Now raise the debug interrupt so that it will
-         * trigger after the current instruction.
-         */
-        qemu_mutex_lock_iothread();
-        cpu_interrupt(cpu, CPU_INTERRUPT_DEBUG);
-        qemu_mutex_unlock_iothread();
-        return;
-    }
-
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
-    QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
-        if (watchpoint_address_matches(wp, addr, len)
-            && (wp->flags & flags)) {
-            if (replay_running_debug()) {
-                /*
-                 * Don't process the watchpoints when we are
-                 * in a reverse debugging operation.
-                 */
-                replay_breakpoint();
-                return;
-            }
-            if (flags == BP_MEM_READ) {
-                wp->flags |= BP_WATCHPOINT_HIT_READ;
-            } else {
-                wp->flags |= BP_WATCHPOINT_HIT_WRITE;
-            }
-            wp->hitaddr = MAX(addr, wp->vaddr);
-            wp->hitattrs = attrs;
-            if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
-                    wp->flags &= ~BP_WATCHPOINT_HIT;
-                    continue;
-                }
-                cpu->watchpoint_hit = wp;
-
-                mmap_lock();
-                tb_check_watchpoint(cpu, ra);
-                if (wp->flags & BP_STOP_BEFORE_ACCESS) {
-                    cpu->exception_index = EXCP_DEBUG;
-                    mmap_unlock();
-                    cpu_loop_exit_restore(cpu, ra);
-                } else {
-                    /* Force execution of one insn next time.  */
-                    cpu->cflags_next_tb = 1 | curr_cflags();
-                    mmap_unlock();
-                    if (ra) {
-                        cpu_restore_state(cpu, ra, true);
-                    }
-                    cpu_loop_exit_noexc(cpu);
-                }
-            }
-        } else {
-            wp->flags &= ~BP_WATCHPOINT_HIT;
-        }
-    }
-}
-
 static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
                                  MemTxAttrs attrs, void *buf, hwaddr len);
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs")

introduced this ARM-specific, TCG-specific hack to adjust the address,
before checking it with cpu_check_watchpoint.

Make adjust_watchpoint_address optional and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-14-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 6 +++++-
 hw/core/cpu.c         | 6 ------
 softmmu/physmem.c     | 5 ++++-
 target/arm/cpu.c      | 2 +-
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
     void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
                                 MMUAccessType access_type,
                                 int mmu_idx, uintptr_t retaddr);
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     const char * (*gdb_get_dynamic_xml)(CPUState *cpu, const char *xmlname);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
     const char *deprecation_note;
     /* Keep non-pointer data at the end to minimize holes.  */
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static vaddr cpu_adjust_watchpoint_address(CPUState *cpu, vaddr addr, int len)
-{
-    return addr;
-}
-
 static Property cpu_common_props[] = {
 #ifndef CONFIG_USER_ONLY
     /* Create a memory property for softmmu CPU object,
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
     k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
-    k->adjust_watchpoint_address = cpu_adjust_watchpoint_address;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    addr = cc->adjust_watchpoint_address(cpu, addr, len);
+    if (cc->tcg_ops.adjust_watchpoint_address) {
+        /* this is currently used only by ARM BE32 */
+        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+    }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
             && (wp->flags & flags)) {
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #if !defined(CONFIG_USER_ONLY)
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->adjust_watchpoint_address = arm_adjust_watchpoint_address;
+    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
     cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

commit 568496c0c0f1 ("cpu: Add callback to check architectural") and
commit 3826121d9298 ("target-arm: Implement checking of fired")
introduced an ARM-specific hack for cpu_check_watchpoint.

Make debug_check_watchpoint optional, and move it to tcg_ops.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210204163931.7358-15-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 9 ++++++---
 accel/tcg/user-exec.c | 3 ++-
 hw/core/cpu.c         | 9 ---------
 softmmu/physmem.c     | 4 ++--
 target/arm/cpu.c      | 4 ++--
 5 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
      */
     vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
 
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
 } TcgCpuOperations;
 
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct TcgCpuOperations {
  *       a memory access with the specified memory transaction attributes.
  * @gdb_read_register: Callback for letting GDB read a register.
  * @gdb_write_register: Callback for letting GDB write a register.
- * @debug_check_watchpoint: Callback: return true if the architectural
- *       watchpoint whose address has matched should really fire.
  * @write_elf64_note: Callback for writing a CPU-specific ELF note to a
  * 64-bit VM coredump.
  * @write_elf32_qemunote: Callback for writing a CPU- and QEMU-specific ELF
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int (*asidx_from_attrs)(CPUState *cpu, MemTxAttrs attrs);
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc);
+    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
+                         MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -XXX,XX +XXX,XX @@ static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
     return 0;
 }
 
-static bool cpu_common_debug_check_watchpoint(CPUState *cpu, CPUWatchpoint *wp)
-{
-    /* If no extra check is required, QEMU watchpoint match can be considered
-     * as an architectural match.
-     */
-    return true;
-}
-
 static bool cpu_common_virtio_is_big_endian(CPUState *cpu)
 {
     return target_words_bigendian();
@@ -XXX,XX +XXX,XX @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->gdb_read_register = cpu_common_gdb_read_register;
     k->gdb_write_register = cpu_common_gdb_write_register;
     k->virtio_is_big_endian = cpu_common_virtio_is_big_endian;
-    k->debug_check_watchpoint = cpu_common_debug_check_watchpoint;
     set_bit(DEVICE_CATEGORY_CPU, dc->categories);
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU &&
-                    !cc->debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
+                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
     cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
     cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-    cc->debug_check_watchpoint = arm_debug_check_watchpoint;
 #if !defined(CONFIG_USER_ONLY)
+    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
     cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
     cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
     cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
+    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 }
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

we cannot in principle make the TCG Operations field definitions
conditional on CONFIG_TCG in code that is included by both common_ss
and specific_ss modules.

Therefore, what we can do safely to restrict the TCG fields to TCG-only
builds, is to move all tcg cpu operations into a separate header file,
which is only included by TCG, target-specific code.

This leaves just a NULL pointer in the cpu.h for the non-TCG builds.

This also tidies up the code in all targets a bit, having all TCG cpu
operations neatly contained by a dedicated data struct.

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUWatchpoint CPUWatchpoint;
 
 struct TranslationBlock;
 
-/**
- * struct TcgCpuOperations: TCG operations specific to a CPU class
- */
-typedef struct TcgCpuOperations {
-    /**
-     * @initialize: Initalize TCG state
-     *
-     * Called when the first CPU is realized.
-     */
-    void (*initialize)(void);
-    /**
-     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
-     *
-     * This is called when we abandon execution of a TB before starting it,
-     * and must set all parts of the CPU state which the previous TB in the
-     * chain may not have updated.
-     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
-     *
-     * If more state needs to be restored, the target must implement a
-     * function to restore all the state, and register it here.
-     */
-    void (*synchronize_from_tb)(CPUState *cpu,
-                                const struct TranslationBlock *tb);
-    /** @cpu_exec_enter: Callback for cpu_exec preparation */
-    void (*cpu_exec_enter)(CPUState *cpu);
-    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
-    void (*cpu_exec_exit)(CPUState *cpu);
-    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
-    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
-    /** @do_interrupt: Callback for interrupt handling. */
-    void (*do_interrupt)(CPUState *cpu);
-    /**
-     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
-     *
-     * For system mode, if the access is valid, call tlb_set_page
-     * and return true; if the access is invalid, and probe is
-     * true, return false; otherwise raise an exception and do
-     * not return.  For user-only mode, always raise an exception
-     * and do not return.
-     */
-    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
-                     MMUAccessType access_type, int mmu_idx,
-                     bool probe, uintptr_t retaddr);
-    /** @debug_excp_handler: Callback for handling debug exceptions */
-    void (*debug_excp_handler)(CPUState *cpu);
-
-    /**
-     * @do_transaction_failed: Callback for handling failed memory transactions
-     * (ie bus faults or external aborts; not MMU faults)
-     */
-    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
-                                  unsigned size, MMUAccessType access_type,
-                                  int mmu_idx, MemTxAttrs attrs,
-                                  MemTxResult response, uintptr_t retaddr);
-    /**
-     * @do_unaligned_access: Callback for unaligned access handling
-     */
-    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr);
-    /**
-     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
-     */
-    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
-
-    /**
-     * @debug_check_watchpoint: return true if the architectural
-     * watchpoint whose address has matched should really fire, used by ARM
-     */
-    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
-
-} TcgCpuOperations;
+/* see tcg-cpu-ops.h */
+struct TCGCPUOps;
 
 /**
  * CPUClass:
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
 
-    TcgCpuOperations tcg_ops;
+    /* when TCG is not available, this pointer is NULL */
+    struct TCGCPUOps *tcg_ops;
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
-static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
-                                        MMUAccessType access_type,
-                                        int mmu_idx, uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    cc->tcg_ops.do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
-}
-
-static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
-                                          vaddr addr, unsigned size,
-                                          MMUAccessType access_type,
-                                          int mmu_idx, MemTxAttrs attrs,
-                                          MemTxResult response,
-                                          uintptr_t retaddr)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    if (!cpu->ignore_memory_transaction_failures &&
-        cc->tcg_ops.do_transaction_failed) {
-        cc->tcg_ops.do_transaction_failed(cpu, physaddr, addr, size,
-                                          access_type, mmu_idx, attrs,
-                                          response, retaddr);
-    }
-}
-
 /**
  * cpu_set_pc:
  * @cpu: The CPU to set the program counter for.
diff --git a/include/hw/core/tcg-cpu-ops.h b/include/hw/core/tcg-cpu-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/tcg-cpu-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * TCG CPU-specific operations
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPU_OPS_H
+#define TCG_CPU_OPS_H
+
+#include "hw/core/cpu.h"
+
+struct TCGCPUOps {
+    /**
+     * @initialize: Initalize TCG state
+     *
+     * Called when the first CPU is realized.
+     */
+    void (*initialize)(void);
+    /**
+     * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
+     *
+     * This is called when we abandon execution of a TB before starting it,
+     * and must set all parts of the CPU state which the previous TB in the
+     * chain may not have updated.
+     * By default, when this is NULL, a call is made to @set_pc(tb->pc).
+     *
+     * If more state needs to be restored, the target must implement a
+     * function to restore all the state, and register it here.
+     */
+    void (*synchronize_from_tb)(CPUState *cpu,
+                                const struct TranslationBlock *tb);
+    /** @cpu_exec_enter: Callback for cpu_exec preparation */
+    void (*cpu_exec_enter)(CPUState *cpu);
+    /** @cpu_exec_exit: Callback for cpu_exec cleanup */
+    void (*cpu_exec_exit)(CPUState *cpu);
+    /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
+    bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /**
+     * @do_interrupt: Callback for interrupt handling.
+     *
+     * note that this is in general SOFTMMU only, but it actually isn't
+     * because of an x86 hack (accel/tcg/cpu-exec.c), so we cannot put it
+     * in the SOFTMMU section in general.
+     */
+    void (*do_interrupt)(CPUState *cpu);
+    /**
+     * @tlb_fill: Handle a softmmu tlb miss or user-only address fault
+     *
+     * For system mode, if the access is valid, call tlb_set_page
+     * and return true; if the access is invalid, and probe is
+     * true, return false; otherwise raise an exception and do
+     * not return.  For user-only mode, always raise an exception
+     * and do not return.
+     */
+    bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
+                     MMUAccessType access_type, int mmu_idx,
+                     bool probe, uintptr_t retaddr);
+    /** @debug_excp_handler: Callback for handling debug exceptions */
+    void (*debug_excp_handler)(CPUState *cpu);
+
+#ifdef NEED_CPU_H
+#ifdef CONFIG_SOFTMMU
+    /**
+     * @do_transaction_failed: Callback for handling failed memory transactions
+     * (ie bus faults or external aborts; not MMU faults)
+     */
+    void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr,
+                                  unsigned size, MMUAccessType access_type,
+                                  int mmu_idx, MemTxAttrs attrs,
+                                  MemTxResult response, uintptr_t retaddr);
+    /**
+     * @do_unaligned_access: Callback for unaligned access handling
+     */
+    void (*do_unaligned_access)(CPUState *cpu, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr);
+
+    /**
+     * @adjust_watchpoint_address: hack for cpu_check_watchpoint used by ARM
+     */
+    vaddr (*adjust_watchpoint_address)(CPUState *cpu, vaddr addr, int len);
+
+    /**
+     * @debug_check_watchpoint: return true if the architectural
+     * watchpoint whose address has matched should really fire, used by ARM
+     */
+    bool (*debug_check_watchpoint)(CPUState *cpu, CPUWatchpoint *wp);
+
+#endif /* CONFIG_SOFTMMU */
+#endif /* NEED_CPU_H */
+
+};
+
+#endif /* TCG_CPU_OPS_H */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline int r14_bank_number(int mode)
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);
 
+#ifdef CONFIG_TCG
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const struct TranslationBlock *tb);
+#endif /* CONFIG_TCG */
+
+
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
     FPROUNDING_POSINF,
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
                                TARGET_FMT_lx "] %s\n",
                                last_tb->tc.ptr, last_tb->pc,
                                lookup_symbol(last_tb->pc));
-        if (cc->tcg_ops.synchronize_from_tb) {
-            cc->tcg_ops.synchronize_from_tb(cpu, last_tb);
+        if (cc->tcg_ops->synchronize_from_tb) {
+            cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
             cc->set_pc(cpu, last_tb->pc);
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_enter(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_enter) {
-        cc->tcg_ops.cpu_exec_enter(cpu);
+    if (cc->tcg_ops->cpu_exec_enter) {
+        cc->tcg_ops->cpu_exec_enter(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_exec_exit(CPUState *cpu)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
-    if (cc->tcg_ops.cpu_exec_exit) {
-        cc->tcg_ops.cpu_exec_exit(cpu);
+    if (cc->tcg_ops->cpu_exec_exit) {
+        cc->tcg_ops->cpu_exec_exit(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
         }
     }
 
-    if (cc->tcg_ops.debug_excp_handler) {
-        cc->tcg_ops.debug_excp_handler(cpu);
+    if (cc->tcg_ops->debug_excp_handler) {
+        cc->tcg_ops->debug_excp_handler(cpu);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
            loop */
 #if defined(TARGET_I386)
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->tcg_ops.do_interrupt(cpu);
+        cc->tcg_ops->do_interrupt(cpu);
 #endif
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
         if (replay_exception()) {
             CPUClass *cc = CPU_GET_CLASS(cpu);
             qemu_mutex_lock_iothread();
-            cc->tcg_ops.do_interrupt(cpu);
+            cc->tcg_ops->do_interrupt(cpu);
             qemu_mutex_unlock_iothread();
             cpu->exception_index = -1;
 
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
            True when it is, and we should restart on a new TB,
            and via longjmp via cpu_loop_exit.  */
         else {
-            if (cc->tcg_ops.cpu_exec_interrupt &&
-                cc->tcg_ops.cpu_exec_interrupt(cpu, interrupt_request)) {
+            if (cc->tcg_ops->cpu_exec_interrupt &&
+                cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (need_replay_interrupt(interrupt_request)) {
                     replay_interrupt();
                 }
@@ -XXX,XX +XXX,XX @@ void tcg_exec_realizefn(CPUState *cpu, Error **errp)
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
     if (!tcg_target_initialized) {
-        cc->tcg_ops.initialize();
+        cc->tcg_ops->initialize();
         tcg_target_initialized = true;
     }
     tlb_init(cpu);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
@@ -XXX,XX +XXX,XX @@ static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tcg_ops.tlb_fill(cpu, addr, size,
-                              access_type, mmu_idx, false, retaddr);
+    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
+                               access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
+static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
+                                        MMUAccessType access_type,
+                                        int mmu_idx, uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+}
+
+static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
+                                          vaddr addr, unsigned size,
+                                          MMUAccessType access_type,
+                                          int mmu_idx, MemTxAttrs attrs,
+                                          MemTxResult response,
+                                          uintptr_t retaddr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (!cpu->ignore_memory_transaction_failures &&
+        cc->tcg_ops->do_transaction_failed) {
+        cc->tcg_ops->do_transaction_failed(cpu, physaddr, addr, size,
+                                           access_type, mmu_idx, attrs,
+                                           response, retaddr);
+    }
+}
+
 static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
             CPUState *cs = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tcg_ops.tlb_fill(cs, addr, fault_size, access_type,
-                                      mmu_idx, nonfault, retaddr)) {
+            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
+                                       mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
@@ -XXX,XX +XXX,XX @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info,
     clear_helper_retaddr();
 
     cc = CPU_GET_CLASS(cpu);
-    cc->tcg_ops.tlb_fill(cpu, address, 0, access_type,
-                         MMU_USER_IDX, false, pc);
+    cc->tcg_ops->tlb_fill(cpu, address, 0, access_type,
+                          MMU_USER_IDX, false, pc);
     g_assert_not_reached();
 }
 
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
         } else {
             CPUState *cpu = env_cpu(env);
             CPUClass *cc = CPU_GET_CLASS(cpu);
-            cc->tcg_ops.tlb_fill(cpu, addr, fault_size, access_type,
-                                 MMU_USER_IDX, false, ra);
+            cc->tcg_ops->tlb_fill(cpu, addr, fault_size, access_type,
+                                  MMU_USER_IDX, false, ra);
             g_assert_not_reached();
         }
     }
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/help_option.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 
 enum jazz_model_e {
     JAZZ_MAGNUM,
@@ -XXX,XX +XXX,XX @@ static void mips_jazz_init(MachineState *machine,
      */
     cc = CPU_GET_CLASS(cpu);
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    real_do_transaction_failed = cc->tcg_ops.do_transaction_failed;
-    cc->tcg_ops.do_transaction_failed = mips_jazz_do_transaction_failed;
+    real_do_transaction_failed = cc->tcg_ops->do_transaction_failed;
+    cc->tcg_ops->do_transaction_failed = mips_jazz_do_transaction_failed;
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
     /* allocate RAM */
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/cutils.h"
 #include "qemu/cacheflush.h"
 #include "cpu.h"
+
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
+
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "hw/qdev-core.h"
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
         return;
     }
 
-    if (cc->tcg_ops.adjust_watchpoint_address) {
+    if (cc->tcg_ops->adjust_watchpoint_address) {
         /* this is currently used only by ARM BE32 */
-        addr = cc->tcg_ops.adjust_watchpoint_address(cpu, addr, len);
+        addr = cc->tcg_ops->adjust_watchpoint_address(cpu, addr, len);
     }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
         if (watchpoint_address_matches(wp, addr, len)
@@ -XXX,XX +XXX,XX @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             wp->hitaddr = MAX(addr, wp->vaddr);
             wp->hitattrs = attrs;
             if (!cpu->watchpoint_hit) {
-                if (wp->flags & BP_CPU && cc->tcg_ops.debug_check_watchpoint &&
-                    !cc->tcg_ops.debug_check_watchpoint(cpu, wp)) {
+                if (wp->flags & BP_CPU && cc->tcg_ops->debug_check_watchpoint &&
+                    !cc->tcg_ops->debug_check_watchpoint(cpu, wp)) {
                     wp->flags &= ~BP_WATCHPOINT_HIT;
                     continue;
                 }
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps alpha_tcg_ops = {
+    .initialize = alpha_translate_init,
+    .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
+    .tlb_fill = alpha_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = alpha_cpu_do_interrupt,
+    .do_transaction_failed = alpha_cpu_do_transaction_failed,
+    .do_unaligned_access = alpha_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->has_work = alpha_cpu_has_work;
-    cc->tcg_ops.do_interrupt = alpha_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = alpha_cpu_exec_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = alpha_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = alpha_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = alpha_cpu_do_unaligned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
     cc->disas_set_info = alpha_cpu_disas_set_info;
-    cc->tcg_ops.initialize = alpha_translate_init;
 
+    cc->tcg_ops = &alpha_tcg_ops;
     cc->gdb_num_core_regs = 67;
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
 }
 
 #ifdef CONFIG_TCG
-static void arm_cpu_synchronize_from_tb(CPUState *cs,
-                                        const TranslationBlock *tb)
+void arm_cpu_synchronize_from_tb(CPUState *cs,
+                                 const TranslationBlock *tb)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  found:
     cs->exception_index = excp_idx;
     env->exception.target_el = target_el;
-    cc->tcg_ops.do_interrupt(cs);
+    cc->tcg_ops->do_interrupt(cs);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static gchar *arm_gdb_arch_name(CPUState *cs)
     return g_strdup("arm");
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_cpu_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = arm_disas_set_info;
+
 #ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = arm_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = arm_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = arm_cpu_tlb_fill;
-    cc->tcg_ops.debug_excp_handler = arm_debug_excp_handler;
-#if !defined(CONFIG_USER_ONLY)
-    cc->tcg_ops.do_interrupt = arm_cpu_do_interrupt;
-    cc->tcg_ops.do_transaction_failed = arm_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = arm_cpu_do_unaligned_access;
-    cc->tcg_ops.adjust_watchpoint_address = arm_adjust_watchpoint_address;
-    cc->tcg_ops.debug_check_watchpoint = arm_debug_check_watchpoint;
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+    cc->tcg_ops = &arm_tcg_ops;
 #endif /* CONFIG_TCG */
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "qemu/module.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_cpu_exec_interrupt;
-#endif /* CONFIG_TCG */
-
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 34;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+#endif /* CONFIG_TCG */
 #include "internals.h"
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_HARD
         && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     return ret;
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
+#ifdef CONFIG_TCG
+static struct TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .tlb_fill = arm_cpu_tlb_fill,
+    .debug_excp_handler = arm_debug_excp_handler,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 
     acc->info = data;
 #ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_interrupt = arm_v7m_cpu_do_interrupt;
-#endif
+    cc->tcg_ops = &arm_v7m_tcg_ops;
 #endif /* CONFIG_TCG */
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     qemu_fprintf(f, "\n");
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps avr_tcg_ops = {
+    .initialize = avr_cpu_tcg_init,
+    .synchronize_from_tb = avr_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = avr_cpu_exec_interrupt,
+    .tlb_fill = avr_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = avr_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void avr_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = avr_cpu_class_by_name;
 
     cc->has_work = avr_cpu_has_work;
-    cc->tcg_ops.do_interrupt = avr_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = avr_cpu_exec_interrupt;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->memory_rw_debug = avr_cpu_memory_rw_debug;
     cc->get_phys_page_debug = avr_cpu_get_phys_page_debug;
-    cc->tcg_ops.tlb_fill = avr_cpu_tlb_fill;
     cc->vmsd = &vms_avr_cpu;
     cc->disas_set_info = avr_cpu_disas_set_info;
-    cc->tcg_ops.initialize = avr_cpu_tcg_init;
-    cc->tcg_ops.synchronize_from_tb = avr_cpu_synchronize_from_tb;
     cc->gdb_read_register = avr_cpu_gdb_read_register;
     cc->gdb_write_register = avr_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 35;
     cc->gdb_core_xml_file = "avr-cpu.xml";
+    cc->tcg_ops = &avr_tcg_ops;
 }
 
 /*
diff --git a/target/avr/helper.c b/target/avr/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/address-spaces.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     if (interrupt_request & CPU_INTERRUPT_RESET) {
         if (cpu_interrupts_enabled(env)) {
             cs->exception_index = EXCP_RESET;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
 
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
             int index = ctz32(env->intsrc);
             cs->exception_index = EXCP_INT(index);
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_initfn(Object *obj)
 #endif
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps crisv10_tcg_ops = {
+    .initialize = cris_initialize_crisv10_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = crisv10_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static struct TCGCPUOps crisv32_tcg_ops = {
+    .initialize = cris_initialize_tcg,
+    .cpu_exec_interrupt = cris_cpu_exec_interrupt,
+    .tlb_fill = cris_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = cris_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 8;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 9;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 10;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 11;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void crisv17_cpu_class_init(ObjectClass *oc, void *data)
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 17;
-    cc->tcg_ops.do_interrupt = crisv10_cpu_do_interrupt;
     cc->gdb_read_register = crisv10_cpu_gdb_read_register;
-    cc->tcg_ops.initialize = cris_initialize_crisv10_tcg;
+    cc->tcg_ops = &crisv10_tcg_ops;
 }
 
 static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
 {
+    CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
     ccc->vr = 32;
+    cc->tcg_ops = &crisv32_tcg_ops;
 }
 
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->has_work = cris_cpu_has_work;
-    cc->tcg_ops.do_interrupt = cris_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = cris_cpu_exec_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = cris_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_cris_cpu;
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_stop_before_watchpoint = true;
 
     cc->disas_set_info = cris_disas_set_info;
-    cc->tcg_ops.initialize = cris_initialize_tcg;
 }
 
 #define DEFINE_CRIS_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/cris/helper.c b/target/cris/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "mmu.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         && (env->pregs[PR_CCS] & I_FLAG)
         && !env->locked_irq) {
         cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops.do_interrupt(cs);
+        cc->tcg_ops->do_interrupt(cs);
         ret = true;
     }
     if (interrupt_request & CPU_INTERRUPT_NMI) {
@@ -XXX,XX +XXX,XX @@ bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         }
         if ((env->pregs[PR_CCS] & m_flag_archval)) {
             cs->exception_index = EXCP_NMI;
-            cc->tcg_ops.do_interrupt(cs);
+            cc->tcg_ops->do_interrupt(cs);
             ret = true;
         }
     }
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *hppa_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_HPPA_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps hppa_tcg_ops = {
+    .initialize = hppa_translate_init,
+    .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
+    .tlb_fill = hppa_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = hppa_cpu_do_interrupt,
+    .do_unaligned_access = hppa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = hppa_cpu_class_by_name;
     cc->has_work = hppa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = hppa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = hppa_cpu_exec_interrupt;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = hppa_cpu_synchronize_from_tb;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = hppa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = hppa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_unaligned_access = hppa_cpu_do_unaligned_access;
     dc->vmsd = &vmstate_hppa_cpu;
 #endif
     cc->disas_set_info = hppa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = hppa_translate_init;
-
     cc->gdb_num_core_regs = 128;
+    cc->tcg_ops = &hppa_tcg_ops;
 }
 
 static const TypeInfo hppa_cpu_type_info = {
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps x86_tcg_ops = {
+    .initialize = tcg_x86_init,
+    .synchronize_from_tb = x86_cpu_synchronize_from_tb,
+    .cpu_exec_enter = x86_cpu_exec_enter,
+    .cpu_exec_exit = x86_cpu_exec_exit,
+    .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+    .do_interrupt = x86_cpu_do_interrupt,
+    .tlb_fill = x86_cpu_tlb_fill,
+#ifndef CONFIG_USER_ONLY
+    .debug_excp_handler = breakpoint_handler,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 void tcg_cpu_common_class_init(CPUClass *cc)
 {
-    cc->tcg_ops.do_interrupt = x86_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = x86_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = x86_cpu_synchronize_from_tb;
-    cc->tcg_ops.cpu_exec_enter = x86_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = x86_cpu_exec_exit;
-    cc->tcg_ops.initialize = tcg_x86_init;
-    cc->tcg_ops.tlb_fill = x86_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.debug_excp_handler = breakpoint_handler;
-#endif
+    cc->tcg_ops = &x86_tcg_ops;
 }
diff --git a/target/lm32/cpu.c b/target/lm32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/lm32/cpu.c
+++ b/target/lm32/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps lm32_tcg_ops = {
+    .initialize = lm32_translate_init,
+    .cpu_exec_interrupt = lm32_cpu_exec_interrupt,
+    .tlb_fill = lm32_cpu_tlb_fill,
+    .debug_excp_handler = lm32_debug_excp_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = lm32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 {
     LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = lm32_cpu_class_by_name;
     cc->has_work = lm32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = lm32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = lm32_cpu_exec_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
     cc->gdb_read_register = lm32_cpu_gdb_read_register;
     cc->gdb_write_register = lm32_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = lm32_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 7;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.debug_excp_handler = lm32_debug_excp_handler;
     cc->disas_set_info = lm32_cpu_disas_set_info;
-    cc->tcg_ops.initialize = lm32_translate_init;
+    cc->tcg_ops = &lm32_tcg_ops;
 }
 
 #define DEFINE_LM32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m68k_cpu = {
 };
 #endif
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps m68k_tcg_ops = {
+    .initialize = m68k_tcg_init,
+    .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
+    .tlb_fill = m68k_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = m68k_cpu_do_interrupt,
+    .do_transaction_failed = m68k_cpu_transaction_failed,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void m68k_cpu_class_init(ObjectClass *c, void *data)
 {
     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->has_work = m68k_cpu_has_work;
-    cc->tcg_ops.do_interrupt = m68k_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = m68k_cpu_exec_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = m68k_cpu_tlb_fill;
 #if defined(CONFIG_SOFTMMU)
-    cc->tcg_ops.do_transaction_failed = m68k_cpu_transaction_failed;
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_m68k_cpu;
 #endif
     cc->disas_set_info = m68k_cpu_disas_set_info;
-    cc->tcg_ops.initialize = m68k_tcg_init;
 
     cc->gdb_num_core_regs = 18;
+    cc->tcg_ops = &m68k_tcg_ops;
 }
 
 static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
     return object_class_by_name(TYPE_MICROBLAZE_CPU);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps mb_tcg_ops = {
+    .initialize = mb_tcg_init,
+    .synchronize_from_tb = mb_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mb_cpu_exec_interrupt,
+    .tlb_fill = mb_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = mb_cpu_do_interrupt,
+    .do_transaction_failed = mb_cpu_transaction_failed,
+    .do_unaligned_access = mb_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void mb_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = mb_cpu_class_by_name;
     cc->has_work = mb_cpu_has_work;
-    cc->tcg_ops.do_interrupt = mb_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mb_cpu_exec_interrupt;
+
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = mb_cpu_synchronize_from_tb;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = mb_cpu_tlb_fill;
+
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mb_cpu_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mb_cpu_do_unaligned_access;
     cc->get_phys_page_attrs_debug = mb_cpu_get_phys_page_attrs_debug;
     dc->vmsd = &vmstate_mb_cpu;
 #endif
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_num_core_regs = 32 + 27;
 
     cc->disas_set_info = mb_disas_set_info;
-    cc->tcg_ops.initialize = mb_tcg_init;
+    cc->tcg_ops = &mb_tcg_ops;
 }
 
 static const TypeInfo mb_cpu_type_info = {
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property mips_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+/*
+ * NB: cannot be const, as some elements are changed for specific
+ * mips hardware (see hw/mips/jazz.c).
+ */
+static struct TCGCPUOps mips_tcg_ops = {
+    .initialize = mips_tcg_init,
+    .synchronize_from_tb = mips_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = mips_cpu_exec_interrupt,
+    .tlb_fill = mips_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .do_interrupt = mips_cpu_do_interrupt,
+    .do_transaction_failed = mips_cpu_do_transaction_failed,
+    .do_unaligned_access = mips_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void mips_cpu_class_init(ObjectClass *c, void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->vmsd = &vmstate_mips_cpu;
 #endif
     cc->disas_set_info = mips_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = mips_tcg_init;
-    cc->tcg_ops.do_interrupt = mips_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = mips_cpu_exec_interrupt;
-    cc->tcg_ops.synchronize_from_tb = mips_cpu_synchronize_from_tb;
-    cc->tcg_ops.tlb_fill = mips_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = mips_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = mips_cpu_do_unaligned_access;
-
-#endif /* CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->gdb_num_core_regs = 73;
     cc->gdb_stop_before_watchpoint = true;
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &mips_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target/moxie/cpu.c b/target/moxie/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/moxie/cpu.c
+++ b/target/moxie/cpu.c
@@ -XXX,XX +XXX,XX @@ static ObjectClass *moxie_cpu_class_by_name(const char *cpu_model)
     return oc;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps moxie_tcg_ops = {
+    .initialize = moxie_translate_init,
+    .tlb_fill = moxie_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = moxie_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void moxie_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = moxie_cpu_class_by_name;
 
     cc->has_work = moxie_cpu_has_work;
-    cc->tcg_ops.do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = moxie_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_moxie_cpu;
 #endif
     cc->disas_set_info = moxie_cpu_disas_set_info;
-    cc->tcg_ops.initialize = moxie_translate_init;
+    cc->tcg_ops = &moxie_tcg_ops;
 }
 
 static void moxielite_initfn(Object *obj)
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property nios2_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps nios2_tcg_ops = {
+    .initialize = nios2_tcg_init,
+    .cpu_exec_interrupt = nios2_cpu_exec_interrupt,
+    .tlb_fill = nios2_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = nios2_cpu_do_interrupt,
+    .do_unaligned_access = nios2_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
 
 static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = nios2_cpu_class_by_name;
     cc->has_work = nios2_cpu_has_work;
-    cc->tcg_ops.do_interrupt = nios2_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = nios2_cpu_exec_interrupt;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
-    cc->tcg_ops.tlb_fill = nios2_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = nios2_cpu_do_unaligned_access;
     cc->get_phys_page_debug = nios2_cpu_get_phys_page_debug;
 #endif
     cc->gdb_read_register = nios2_cpu_gdb_read_register;
     cc->gdb_write_register = nios2_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 49;
-    cc->tcg_ops.initialize = nios2_tcg_init;
+    cc->tcg_ops = &nios2_tcg_ops;
 }
 
 static const TypeInfo nios2_cpu_type_info = {
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_any_initfn(Object *obj)
                       | (IMMUCFGR_NTS & (ctz32(TLB_SIZE) << 2));
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps openrisc_tcg_ops = {
+    .initialize = openrisc_translate_init,
+    .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
+    .tlb_fill = openrisc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = openrisc_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 {
     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->has_work = openrisc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = openrisc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = openrisc_cpu_exec_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = openrisc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
 #endif
     cc->gdb_num_core_regs = 32 + 3;
-    cc->tcg_ops.initialize = openrisc_translate_init;
     cc->disas_set_info = openrisc_disas_set_info;
+    cc->tcg_ops = &openrisc_tcg_ops;
 }
 
 /* Sort alphabetically by type name, except for "any". */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
     return NULL;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps riscv_tcg_ops = {
+    .initialize = riscv_translate_init,
+    .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
+    .tlb_fill = riscv_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = riscv_cpu_do_interrupt,
+    .do_transaction_failed = riscv_cpu_do_transaction_failed,
+    .do_unaligned_access = riscv_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = riscv_cpu_class_by_name;
     cc->has_work = riscv_cpu_has_work;
-    cc->tcg_ops.do_interrupt = riscv_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = riscv_cpu_exec_interrupt;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = riscv_cpu_synchronize_from_tb;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = riscv_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = riscv_cpu_do_unaligned_access;
     cc->get_phys_page_debug = riscv_cpu_get_phys_page_debug;
     /* For now, mark unmigratable: */
     cc->vmsd = &vmstate_riscv_cpu;
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
-    cc->tcg_ops.initialize = riscv_translate_init;
-    cc->tcg_ops.tlb_fill = riscv_cpu_tlb_fill;
+    cc->tcg_ops = &riscv_tcg_ops;
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_init(Object *obj)
     qdev_init_gpio_in(DEVICE(cpu), rx_cpu_set_irq, 2);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps rx_tcg_ops = {
+    .initialize = rx_translate_init,
+    .synchronize_from_tb = rx_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = rx_cpu_exec_interrupt,
+    .tlb_fill = rx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = rx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void rx_cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
 
     cc->class_by_name = rx_cpu_class_by_name;
     cc->has_work = rx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = rx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = rx_cpu_exec_interrupt;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = rx_cpu_synchronize_from_tb;
+
     cc->gdb_read_register = rx_cpu_gdb_read_register;
     cc->gdb_write_register = rx_cpu_gdb_write_register;
     cc->get_phys_page_debug = rx_cpu_get_phys_page_debug;
     cc->disas_set_info = rx_cpu_disas_set_info;
-    cc->tcg_ops.initialize = rx_translate_init;
-    cc->tcg_ops.tlb_fill = rx_cpu_tlb_fill;
 
     cc->gdb_num_core_regs = 26;
     cc->gdb_core_xml_file = "rx-core.xml";
+    cc->tcg_ops = &rx_tcg_ops;
 }
 
 static const TypeInfo rx_cpu_info = {
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_full(DeviceState *dev)
     return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
 }
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps s390_tcg_ops = {
+    .initialize = s390x_translate_init,
+    .tlb_fill = s390_cpu_tlb_fill,
+
+#if !defined(CONFIG_USER_ONLY)
+    .cpu_exec_interrupt = s390_cpu_exec_interrupt,
+    .do_interrupt = s390_cpu_do_interrupt,
+    .debug_excp_handler = s390x_cpu_debug_excp_handler,
+    .do_unaligned_access = s390x_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void s390_cpu_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *scc = S390_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     scc->reset = s390_cpu_reset;
     cc->class_by_name = s390_cpu_class_by_name,
     cc->has_work = s390_cpu_has_work;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.do_interrupt = s390_cpu_do_interrupt;
-#endif
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vmstate_s390_cpu;
     cc->get_crash_info = s390_cpu_get_crash_info;
     cc->write_elf64_note = s390_cpu_write_elf64_note;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.cpu_exec_interrupt = s390_cpu_exec_interrupt;
-    cc->tcg_ops.debug_excp_handler = s390x_cpu_debug_excp_handler;
-    cc->tcg_ops.do_unaligned_access = s390x_cpu_do_unaligned_access;
-#endif
 #endif
     cc->disas_set_info = s390_cpu_disas_set_info;
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = s390x_translate_init;
-    cc->tcg_ops.tlb_fill = s390_cpu_tlb_fill;
-#endif
-
     cc->gdb_num_core_regs = S390_NUM_CORE_REGS;
     cc->gdb_core_xml_file = "s390x-core64.xml";
     cc->gdb_arch_name = s390_gdb_arch_name;
 
     s390_cpu_model_class_register_props(oc);
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &s390_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo s390_cpu_type_info = {
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sh_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps superh_tcg_ops = {
+    .initialize = sh4_translate_init,
+    .synchronize_from_tb = superh_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = superh_cpu_exec_interrupt,
+    .tlb_fill = superh_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = superh_cpu_do_interrupt,
+    .do_unaligned_access = superh_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void superh_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->has_work = superh_cpu_has_work;
-    cc->tcg_ops.do_interrupt = superh_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = superh_cpu_exec_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = superh_cpu_synchronize_from_tb;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = superh_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = superh_cpu_do_unaligned_access;
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     cc->disas_set_info = superh_cpu_disas_set_info;
-    cc->tcg_ops.initialize = sh4_translate_init;
 
     cc->gdb_num_core_regs = 59;
 
     dc->vmsd = &vmstate_sh_cpu;
+    cc->tcg_ops = &superh_tcg_ops;
 }
 
 #define DEFINE_SUPERH_CPU_TYPE(type_name, cinit, initfn) \
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property sparc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps sparc_tcg_ops = {
+    .initialize = sparc_tcg_init,
+    .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
+    .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
+    .tlb_fill = sparc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = sparc_cpu_do_interrupt,
+    .do_transaction_failed = sparc_cpu_do_transaction_failed,
+    .do_unaligned_access = sparc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
     cc->has_work = sparc_cpu_has_work;
-    cc->tcg_ops.do_interrupt = sparc_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = sparc_cpu_exec_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = sparc_cpu_synchronize_from_tb;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
-    cc->tcg_ops.tlb_fill = sparc_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_transaction_failed = sparc_cpu_do_transaction_failed;
-    cc->tcg_ops.do_unaligned_access = sparc_cpu_do_unaligned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_sparc_cpu;
 #endif
     cc->disas_set_info = cpu_sparc_disas_set_info;
-    cc->tcg_ops.initialize = sparc_tcg_init;
 
 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
     cc->gdb_num_core_regs = 86;
 #else
     cc->gdb_num_core_regs = 72;
 #endif
+    cc->tcg_ops = &sparc_tcg_ops;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target/tilegx/cpu.c b/target/tilegx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tilegx/cpu.c
+++ b/target/tilegx/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool tilegx_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     return false;
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tilegx_tcg_ops = {
+    .initialize = tilegx_tcg_init,
+    .cpu_exec_interrupt = tilegx_cpu_exec_interrupt,
+    .tlb_fill = tilegx_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = tilegx_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void tilegx_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = tilegx_cpu_class_by_name;
     cc->has_work = tilegx_cpu_has_work;
-    cc->tcg_ops.do_interrupt = tilegx_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = tilegx_cpu_exec_interrupt;
     cc->dump_state = tilegx_cpu_dump_state;
     cc->set_pc = tilegx_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = tilegx_cpu_tlb_fill;
     cc->gdb_num_core_regs = 0;
-    cc->tcg_ops.initialize = tilegx_tcg_init;
+    cc->tcg_ops = &tilegx_tcg_ops;
 }
 
 static const TypeInfo tilegx_cpu_type_info = {
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tc27x_initfn(Object *obj)
     set_feature(&cpu->env, TRICORE_FEATURE_161);
 }
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps tricore_tcg_ops = {
+    .initialize = tricore_tcg_init,
+    .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
+    .tlb_fill = tricore_cpu_tlb_fill,
+};
+
 static void tricore_cpu_class_init(ObjectClass *c, void *data)
 {
     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
-    cc->tcg_ops.synchronize_from_tb = tricore_cpu_synchronize_from_tb;
     cc->get_phys_page_debug = tricore_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = tricore_tcg_init;
-    cc->tcg_ops.tlb_fill = tricore_cpu_tlb_fill;
+    cc->tcg_ops = &tricore_tcg_ops;
 }
 
 #define DEFINE_TRICORE_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_uc32_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps uc32_tcg_ops = {
+    .initialize = uc32_translate_init,
+    .cpu_exec_interrupt = uc32_cpu_exec_interrupt,
+    .tlb_fill = uc32_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = uc32_cpu_do_interrupt,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->has_work = uc32_cpu_has_work;
-    cc->tcg_ops.do_interrupt = uc32_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = uc32_cpu_exec_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
-    cc->tcg_ops.tlb_fill = uc32_cpu_tlb_fill;
     cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
-    cc->tcg_ops.initialize = uc32_translate_init;
     dc->vmsd = &vmstate_uc32_cpu;
+    cc->tcg_ops = &uc32_tcg_ops;
 }
 
 #define DEFINE_UNICORE32_CPU_TYPE(cpu_model, initfn) \
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_xtensa_cpu = {
     .unmigratable = 1,
 };
 
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps xtensa_tcg_ops = {
+    .initialize = xtensa_translate_init,
+    .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
+    .tlb_fill = xtensa_cpu_tlb_fill,
+    .debug_excp_handler = xtensa_breakpoint_handler,
+
+#ifndef CONFIG_USER_ONLY
+    .do_interrupt = xtensa_cpu_do_interrupt,
+    .do_transaction_failed = xtensa_cpu_do_transaction_failed,
+    .do_unaligned_access = xtensa_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+
 static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = xtensa_cpu_class_by_name;
     cc->has_work = xtensa_cpu_has_work;
-    cc->tcg_ops.do_interrupt = xtensa_cpu_do_interrupt;
-    cc->tcg_ops.cpu_exec_interrupt = xtensa_cpu_exec_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-    cc->tcg_ops.tlb_fill = xtensa_cpu_tlb_fill;
 #ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.do_unaligned_access = xtensa_cpu_do_unaligned_access;
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
-    cc->tcg_ops.do_transaction_failed = xtensa_cpu_do_transaction_failed;
 #endif
-    cc->tcg_ops.debug_excp_handler = xtensa_breakpoint_handler;
     cc->disas_set_info = xtensa_cpu_disas_set_info;
-    cc->tcg_ops.initialize = xtensa_translate_init;
     dc->vmsd = &vmstate_xtensa_cpu;
+    cc->tcg_ops = &xtensa_tcg_ops;
 }
 
 static const TypeInfo xtensa_cpu_type_info = {
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -XXX,XX +XXX,XX @@ static Property ppc_cpu_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+#ifdef CONFIG_TCG
+#include "hw/core/tcg-cpu-ops.h"
+
+static struct TCGCPUOps ppc_tcg_ops = {
+  .initialize = ppc_translate_init,
+  .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
+  .tlb_fill = ppc_cpu_tlb_fill,
+
+#ifndef CONFIG_USER_ONLY
+  .do_interrupt = ppc_cpu_do_interrupt,
+  .cpu_exec_enter = ppc_cpu_exec_enter,
+  .cpu_exec_exit = ppc_cpu_exec_exit,
+  .do_unaligned_access = ppc_cpu_do_unaligned_access,
+#endif /* !CONFIG_USER_ONLY */
+};
+#endif /* CONFIG_TCG */
+
 static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->virtio_is_big_endian = ppc_cpu_is_big_endian;
 #endif
-#ifdef CONFIG_TCG
-    cc->tcg_ops.initialize = ppc_translate_init;
-    cc->tcg_ops.cpu_exec_interrupt = ppc_cpu_exec_interrupt;
-    cc->tcg_ops.do_interrupt = ppc_cpu_do_interrupt;
-    cc->tcg_ops.tlb_fill = ppc_cpu_tlb_fill;
-#ifndef CONFIG_USER_ONLY
-    cc->tcg_ops.cpu_exec_enter = ppc_cpu_exec_enter;
-    cc->tcg_ops.cpu_exec_exit = ppc_cpu_exec_exit;
-    cc->tcg_ops.do_unaligned_access = ppc_cpu_do_unaligned_access;
-#endif /* !CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
     cc->disas_set_info = ppc_disas_set_info;
 
     dc->fw_name = "PowerPC,UNKNOWN";
+
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &ppc_tcg_ops;
+#endif /* CONFIG_TCG */
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/exec/helper*.h
 F: include/exec/tb-hash.h
 F: include/sysemu/cpus.h
 F: include/sysemu/tcg.h
+F: include/hw/core/tcg-cpu-ops.h
 
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

[claudio: rebased on Richard's splitwx work]

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-17-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/boards.h                |  2 +-
 include/{sysemu => qemu}/accel.h   | 14 +++++----
 include/sysemu/hvf.h               |  2 +-
 include/sysemu/kvm.h               |  2 +-
 include/sysemu/kvm_int.h           |  2 +-
 target/i386/hvf/hvf-i386.h         |  2 +-
 accel/accel-common.c               | 50 ++++++++++++++++++++++++++++++
 accel/{accel.c => accel-softmmu.c} | 27 ++--------------
 accel/accel-user.c                 | 24 ++++++++++++++
 accel/qtest/qtest.c                |  2 +-
 accel/tcg/tcg-all.c                | 15 +++++++--
 accel/xen/xen-all.c                |  2 +-
 bsd-user/main.c                    |  6 +++-
 linux-user/main.c                  |  6 +++-
 softmmu/memory.c                   |  2 +-
 softmmu/qtest.c                    |  2 +-
 softmmu/vl.c                       |  2 +-
 target/i386/hax/hax-all.c          |  2 +-
 target/i386/hvf/hvf.c              |  2 +-
 target/i386/hvf/x86_task.c         |  2 +-
 target/i386/whpx/whpx-all.c        |  2 +-
 MAINTAINERS                        |  2 +-
 accel/meson.build                  |  4 ++-
 accel/tcg/meson.build              |  2 +-
 24 files changed, 125 insertions(+), 53 deletions(-)
 rename include/{sysemu => qemu}/accel.h (95%)
 create mode 100644 accel/accel-common.c
 rename accel/{accel.c => accel-softmmu.c} (75%)
 create mode 100644 accel/accel-user.c

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/blockdev.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-types-machine.h"
 #include "qemu/module.h"
 #include "qom/object.h"
diff --git a/include/sysemu/accel.h b/include/qemu/accel.h
similarity index 95%
rename from include/sysemu/accel.h
rename to include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#ifndef HW_ACCEL_H
-#define HW_ACCEL_H
+#ifndef QEMU_ACCEL_H
+#define QEMU_ACCEL_H
 
 #include "qom/object.h"
 #include "exec/hwaddr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     /*< public >*/
 
     const char *name;
-#ifndef CONFIG_USER_ONLY
     int (*init_machine)(MachineState *ms);
+#ifndef CONFIG_USER_ONLY
     void (*setup_post)(MachineState *ms, AccelState *accel);
     bool (*has_memory)(MachineState *ms, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
     OBJECT_GET_CLASS(AccelClass, (obj), TYPE_ACCEL)
 
 AccelClass *accel_find(const char *opt_name);
+AccelState *current_accel(void);
+
+#ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
 /* Called just before os_setup_post (ie just before drop OS privs) */
 void accel_setup_post(MachineState *ms);
+#endif /* !CONFIG_USER_ONLY */
 
-AccelState *current_accel(void);
-
-#endif
+#endif /* QEMU_ACCEL_H */
diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_H
 #define HVF_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef CONFIG_HVF
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/queue.h"
 #include "hw/core/cpu.h"
 #include "exec/memattrs.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "qom/object.h"
 
 #ifdef NEED_CPU_H
diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm_int.h
+++ b/include/sysemu/kvm_int.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_KVM_INT_H
 
 #include "exec/memory.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/kvm.h"
 
 typedef struct KVMSlot
diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-i386.h
+++ b/target/i386/hvf/hvf-i386.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_I386_H
 #define HVF_I386_H
 
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/hvf.h"
 #include "cpu.h"
 #include "x86.h"
diff --git a/accel/accel-common.c b/accel/accel-common.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, components common to system emulation and user mode
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2014 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+static const TypeInfo accel_type = {
+    .name = TYPE_ACCEL,
+    .parent = TYPE_OBJECT,
+    .class_size = sizeof(AccelClass),
+    .instance_size = sizeof(AccelState),
+};
+
+/* Lookup AccelClass from opt_name. Returns NULL if not found */
+AccelClass *accel_find(const char *opt_name)
+{
+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
+    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
+    g_free(class_name);
+    return ac;
+}
+
+static void register_accel_types(void)
+{
+    type_register_static(&accel_type);
+}
+
+type_init(register_accel_types);
diff --git a/accel/accel.c b/accel/accel-softmmu.c
similarity index 75%
rename from accel/accel.c
rename to accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 /*
- * QEMU System Emulator, accelerator interfaces
+ * QEMU accel class, system emulation components
  *
  * Copyright (c) 2003-2008 Fabrice Bellard
  * Copyright (c) 2014 Red Hat Inc.
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "qom/object.h"
 
-static const TypeInfo accel_type = {
-    .name = TYPE_ACCEL,
-    .parent = TYPE_OBJECT,
-    .class_size = sizeof(AccelClass),
-    .instance_size = sizeof(AccelState),
-};
-
-/* Lookup AccelClass from opt_name. Returns NULL if not found */
-AccelClass *accel_find(const char *opt_name)
-{
-    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
-    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
-    g_free(class_name);
-    return ac;
-}
-
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
     AccelClass *acc = ACCEL_GET_CLASS(accel);
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
-
-static void register_accel_types(void)
-{
-    type_register_static(&accel_type);
-}
-
-type_init(register_accel_types);
diff --git a/accel/accel-user.c b/accel/accel-user.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-user.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU accel class, user-mode components
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+
+AccelState *current_accel(void)
+{
+    static AccelState *accel;
+
+    if (!accel) {
+        AccelClass *ac = accel_find("tcg");
+
+        g_assert(ac != NULL);
+        accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
+    }
+    return accel;
+}
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/qtest.h"
 #include "sysemu/cpus.h"
 #include "sysemu/cpu-timers.h"
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/boards.h"
+#include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
+
+#ifndef CONFIG_USER_ONLY
 #include "tcg-cpus.h"
+#endif /* CONFIG_USER_ONLY */
 
 struct TCGState {
     AccelState parent_obj;
@@ -XXX,XX +XXX,XX @@ static void tcg_accel_instance_init(Object *obj)
     s->mttcg_enabled = default_mttcg_enabled();
 
     /* If debugging enabled, default "auto on", otherwise off. */
-#ifdef CONFIG_DEBUG_TCG
+#if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
     s->splitwx_enabled = -1;
 #else
     s->splitwx_enabled = 0;
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     mttcg_enabled = s->mttcg_enabled;
 
     /*
-     * Initialize TCG regions
+     * Initialize TCG regions only for softmmu.
+     *
+     * This needs to be done later for user mode, because the prologue
+     * generation needs to be delayed so that GUEST_BASE is already set.
      */
+#ifndef CONFIG_USER_ONLY
     tcg_region_init();
 
     if (mttcg_enabled) {
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
     } else {
         cpus_register_accel(&tcg_cpus_rr);
     }
+#endif /* !CONFIG_USER_ONLY */
+
     return 0;
 }
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/xen/xen-legacy-backend.h"
 #include "hw/xen/xen_pt.h"
 #include "chardev/char.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpus.h"
 #include "sysemu/xen.h"
 #include "sysemu/runstate.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <machine/trap.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     }
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/units.h"
+#include "qemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qemu-version.h"
 #include <sys/syscall.h>
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
     cpu_type = parse_cpu_option(cpu_model);
 
     /* init tcg before creating CPUs and to get qemu_host_page_size */
-    tcg_exec_init(0, false);
+    {
+        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
+        ac->init_machine(NULL);
+    }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
     cpu_reset(cpu);
diff --git a/softmmu/memory.c b/softmmu/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "sysemu/runstate.h"
 #include "sysemu/tcg.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/boards.h"
 #include "migration/vmstate.h"
 
diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/ioport.h"
 #include "exec/memory.h"
 #include "hw/irq.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/cpu-timers.h"
 #include "qemu/config-file.h"
 #include "qemu/option.h"
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/error-report.h"
 #include "qemu/sockets.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "hw/usb.h"
 #include "hw/isa/isa.h"
 #include "hw/scsi/scsi.h"
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 #include "hvf-cpus.h"
diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86_task.c
+++ b/target/i386/hvf/x86_task.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/i386/apic_internal.h"
 #include "qemu/main-loop.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
 // TODO: taskswitch handling
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "exec/ioport.h"
 #include "qemu-common.h"
-#include "sysemu/accel.h"
+#include "qemu/accel.h"
 #include "sysemu/whpx.h"
 #include "sysemu/cpus.h"
 #include "sysemu/runstate.h"
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Overall
 M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
-F: include/sysemu/accel.h
+F: include/qemu/accel.h
 F: accel/accel.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
diff --git a/accel/meson.build b/accel/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -XXX,XX +XXX,XX @@
-softmmu_ss.add(files('accel.c'))
+specific_ss.add(files('accel-common.c'))
+softmmu_ss.add(files('accel-softmmu.c'))
+user_ss.add(files('accel-user.c'))
 
 subdir('qtest')
 subdir('kvm')
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@
 tcg_ss = ss.source_set()
 tcg_ss.add(files(
+  'tcg-all.c',
   'cpu-exec-common.c',
   'cpu-exec.c',
   'tcg-runtime-gvec.c',
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
-  'tcg-all.c',
   'cputlb.c',
   'tcg-cpus.c',
   'tcg-cpus-mttcg.c',
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

This will allow us to centralize the registration of
the cpus.c module accelerator operations (in accel/accel-softmmu.c),
and trigger it automatically using object hierarchy lookup from the
new accel_init_interfaces() initialization step, depending just on
which accelerators are available in the code.

Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c,
kvm-accel-ops.c, etc, matching the object type names.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-18-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/accel-softmmu.h                         | 15 ++++++
 accel/kvm/kvm-cpus.h                          |  2 -
 ...g-cpus-icount.h => tcg-accel-ops-icount.h} |  2 +
 accel/tcg/tcg-accel-ops-mttcg.h               | 19 ++++++++
 .../tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} |  0
 accel/tcg/{tcg-cpus.h => tcg-accel-ops.h}     |  6 +--
 include/qemu/accel.h                          |  2 +
 include/sysemu/accel-ops.h                    | 45 ++++++++++++++++++
 include/sysemu/cpus.h                         | 26 ++--------
 .../i386/hax/{hax-cpus.h => hax-accel-ops.h}  |  2 -
 target/i386/hax/hax-windows.h                 |  2 +-
 .../i386/hvf/{hvf-cpus.h => hvf-accel-ops.h}  |  2 -
 .../whpx/{whpx-cpus.h => whpx-accel-ops.h}    |  2 -
 accel/accel-common.c                          | 11 +++++
 accel/accel-softmmu.c                         | 44 +++++++++++++++--
 accel/kvm/{kvm-cpus.c => kvm-accel-ops.c}     | 28 ++++++++---
 accel/kvm/kvm-all.c                           |  2 -
 accel/qtest/qtest.c                           | 23 ++++++---
 ...g-cpus-icount.c => tcg-accel-ops-icount.c} | 21 +++------
 ...tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} | 14 ++----
 .../tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} | 13 ++---
 accel/tcg/{tcg-cpus.c => tcg-accel-ops.c}     | 47 ++++++++++++++++++-
 accel/tcg/tcg-all.c                           | 12 -----
 accel/xen/xen-all.c                           | 24 ++++++----
 bsd-user/main.c                               |  3 +-
 linux-user/main.c                             |  1 +
 softmmu/cpus.c                                | 12 ++---
 softmmu/vl.c                                  |  7 ++-
 .../i386/hax/{hax-cpus.c => hax-accel-ops.c}  | 33 +++++++++----
 target/i386/hax/hax-all.c                     |  5 +-
 target/i386/hax/hax-mem.c                     |  2 +-
 target/i386/hax/hax-posix.c                   |  2 +-
 target/i386/hax/hax-windows.c                 |  2 +-
 .../i386/hvf/{hvf-cpus.c => hvf-accel-ops.c}  | 29 +++++++++---
 target/i386/hvf/hvf.c                         |  3 +-
 target/i386/hvf/x86hvf.c                      |  2 +-
 .../whpx/{whpx-cpus.c => whpx-accel-ops.c}    | 33 +++++++++----
 target/i386/whpx/whpx-all.c                   |  7 +--
 MAINTAINERS                                   |  3 +-
 accel/kvm/meson.build                         |  2 +-
 accel/tcg/meson.build                         |  8 ++--
 target/i386/hax/meson.build                   |  2 +-
 target/i386/hvf/meson.build                   |  2 +-
 target/i386/whpx/meson.build                  |  2 +-
 44 files changed, 361 insertions(+), 163 deletions(-)
 create mode 100644 accel/accel-softmmu.h
 rename accel/tcg/{tcg-cpus-icount.h => tcg-accel-ops-icount.h} (88%)
 create mode 100644 accel/tcg/tcg-accel-ops-mttcg.h
 rename accel/tcg/{tcg-cpus-rr.h => tcg-accel-ops-rr.h} (100%)
 rename accel/tcg/{tcg-cpus.h => tcg-accel-ops.h} (72%)
 create mode 100644 include/sysemu/accel-ops.h
 rename target/i386/hax/{hax-cpus.h => hax-accel-ops.h} (95%)
 rename target/i386/hvf/{hvf-cpus.h => hvf-accel-ops.h} (94%)
 rename target/i386/whpx/{whpx-cpus.h => whpx-accel-ops.h} (96%)
 rename accel/kvm/{kvm-cpus.c => kvm-accel-ops.c} (72%)
 rename accel/tcg/{tcg-cpus-icount.c => tcg-accel-ops-icount.c} (89%)
 rename accel/tcg/{tcg-cpus-mttcg.c => tcg-accel-ops-mttcg.c} (92%)
 rename accel/tcg/{tcg-cpus-rr.c => tcg-accel-ops-rr.c} (97%)
 rename accel/tcg/{tcg-cpus.c => tcg-accel-ops.c} (63%)
 rename target/i386/hax/{hax-cpus.c => hax-accel-ops.c} (69%)
 rename target/i386/hvf/{hvf-cpus.c => hvf-accel-ops.c} (84%)
 rename target/i386/whpx/{whpx-cpus.c => whpx-accel-ops.c} (71%)

diff --git a/accel/accel-softmmu.h b/accel/accel-softmmu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/accel-softmmu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulation accel internal functions
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_SOFTMMU_H
+#define ACCEL_SOFTMMU_H
+
+void accel_init_ops_interfaces(AccelClass *ac);
+
+#endif /* ACCEL_SOFTMMU_H */
diff --git a/accel/kvm/kvm-cpus.h b/accel/kvm/kvm-cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.h
+++ b/accel/kvm/kvm-cpus.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel kvm_cpus;
-
 int kvm_init_vcpu(CPUState *cpu, Error **errp);
 int kvm_cpu_exec(CPUState *cpu);
 void kvm_destroy_vcpu(CPUState *cpu);
diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-accel-ops-icount.h
similarity index 88%
rename from accel/tcg/tcg-cpus-icount.h
rename to accel/tcg/tcg-accel-ops-icount.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.h
+++ b/accel/tcg/tcg-accel-ops-icount.h
@@ -XXX,XX +XXX,XX @@ void icount_handle_deadline(void);
 void icount_prepare_for_run(CPUState *cpu);
 void icount_process_data(CPUState *cpu);
 
+void icount_handle_interrupt(CPUState *cpu, int mask);
+
 #endif /* TCG_CPUS_ICOUNT_H */
diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU TCG Multi Threaded vCPUs implementation
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef TCG_CPUS_MTTCG_H
+#define TCG_CPUS_MTTCG_H
+
+/* kick MTTCG vCPU thread */
+void mttcg_kick_vcpu_thread(CPUState *cpu);
+
+/* start an mttcg vCPU thread */
+void mttcg_start_vcpu_thread(CPUState *cpu);
+
+#endif /* TCG_CPUS_MTTCG_H */
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-accel-ops-rr.h
similarity index 100%
rename from accel/tcg/tcg-cpus-rr.h
rename to accel/tcg/tcg-accel-ops-rr.h
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-accel-ops.h
similarity index 72%
rename from accel/tcg/tcg-cpus.h
rename to accel/tcg/tcg-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.h
+++ b/accel/tcg/tcg-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel tcg_cpus_mttcg;
-extern const CpusAccel tcg_cpus_icount;
-extern const CpusAccel tcg_cpus_rr;
-
 void tcg_cpus_destroy(CPUState *cpu);
 int tcg_cpus_exec(CPUState *cpu);
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
+void tcg_handle_interrupt(CPUState *cpu, int mask);
 
 #endif /* TCG_CPUS_H */
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
 AccelClass *accel_find(const char *opt_name);
 AccelState *current_accel(void);
 
+void accel_init_interfaces(AccelClass *ac);
+
 #ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
diff --git a/include/sysemu/accel-ops.h b/include/sysemu/accel-ops.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/sysemu/accel-ops.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator OPS, used for cpus.c module
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_OPS_H
+#define ACCEL_OPS_H
+
+#include "qom/object.h"
+
+#define ACCEL_OPS_SUFFIX "-ops"
+#define TYPE_ACCEL_OPS "accel" ACCEL_OPS_SUFFIX
+#define ACCEL_OPS_NAME(name) (name "-" TYPE_ACCEL_OPS)
+
+typedef struct AccelOpsClass AccelOpsClass;
+DECLARE_CLASS_CHECKERS(AccelOpsClass, ACCEL_OPS, TYPE_ACCEL_OPS)
+
+/* cpus.c operations interface */
+struct AccelOpsClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    /* initialization function called when accel is chosen */
+    void (*ops_init)(AccelOpsClass *ops);
+
+    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY NON-NULL */
+    void (*kick_vcpu_thread)(CPUState *cpu);
+
+    void (*synchronize_post_reset)(CPUState *cpu);
+    void (*synchronize_post_init)(CPUState *cpu);
+    void (*synchronize_state)(CPUState *cpu);
+    void (*synchronize_pre_loadvm)(CPUState *cpu);
+
+    void (*handle_interrupt)(CPUState *cpu, int mask);
+
+    int64_t (*get_virtual_clock)(void);
+    int64_t (*get_elapsed_ticks)(void);
+};
+
+#endif /* ACCEL_OPS_H */
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_CPUS_H
 
 #include "qemu/timer.h"
+#include "sysemu/accel-ops.h"
 
-/* cpus.c */
+/* register accel-specific operations */
+void cpus_register_accel(const AccelOpsClass *i);
 
-/* CPU execution threads */
+/* accel/dummy-cpus.c */
 
-typedef struct CpusAccel {
-    void (*create_vcpu_thread)(CPUState *cpu); /* MANDATORY */
-    void (*kick_vcpu_thread)(CPUState *cpu);
-
-    void (*synchronize_post_reset)(CPUState *cpu);
-    void (*synchronize_post_init)(CPUState *cpu);
-    void (*synchronize_state)(CPUState *cpu);
-    void (*synchronize_pre_loadvm)(CPUState *cpu);
-
-    void (*handle_interrupt)(CPUState *cpu, int mask);
-
-    int64_t (*get_virtual_clock)(void);
-    int64_t (*get_elapsed_ticks)(void);
-} CpusAccel;
-
-/* register accel-specific cpus interface implementation */
-void cpus_register_accel(const CpusAccel *i);
-
-/* Create a dummy vcpu for CpusAccel->create_vcpu_thread */
+/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
 void dummy_start_vcpu_thread(CPUState *);
 
 /* interface available for cpus accelerator threads */
diff --git a/target/i386/hax/hax-cpus.h b/target/i386/hax/hax-accel-ops.h
similarity index 95%
rename from target/i386/hax/hax-cpus.h
rename to target/i386/hax/hax-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.h
+++ b/target/i386/hax/hax-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hax_cpus;
-
 #include "hax-interface.h"
 #include "hax-i386.h"
 
diff --git a/target/i386/hax/hax-windows.h b/target/i386/hax/hax-windows.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.h
+++ b/target/i386/hax/hax-windows.h
@@ -XXX,XX +XXX,XX @@
 #include <winioctl.h>
 #include <windef.h>
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define HAX_INVALID_FD INVALID_HANDLE_VALUE
 
diff --git a/target/i386/hvf/hvf-cpus.h b/target/i386/hvf/hvf-accel-ops.h
similarity index 94%
rename from target/i386/hvf/hvf-cpus.h
rename to target/i386/hvf/hvf-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.h
+++ b/target/i386/hvf/hvf-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel hvf_cpus;
-
 int hvf_init_vcpu(CPUState *);
 int hvf_vcpu_exec(CPUState *);
 void hvf_cpu_synchronize_state(CPUState *);
diff --git a/target/i386/whpx/whpx-cpus.h b/target/i386/whpx/whpx-accel-ops.h
similarity index 96%
rename from target/i386/whpx/whpx-cpus.h
rename to target/i386/whpx/whpx-accel-ops.h
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.h
+++ b/target/i386/whpx/whpx-accel-ops.h
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/cpus.h"
 
-extern const CpusAccel whpx_cpus;
-
 int whpx_init_vcpu(CPUState *cpu);
 int whpx_vcpu_exec(CPUState *cpu);
 void whpx_destroy_vcpu(CPUState *cpu);
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#ifndef CONFIG_USER_ONLY
+#include "accel-softmmu.h"
+#endif /* !CONFIG_USER_ONLY */
+
 static const TypeInfo accel_type = {
     .name = TYPE_ACCEL,
     .parent = TYPE_OBJECT,
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+void accel_init_interfaces(AccelClass *ac)
+{
+#ifndef CONFIG_USER_ONLY
+    accel_init_ops_interfaces(ac);
+#endif /* !CONFIG_USER_ONLY */
+}
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
diff --git a/accel/accel-softmmu.c b/accel/accel-softmmu.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-softmmu.c
+++ b/accel/accel-softmmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
-#include "sysemu/arch_init.h"
-#include "sysemu/sysemu.h"
-#include "qom/object.h"
+#include "sysemu/cpus.h"
+
+#include "accel-softmmu.h"
 
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
@@ -XXX,XX +XXX,XX @@ void accel_setup_post(MachineState *ms)
         acc->setup_post(ms, accel);
     }
 }
+
+/* initialize the arch-independent accel operation interfaces */
+void accel_init_ops_interfaces(AccelClass *ac)
+{
+    const char *ac_name;
+    char *ops_name;
+    AccelOpsClass *ops;
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    ops_name = g_strdup_printf("%s" ACCEL_OPS_SUFFIX, ac_name);
+    ops = ACCEL_OPS_CLASS(object_class_by_name(ops_name));
+    g_free(ops_name);
+
+    /*
+     * all accelerators need to define ops, providing at least a mandatory
+     * non-NULL create_vcpu_thread operation.
+     */
+    g_assert(ops != NULL);
+    if (ops->ops_init) {
+        ops->ops_init(ops);
+    }
+    cpus_register_accel(ops);
+}
+
+static const TypeInfo accel_ops_type_info = {
+    .name = TYPE_ACCEL_OPS,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelOpsClass),
+};
+
+static void accel_softmmu_register_types(void)
+{
+    type_register_static(&accel_ops_type_info);
+}
+type_init(accel_softmmu_register_types);
diff --git a/accel/kvm/kvm-cpus.c b/accel/kvm/kvm-accel-ops.c
similarity index 72%
rename from accel/kvm/kvm-cpus.c
rename to accel/kvm/kvm-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-cpus.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void kvm_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel kvm_cpus = {
-    .create_vcpu_thread = kvm_start_vcpu_thread,
+static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = kvm_cpu_synchronize_post_reset,
-    .synchronize_post_init = kvm_cpu_synchronize_post_init,
-    .synchronize_state = kvm_cpu_synchronize_state,
-    .synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = kvm_start_vcpu_thread;
+    ops->synchronize_post_reset = kvm_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
+    ops->synchronize_state = kvm_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo kvm_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("kvm"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = kvm_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void kvm_accel_ops_register_types(void)
+{
+    type_register_static(&kvm_accel_ops_type);
+}
+type_init(kvm_accel_ops_register_types);
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ static int kvm_init(MachineState *ms)
         ret = ram_block_discard_disable(true);
         assert(!ret);
     }
-
-    cpus_register_accel(&kvm_cpus);
     return 0;
 
 err:
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
 
-const CpusAccel qtest_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-    .get_virtual_clock = qtest_get_virtual_clock,
-};
-
 static int qtest_init_accel(MachineState *ms)
 {
-    cpus_register_accel(&qtest_cpus);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo qtest_accel_type = {
     .class_init = qtest_accel_class_init,
 };
 
+static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->get_virtual_clock = qtest_get_virtual_clock;
+};
+
+static const TypeInfo qtest_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("qtest"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = qtest_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void qtest_type_init(void)
 {
     type_register_static(&qtest_accel_type);
+    type_register_static(&qtest_accel_ops_type);
 }
 
 type_init(qtest_type_init);
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-accel-ops-icount.c
similarity index 89%
rename from accel/tcg/tcg-cpus-icount.c
rename to accel/tcg/tcg-accel-ops-icount.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-icount.h"
-#include "tcg-cpus-rr.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-icount.h"
+#include "tcg-accel-ops-rr.h"
 
 static int64_t icount_get_limit(void)
 {
@@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu)
     /*
      * These should always be cleared by icount_process_data after
      * each vCPU execution. However u16.high can be raised
-     * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
+     * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
      */
     g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
     g_assert(cpu->icount_extra == 0);
@@ -XXX,XX +XXX,XX @@ void icount_process_data(CPUState *cpu)
     replay_mutex_unlock();
 }
 
-static void icount_handle_interrupt(CPUState *cpu, int mask)
+void icount_handle_interrupt(CPUState *cpu, int mask)
 {
     int old_mask = cpu->interrupt_request;
 
-    tcg_cpus_handle_interrupt(cpu, mask);
+    tcg_handle_interrupt(cpu, mask);
     if (qemu_cpu_is_self(cpu) &&
         !cpu->can_do_io
         && (mask & ~old_mask) != 0) {
         cpu_abort(cpu, "Raised interrupt while not in I/O function");
     }
 }
-
-const CpusAccel tcg_cpus_icount = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = icount_handle_interrupt,
-    .get_virtual_clock = icount_get,
-    .get_elapsed_ticks = icount_get,
-};
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
similarity index 92%
rename from accel/tcg/tcg-cpus-mttcg.c
rename to accel/tcg/tcg-accel-ops-mttcg.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
 
 /*
  * In the multi-threaded case each vCPU has its own thread. The TLS
@@ -XXX,XX +XXX,XX @@ static void *mttcg_cpu_thread_fn(void *arg)
     return NULL;
 }
 
-static void mttcg_kick_vcpu_thread(CPUState *cpu)
+void mttcg_kick_vcpu_thread(CPUState *cpu)
 {
     cpu_exit(cpu);
 }
 
-static void mttcg_start_vcpu_thread(CPUState *cpu)
+void mttcg_start_vcpu_thread(CPUState *cpu)
 {
     char thread_name[VCPU_THREAD_NAME_SIZE];
 
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
     cpu->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
 }
-
-const CpusAccel tcg_cpus_mttcg = {
-    .create_vcpu_thread = mttcg_start_vcpu_thread,
-    .kick_vcpu_thread = mttcg_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-accel-ops-rr.c
similarity index 97%
rename from accel/tcg/tcg-cpus-rr.c
rename to accel/tcg/tcg-accel-ops-rr.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
-#include "tcg-cpus-rr.h"
-#include "tcg-cpus-icount.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* Kick all RR vCPUs */
 void rr_kick_vcpu_thread(CPUState *unused)
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
         cpu->created = true;
     }
 }
-
-const CpusAccel tcg_cpus_rr = {
-    .create_vcpu_thread = rr_start_vcpu_thread,
-    .kick_vcpu_thread = rr_kick_vcpu_thread,
-
-    .handle_interrupt = tcg_cpus_handle_interrupt,
-};
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-accel-ops.c
similarity index 63%
rename from accel/tcg/tcg-cpus.c
rename to accel/tcg/tcg-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-cpus.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/exec-all.h"
 #include "hw/boards.h"
 
-#include "tcg-cpus.h"
+#include "tcg-accel-ops.h"
+#include "tcg-accel-ops-mttcg.h"
+#include "tcg-accel-ops-rr.h"
+#include "tcg-accel-ops-icount.h"
 
 /* common functionality among all TCG variants */
 
@@ -XXX,XX +XXX,XX @@ int tcg_cpus_exec(CPUState *cpu)
 }
 
 /* mask must never be zero, except for A20 change call */
-void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
+void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
     g_assert(qemu_mutex_iothread_locked());
 
@@ -XXX,XX +XXX,XX @@ void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
         qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
     }
 }
+
+static void tcg_accel_ops_init(AccelOpsClass *ops)
+{
+    if (qemu_tcg_mttcg_enabled()) {
+        ops->create_vcpu_thread = mttcg_start_vcpu_thread;
+        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    } else if (icount_enabled()) {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = icount_handle_interrupt;
+        ops->get_virtual_clock = icount_get;
+        ops->get_elapsed_ticks = icount_get;
+    } else {
+        ops->create_vcpu_thread = rr_start_vcpu_thread;
+        ops->kick_vcpu_thread = rr_kick_vcpu_thread;
+        ops->handle_interrupt = tcg_handle_interrupt;
+    }
+}
+
+static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->ops_init = tcg_accel_ops_init;
+}
+
+static const TypeInfo tcg_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("tcg"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = tcg_accel_ops_class_init,
+    .abstract = true,
+};
+
+static void tcg_accel_ops_register_types(void)
+{
+    type_register_static(&tcg_accel_ops_type);
+}
+type_init(tcg_accel_ops_register_types);
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "qapi/qapi-builtin-visit.h"
 
-#ifndef CONFIG_USER_ONLY
-#include "tcg-cpus.h"
-#endif /* CONFIG_USER_ONLY */
-
 struct TCGState {
     AccelState parent_obj;
 
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
      */
 #ifndef CONFIG_USER_ONLY
     tcg_region_init();
-
-    if (mttcg_enabled) {
-        cpus_register_accel(&tcg_cpus_mttcg);
-    } else if (icount_enabled()) {
-        cpus_register_accel(&tcg_cpus_icount);
-    } else {
-        cpus_register_accel(&tcg_cpus_rr);
-    }
 #endif /* !CONFIG_USER_ONLY */
 
     return 0;
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -XXX,XX +XXX,XX @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
     }
 }
 
-const CpusAccel xen_cpus = {
-    .create_vcpu_thread = dummy_start_vcpu_thread,
-};
-
 static int xen_init(MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -XXX,XX +XXX,XX @@ static int xen_init(MachineState *ms)
      * opt out of system RAM being allocated by generic code
      */
     mc->default_ram_id = NULL;
-
-    cpus_register_accel(&xen_cpus);
-
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
+static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = dummy_start_vcpu_thread;
+}
+
+static const TypeInfo xen_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("xen"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = xen_accel_ops_class_init,
+    .abstract = true,
+};
+
 static void xen_type_init(void)
 {
     type_register_static(&xen_accel_type);
+    type_register_static(&xen_accel_ops_type);
 }
-
 type_init(xen_type_init);
diff --git a/bsd-user/main.c b/bsd-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 #endif
     }
 
+    cpu_type = parse_cpu_option(cpu_model);
     /* init tcg before creating CPUs and to get qemu_host_page_size */
     {
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
-    cpu_type = parse_cpu_option(cpu_model);
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         AccelClass *ac = ACCEL_GET_CLASS(current_accel());
 
         ac->init_machine(NULL);
+        accel_init_interfaces(ac);
     }
     cpu = cpu_create(cpu_type);
     env = cpu->env_ptr;
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -XXX,XX +XXX,XX @@ void hw_error(const char *fmt, ...)
 /*
  * The chosen accelerator is supposed to register this.
  */
-static const CpusAccel *cpus_accel;
+static const AccelOpsClass *cpus_accel;
 
 void cpu_synchronize_all_states(void)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_remove_sync(CPUState *cpu)
     qemu_mutex_lock_iothread();
 }
 
-void cpus_register_accel(const CpusAccel *ca)
+void cpus_register_accel(const AccelOpsClass *ops)
 {
-    assert(ca != NULL);
-    assert(ca->create_vcpu_thread != NULL); /* mandatory */
-    cpus_accel = ca;
+    assert(ops != NULL);
+    assert(ops->create_vcpu_thread != NULL); /* mandatory */
+    cpus_accel = ops;
 }
 
 void qemu_init_vcpu(CPUState *cpu)
@@ -XXX,XX +XXX,XX @@ void qemu_init_vcpu(CPUState *cpu)
         cpu_address_space_init(cpu, 0, "cpu-memory", cpu->memory);
     }
 
-    /* accelerators all implement the CpusAccel interface */
+    /* accelerators all implement the AccelOpsClass */
     g_assert(cpus_accel != NULL && cpus_accel->create_vcpu_thread != NULL);
     cpus_accel->create_vcpu_thread(cpu);
 
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_early(const char *type, QemuOpts *opts)
         return false;
     }
 
-    /* Allocation of large amounts of memory may delay
+    /*
+     * Allocation of large amounts of memory may delay
      * chardev initialization for too long, and trigger timeouts
      * on software that waits for a monitor socket to be created
      * (e.g. libvirt).
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
      *
      * Machine compat properties: object_set_machine_compat_props().
      * Accelerator compat props: object_set_accelerator_compat_props(),
-     * called from configure_accelerator().
+     * called from do_configure_accelerator().
      */
 
     machine_class = MACHINE_GET_CLASS(current_machine);
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)
     if (cpu_option) {
         current_machine->cpu_type = parse_cpu_option(cpu_option);
     }
+    /* NB: for machine none cpu_type could STILL be NULL here! */
+    accel_init_interfaces(ACCEL_GET_CLASS(current_machine->accelerator));
 
     qemu_resolve_machine_memdev();
     parse_numa_opts(current_machine);
diff --git a/target/i386/hax/hax-cpus.c b/target/i386/hax/hax-accel-ops.c
similarity index 69%
rename from target/i386/hax/hax-cpus.c
rename to target/i386/hax/hax-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-cpus.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/cpus.h"
 #include "qemu/guest-random.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 static void *hax_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void hax_start_vcpu_thread(CPUState *cpu)
 #endif
 }
 
-const CpusAccel hax_cpus = {
-    .create_vcpu_thread = hax_start_vcpu_thread,
-    .kick_vcpu_thread = hax_kick_vcpu_thread,
+static void hax_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hax_cpu_synchronize_post_reset,
-    .synchronize_post_init = hax_cpu_synchronize_post_init,
-    .synchronize_state = hax_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hax_start_vcpu_thread;
+    ops->kick_vcpu_thread = hax_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = hax_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hax_cpu_synchronize_post_init;
+    ops->synchronize_state = hax_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hax_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo hax_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hax"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hax_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void hax_accel_ops_register_types(void)
+{
+    type_register_static(&hax_accel_ops_type);
+}
+type_init(hax_accel_ops_register_types);
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/boards.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 #define DEBUG_HAX 0
 
@@ -XXX,XX +XXX,XX @@ static int hax_accel_init(MachineState *ms)
                 !ret ? "working" : "not working",
                 !ret ? "fast virt" : "emulation");
     }
-    if (ret == 0) {
-        cpus_register_accel(&hax_cpus);
-    }
     return ret;
 }
 
diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-mem.c
+++ b/target/i386/hax/hax-mem.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/error-report.h"
 
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 #include "qemu/queue.h"
 
 #define DEBUG_HAX_MEM 0
diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-posix.c
+++ b/target/i386/hax/hax-posix.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/ioctl.h>
 
 #include "sysemu/cpus.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 hax_fd hax_mod_open(void)
 {
diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/hax-windows.c
+++ b/target/i386/hax/hax-windows.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "hax-cpus.h"
+#include "hax-accel-ops.h"
 
 /*
  * return 0 when success, -1 when driver not loaded,
diff --git a/target/i386/hvf/hvf-cpus.c b/target/i386/hvf/hvf-accel-ops.c
similarity index 84%
rename from target/i386/hvf/hvf-cpus.c
rename to target/i386/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf-cpus.c
+++ b/target/i386/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 #include "target/i386/cpu.h"
 #include "qemu/guest-random.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 /*
  * The HVF-specific vCPU thread function. This one should only run when the host
@@ -XXX,XX +XXX,XX @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-const CpusAccel hvf_cpus = {
-    .create_vcpu_thread = hvf_start_vcpu_thread,
+static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = hvf_cpu_synchronize_post_reset,
-    .synchronize_post_init = hvf_cpu_synchronize_post_init,
-    .synchronize_state = hvf_cpu_synchronize_state,
-    .synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = hvf_start_vcpu_thread;
+
+    ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
+    ops->synchronize_state = hvf_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = hvf_cpu_synchronize_pre_loadvm;
 };
+static const TypeInfo hvf_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("hvf"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = hvf_accel_ops_class_init,
+    .abstract = true,
+};
+static void hvf_accel_ops_register_types(void)
+{
+    type_register_static(&hvf_accel_ops_type);
+}
+type_init(hvf_accel_ops_register_types);
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/accel.h"
 #include "target/i386/cpu.h"
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 HVFState *hvf_state;
 
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
   
     hvf_state = s;
     memory_listener_register(&hvf_memory_listener, &address_space_memory);
-    cpus_register_accel(&hvf_cpus);
     return 0;
 }
 
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -XXX,XX +XXX,XX @@
 #include <Hypervisor/hv.h>
 #include <Hypervisor/hv_vmx.h>
 
-#include "hvf-cpus.h"
+#include "hvf-accel-ops.h"
 
 void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr)
diff --git a/target/i386/whpx/whpx-cpus.c b/target/i386/whpx/whpx-accel-ops.c
similarity index 71%
rename from target/i386/whpx/whpx-cpus.c
rename to target/i386/whpx/whpx-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-cpus.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 
 #include "sysemu/whpx.h"
 #include "whpx-internal.h"
-#include "whpx-cpus.h"
+#include "whpx-accel-ops.h"
 
 static void *whpx_cpu_thread_fn(void *arg)
 {
@@ -XXX,XX +XXX,XX @@ static void whpx_kick_vcpu_thread(CPUState *cpu)
     }
 }
 
-const CpusAccel whpx_cpus = {
-    .create_vcpu_thread = whpx_start_vcpu_thread,
-    .kick_vcpu_thread = whpx_kick_vcpu_thread,
+static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
-    .synchronize_post_reset = whpx_cpu_synchronize_post_reset,
-    .synchronize_post_init = whpx_cpu_synchronize_post_init,
-    .synchronize_state = whpx_cpu_synchronize_state,
-    .synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm,
+    ops->create_vcpu_thread = whpx_start_vcpu_thread;
+    ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
+
+    ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
+    ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
+    ops->synchronize_state = whpx_cpu_synchronize_state;
+    ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
+}
+
+static const TypeInfo whpx_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("whpx"),
+
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = whpx_accel_ops_class_init,
+    .abstract = true,
 };
+
+static void whpx_accel_ops_register_types(void)
+{
+    type_register_static(&whpx_accel_ops_type);
+}
+type_init(whpx_accel_ops_register_types);
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/blocker.h"
 #include <winerror.h>
 
-#include "whpx-cpus.h"
 #include "whpx-internal.h"
+#include "whpx-accel-ops.h"
+
+#include <WinHvPlatform.h>
+#include <WinHvEmulation.h>
 
 #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
 
@@ -XXX,XX +XXX,XX @@ static int whpx_accel_init(MachineState *ms)
 
     whpx_memory_init();
 
-    cpus_register_accel(&whpx_cpus);
-
     printf("Windows Hypervisor Platform accelerator is operational\n");
     return 0;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
-F: accel/accel.c
+F: include/sysemu/accel-ops.h
+F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 
diff --git a/accel/kvm/meson.build b/accel/kvm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/meson.build
+++ b/accel/kvm/meson.build
@@ -XXX,XX +XXX,XX @@
 kvm_ss = ss.source_set()
 kvm_ss.add(files(
   'kvm-all.c',
-  'kvm-cpus.c',
+  'kvm-accel-ops.c',
 ))
 kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
 
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
 
 specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
-  'tcg-cpus.c',
-  'tcg-cpus-mttcg.c',
-  'tcg-cpus-icount.c',
-  'tcg-cpus-rr.c'
+  'tcg-accel-ops.c',
+  'tcg-accel-ops-mttcg.c',
+  'tcg-accel-ops-icount.c',
+  'tcg-accel-ops-rr.c'
 ))
diff --git a/target/i386/hax/meson.build b/target/i386/hax/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hax/meson.build
+++ b/target/i386/hax/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_HAX', if_true: files(
   'hax-all.c',
   'hax-mem.c',
-  'hax-cpus.c',
+  'hax-accel-ops.c',
 ))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_POSIX'], if_true: files('hax-posix.c'))
 i386_softmmu_ss.add(when: ['CONFIG_HAX', 'CONFIG_WIN32'], if_true: files('hax-windows.c'))
diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/meson.build
+++ b/target/i386/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
   'hvf.c',
-  'hvf-cpus.c',
+  'hvf-accel-ops.c',
   'x86.c',
   'x86_cpuid.c',
   'x86_decode.c',
diff --git a/target/i386/whpx/meson.build b/target/i386/whpx/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/whpx/meson.build
+++ b/target/i386/whpx/meson.build
@@ -XXX,XX +XXX,XX @@
 i386_softmmu_ss.add(when: 'CONFIG_WHPX', if_true: files(
   'whpx-all.c',
   'whpx-apic.c',
-  'whpx-cpus.c',
+  'whpx-accel-ops.c',
 ))
-- 
2.25.1

From: Claudio Fontana <cfontana@suse.de>

add a new optional interface to CPUClass, which allows accelerators
to extend the CPUClass with additional accelerator-specific
initializations.

This will allow to separate the target cpu code that is specific
to each accelerator, and register it automatically with object
hierarchy lookup depending on accelerator code availability,
as part of the accel_init_interfaces() initialization step.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Message-Id: <20210204163931.7358-19-cfontana@suse.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/accel-cpu.h | 38 ++++++++++++++++++++++++++++++++
 include/hw/core/cpu.h       |  4 ++++
 accel/accel-common.c        | 44 +++++++++++++++++++++++++++++++++++++
 MAINTAINERS                 |  1 +
 4 files changed, 87 insertions(+)
 create mode 100644 include/hw/core/accel-cpu.h

diff --git a/include/hw/core/accel-cpu.h b/include/hw/core/accel-cpu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/core/accel-cpu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Accelerator interface, specializes CPUClass
+ * This header is used only by target-specific code.
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef ACCEL_CPU_H
+#define ACCEL_CPU_H
+
+/*
+ * This header is used to define new accelerator-specific target-specific
+ * accelerator cpu subclasses.
+ * It uses CPU_RESOLVING_TYPE, so this is clearly target-specific.
+ *
+ * Do not try to use for any other purpose than the implementation of new
+ * subclasses in target/, or the accel implementation itself in accel/
+ */
+
+#define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
+#define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
+typedef struct AccelCPUClass AccelCPUClass;
+DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
+
+typedef struct AccelCPUClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    void (*cpu_class_init)(CPUClass *cc);
+    void (*cpu_instance_init)(CPUState *cpu);
+    void (*cpu_realizefn)(CPUState *cpu, Error **errp);
+} AccelCPUClass;
+
+#endif /* ACCEL_CPU_H */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock;
 /* see tcg-cpu-ops.h */
 struct TCGCPUOps;
 
+/* see accel-cpu.h */
+struct AccelCPUClass;
+
 /**
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
+    struct AccelCPUClass *accel_cpu;
 
     /* when TCG is not available, this pointer is NULL */
     struct TCGCPUOps *tcg_ops;
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 
+#include "cpu.h"
+#include "hw/core/accel-cpu.h"
+
 #ifndef CONFIG_USER_ONLY
 #include "accel-softmmu.h"
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+{
+    CPUClass *cc = CPU_CLASS(klass);
+    AccelCPUClass *accel_cpu = opaque;
+
+    cc->accel_cpu = accel_cpu;
+    if (accel_cpu->cpu_class_init) {
+        accel_cpu->cpu_class_init(cc);
+    }
+}
+
+/* initialize the arch-specific accel CpuClass interfaces */
+static void accel_init_cpu_interfaces(AccelClass *ac)
+{
+    const char *ac_name; /* AccelClass name */
+    char *acc_name;      /* AccelCPUClass name */
+    ObjectClass *acc;    /* AccelCPUClass */
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
+    acc = object_class_by_name(acc_name);
+    g_free(acc_name);
+
+    if (acc) {
+        object_class_foreach(accel_init_cpu_int_aux,
+                             CPU_RESOLVING_TYPE, false, acc);
+    }
+}
+
 void accel_init_interfaces(AccelClass *ac)
 {
 #ifndef CONFIG_USER_ONLY
     accel_init_ops_interfaces(ac);
 #endif /* !CONFIG_USER_ONLY */
+
+    accel_init_cpu_interfaces(ac);
 }
 
+static const TypeInfo accel_cpu_type = {
+    .name = TYPE_ACCEL_CPU,
+    .parent = TYPE_OBJECT,
+    .abstract = true,
+    .class_size = sizeof(AccelCPUClass),
+};
+
 static void register_accel_types(void)
 {
     type_register_static(&accel_type);
+    type_register_static(&accel_cpu_type);
 }
 
 type_init(register_accel_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/qemu/accel.h
 F: include/sysemu/accel-ops.h
+F: include/hw/core/accel-cpu.h
 F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
-- 
2.25.1

TCG patch queue, plus one target/sh4 patch that
Yoshinori Sato asked me to process.

The following changes since commit efbf38d73e5dcc4d5f8b98c6e7a12be1f3b91745:

Merge tag 'for-upstream' of git://repo.or.cz/qemu/kevin into staging (2022-10-03 15:06:07 -0400)

are available in the Git repository at:

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20221004

for you to fetch changes up to ab419fd8a035a65942de4e63effcd55ccbf1a9fe:

target/sh4: Fix TB_FLAG_UNALIGN (2022-10-04 12:33:05 -0700)

----------------------------------------------------------------
Cache CPUClass for use in hot code paths.
Add CPUTLBEntryFull, probe_access_full, tlb_set_page_full.
Add generic support for TARGET_TB_PCREL.
tcg/ppc: Optimize 26-bit jumps using STQ for POWER 2.07
target/sh4: Fix TB_FLAG_UNALIGN

----------------------------------------------------------------
Alex Bennée (3):
      cpu: cache CPUClass in CPUState for hot code paths
      hw/core/cpu-sysemu: used cached class in cpu_asidx_from_attrs
      cputlb: used cached CPUClass in our hot-paths

Leandro Lupori (1):
      tcg/ppc: Optimize 26-bit jumps

Richard Henderson (16):
      accel/tcg: Rename CPUIOTLBEntry to CPUTLBEntryFull
      accel/tcg: Drop addr member from SavedIOTLB
      accel/tcg: Suppress auto-invalidate in probe_access_internal
      accel/tcg: Introduce probe_access_full
      accel/tcg: Introduce tlb_set_page_full
      include/exec: Introduce TARGET_PAGE_ENTRY_EXTRA
      accel/tcg: Remove PageDesc code_bitmap
      accel/tcg: Use bool for page_find_alloc
      accel/tcg: Use DisasContextBase in plugin_gen_tb_start
      accel/tcg: Do not align tb->page_addr[0]
      accel/tcg: Inline tb_flush_jmp_cache
      include/hw/core: Create struct CPUJumpCache
      hw/core: Add CPUClass.get_pc
      accel/tcg: Introduce tb_pc and log_pc
      accel/tcg: Introduce TARGET_TB_PCREL
      target/sh4: Fix TB_FLAG_UNALIGN

From: Alex Bennée <alex.bennee@linaro.org>

The class cast checkers are quite expensive and always on (unlike the
dynamic case who's checks are gated by CONFIG_QOM_CAST_DEBUG). To
avoid the overhead of repeatedly checking something which should never
change we cache the CPUClass reference for use in the hot code paths.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-3-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-3-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 9 +++++++++
 cpu.c                 | 9 ++++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
  */
 #define CPU(obj) ((CPUState *)(obj))
 
+/*
+ * The class checkers bring in CPU_GET_CLASS() which is potentially
+ * expensive given the eventual call to
+ * object_class_dynamic_cast_assert(). Because of this the CPUState
+ * has a cached value for the class in cs->cc which is set up in
+ * cpu_exec_realizefn() for use in hot code paths.
+ */
 typedef struct CPUClass CPUClass;
 DECLARE_CLASS_CHECKERS(CPUClass, CPU,
                        TYPE_CPU)
@@ -XXX,XX +XXX,XX @@ struct qemu_work_item;
 struct CPUState {
     /*< private >*/
     DeviceState parent_obj;
+    /* cache to avoid expensive CPU_GET_CLASS */
+    CPUClass *cc;
     /*< public >*/
 
     int nr_cores;
diff --git a/cpu.c b/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/cpu.c
+++ b/cpu.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_cpu_common = {
 
 void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
-#ifndef CONFIG_USER_ONLY
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-#endif
+    /* cache the cpu class for the hotpath */
+    cpu->cc = CPU_GET_CLASS(cpu);
 
     cpu_list_add(cpu);
     if (!accel_cpu_realizefn(cpu, errp)) {
@@ -XXX,XX +XXX,XX @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
     if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
         vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
     }
-    if (cc->sysemu_ops->legacy_vmsd != NULL) {
-        vmstate_register(NULL, cpu->cpu_index, cc->sysemu_ops->legacy_vmsd, cpu);
+    if (cpu->cc->sysemu_ops->legacy_vmsd != NULL) {
+        vmstate_register(NULL, cpu->cpu_index, cpu->cc->sysemu_ops->legacy_vmsd, cpu);
     }
 #endif /* CONFIG_USER_ONLY */
 }
-- 
2.34.1

From: Alex Bennée <alex.bennee@linaro.org>

This is a heavily used function so lets avoid the cost of
CPU_GET_CLASS. On the romulus-bmc run it has a modest effect:

Before: 36.812 s ±  0.506 s
  After:  35.912 s ±  0.168 s

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-4-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-4-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/cpu-sysemu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/core/cpu-sysemu.c b/hw/core/cpu-sysemu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-sysemu.c
+++ b/hw/core/cpu-sysemu.c
@@ -XXX,XX +XXX,XX @@ hwaddr cpu_get_phys_page_debug(CPUState *cpu, vaddr addr)
 
 int cpu_asidx_from_attrs(CPUState *cpu, MemTxAttrs attrs)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
     int ret = 0;
 
-    if (cc->sysemu_ops->asidx_from_attrs) {
-        ret = cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
+    if (cpu->cc->sysemu_ops->asidx_from_attrs) {
+        ret = cpu->cc->sysemu_ops->asidx_from_attrs(cpu, attrs);
         assert(ret < cpu->num_ases && ret >= 0);
     }
     return ret;
-- 
2.34.1

From: Alex Bennée <alex.bennee@linaro.org>

Before: 35.912 s ±  0.168 s
  After: 35.565 s ±  0.087 s

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220811151413.3350684-5-alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220923084803.498337-5-clg@kaod.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
 static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
                      MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
     bool ok;
 
     /*
      * This is not a probe, so only valid return is success; failure
      * should result in exception + longjmp to the cpu loop.
      */
-    ok = cc->tcg_ops->tlb_fill(cpu, addr, size,
-                               access_type, mmu_idx, false, retaddr);
+    ok = cpu->cc->tcg_ops->tlb_fill(cpu, addr, size,
+                                    access_type, mmu_idx, false, retaddr);
     assert(ok);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr,
                                         MMUAccessType access_type,
                                         int mmu_idx, uintptr_t retaddr)
 {
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-
-    cc->tcg_ops->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr);
+    cpu->cc->tcg_ops->do_unaligned_access(cpu, addr, access_type,
+                                          mmu_idx, retaddr);
 }
 
 static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     if (!tlb_hit_page(tlb_addr, page_addr)) {
         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
             CPUState *cs = env_cpu(env);
-            CPUClass *cc = CPU_GET_CLASS(cs);
 
-            if (!cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
-                                       mmu_idx, nonfault, retaddr)) {
+            if (!cs->cc->tcg_ops->tlb_fill(cs, addr, fault_size, access_type,
+                                           mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
                 return TLB_INVALID_MASK;
-- 
2.34.1

This structure will shortly contain more than just
data for accessing MMIO.  Rename the 'addr' member
to 'xlat_section' to more clearly indicate its purpose.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h    |  22 ++++----
 accel/tcg/cputlb.c         | 102 +++++++++++++++++++------------------
 target/arm/mte_helper.c    |  14 ++---
 target/arm/sve_helper.c    |   4 +-
 target/arm/translate-a64.c |   2 +-
 5 files changed, 73 insertions(+), 71 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@ typedef uint64_t target_ulong;
 #  endif
 # endif
 
+/* Minimalized TLB entry for use by TCG fast path. */
 typedef struct CPUTLBEntry {
     /* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
        bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntry {
 
 QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
 
-/* The IOTLB is not accessed directly inline by generated TCG code,
- * so the CPUIOTLBEntry layout is not as critical as that of the
- * CPUTLBEntry. (This is also why we don't want to combine the two
- * structs into one.)
+/*
+ * The full TLB entry, which is not accessed by generated TCG code,
+ * so the layout is not as critical as that of CPUTLBEntry. This is
+ * also why we don't want to combine the two structs.
  */
-typedef struct CPUIOTLBEntry {
+typedef struct CPUTLBEntryFull {
     /*
-     * @addr contains:
+     * @xlat_section contains:
      *  - in the lower TARGET_PAGE_BITS, a physical section number
      *  - with the lower TARGET_PAGE_BITS masked off, an offset which
      *    must be added to the virtual address to obtain:
@@ -XXX,XX +XXX,XX @@ typedef struct CPUIOTLBEntry {
      *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
      *     + the offset within the target MemoryRegion (otherwise)
      */
-    hwaddr addr;
+    hwaddr xlat_section;
     MemTxAttrs attrs;
-} CPUIOTLBEntry;
+} CPUTLBEntryFull;
 
 /*
  * Data elements that are per MMU mode, minus the bits accessed by
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBDesc {
     size_t vindex;
     /* The tlb victim table, in two parts.  */
     CPUTLBEntry vtable[CPU_VTLB_SIZE];
-    CPUIOTLBEntry viotlb[CPU_VTLB_SIZE];
-    /* The iotlb.  */
-    CPUIOTLBEntry *iotlb;
+    CPUTLBEntryFull vfulltlb[CPU_VTLB_SIZE];
+    CPUTLBEntryFull *fulltlb;
 } CPUTLBDesc;
 
 /*
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
     }
 
     g_free(fast->table);
-    g_free(desc->iotlb);
+    g_free(desc->fulltlb);
 
     tlb_window_reset(desc, now, 0);
     /* desc->n_used_entries is cleared by the caller */
     fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_try_new(CPUTLBEntry, new_size);
-    desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+    desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
 
     /*
      * If the allocations fail, try smaller sizes. We just freed some
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
      * allocations to fail though, so we progressively reduce the allocation
      * size, aborting if we cannot even allocate the smallest TLB we support.
      */
-    while (fast->table == NULL || desc->iotlb == NULL) {
+    while (fast->table == NULL || desc->fulltlb == NULL) {
         if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
             error_report("%s: %s", __func__, strerror(errno));
             abort();
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_resize_locked(CPUTLBDesc *desc, CPUTLBDescFast *fast,
         fast->mask = (new_size - 1) << CPU_TLB_ENTRY_BITS;
 
         g_free(fast->table);
-        g_free(desc->iotlb);
+        g_free(desc->fulltlb);
         fast->table = g_try_new(CPUTLBEntry, new_size);
-        desc->iotlb = g_try_new(CPUIOTLBEntry, new_size);
+        desc->fulltlb = g_try_new(CPUTLBEntryFull, new_size);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_mmu_init(CPUTLBDesc *desc, CPUTLBDescFast *fast, int64_t now)
     desc->n_used_entries = 0;
     fast->mask = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
     fast->table = g_new(CPUTLBEntry, n_entries);
-    desc->iotlb = g_new(CPUIOTLBEntry, n_entries);
+    desc->fulltlb = g_new(CPUTLBEntryFull, n_entries);
     tlb_mmu_flush_locked(desc, fast);
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_destroy(CPUState *cpu)
         CPUTLBDescFast *fast = &env_tlb(env)->f[i];
 
         g_free(fast->table);
-        g_free(desc->iotlb);
+        g_free(desc->fulltlb);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 
         /* Evict the old entry into the victim tlb.  */
         copy_tlb_helper_locked(tv, te);
-        desc->viotlb[vidx] = desc->iotlb[index];
+        desc->vfulltlb[vidx] = desc->fulltlb[index];
         tlb_n_used_entries_dec(env, mmu_idx);
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      * subtract here is that of the page base, and not the same as the
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
-    desc->iotlb[index].addr = iotlb - vaddr_page;
-    desc->iotlb[index].attrs = attrs;
+    desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
+    desc->fulltlb[index].attrs = attrs;
 
     /* Now calculate the new entry */
     tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
     }
 }
 
-static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
                          int mmu_idx, target_ulong addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
     mr = section->mr;
-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_read(mr, mr_offset, &val, op, iotlbentry->attrs);
+    r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op), access_type,
-                               mmu_idx, iotlbentry->attrs, r, retaddr);
+                               mmu_idx, full->attrs, r, retaddr);
     }
     if (locked) {
         qemu_mutex_unlock_iothread();
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
 }
 
 /*
- * Save a potentially trashed IOTLB entry for later lookup by plugin.
- * This is read by tlb_plugin_lookup if the iotlb entry doesn't match
+ * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
+ * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
  * because of the side effect of io_writex changing memory layout.
  */
 static void save_iotlb_data(CPUState *cs, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static void save_iotlb_data(CPUState *cs, hwaddr addr,
 #endif
 }
 
-static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
+static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
                       int mmu_idx, uint64_t val, target_ulong addr,
                       uintptr_t retaddr, MemOp op)
 {
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
     bool locked = false;
     MemTxResult r;
 
-    section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
+    section = iotlb_to_section(cpu, full->xlat_section, full->attrs);
     mr = section->mr;
-    mr_offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+    mr_offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
     if (!cpu->can_do_io) {
         cpu_io_recompile(cpu, retaddr);
     }
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
      * The memory_region_dispatch may trigger a flush/resize
      * so for plugins we save the iotlb_data just in case.
      */
-    save_iotlb_data(cpu, iotlbentry->addr, section, mr_offset);
+    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
 
     if (!qemu_mutex_iothread_locked()) {
         qemu_mutex_lock_iothread();
         locked = true;
     }
-    r = memory_region_dispatch_write(mr, mr_offset, val, op, iotlbentry->attrs);
+    r = memory_region_dispatch_write(mr, mr_offset, val, op, full->attrs);
     if (r != MEMTX_OK) {
         hwaddr physaddr = mr_offset +
             section->offset_within_address_space -
             section->offset_within_region;
 
         cpu_transaction_failed(cpu, physaddr, addr, memop_size(op),
-                               MMU_DATA_STORE, mmu_idx, iotlbentry->attrs, r,
+                               MMU_DATA_STORE, mmu_idx, full->attrs, r,
                                retaddr);
     }
     if (locked) {
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
             copy_tlb_helper_locked(vtlb, &tmptlb);
             qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-            CPUIOTLBEntry tmpio, *io = &env_tlb(env)->d[mmu_idx].iotlb[index];
-            CPUIOTLBEntry *vio = &env_tlb(env)->d[mmu_idx].viotlb[vidx];
-            tmpio = *io; *io = *vio; *vio = tmpio;
+            CPUTLBEntryFull *f1 = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+            CPUTLBEntryFull *f2 = &env_tlb(env)->d[mmu_idx].vfulltlb[vidx];
+            CPUTLBEntryFull tmpf;
+            tmpf = *f1; *f1 = *f2; *f2 = tmpf;
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
                  (ADDR) & TARGET_PAGE_MASK)
 
 static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
-                           CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
+                           CPUTLBEntryFull *full, uintptr_t retaddr)
 {
-    ram_addr_t ram_addr = mem_vaddr + iotlbentry->addr;
+    ram_addr_t ram_addr = mem_vaddr + full->xlat_section;
 
     trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
 
@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
         uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
-        notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
+        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
         flags &= ~TLB_NOTDIRTY;
     }
 
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
 
     if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
         uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (flags & TLB_WATCHPOINT) {
             int wp_access = (access_type == MMU_DATA_STORE
                              ? BP_MEM_WRITE : BP_MEM_READ);
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, wp_access, retaddr);
+                                 full->attrs, wp_access, retaddr);
         }
 
         /* Handle clean RAM pages.  */
         if (flags & TLB_NOTDIRTY) {
-            notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
+            notdirty_write(env_cpu(env), addr, 1, full, retaddr);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
  * should have just filled the TLB. The one corner case is io_writex
  * which can cause TLB flushes and potential resizing of the TLBs
  * losing the information we need. In those cases we need to recover
- * data from a copy of the iotlbentry. As long as this always occurs
+ * data from a copy of the CPUTLBEntryFull. As long as this always occurs
  * from the same thread (which a mem callback will be) this is safe.
  */
 
@@ -XXX,XX +XXX,XX @@ bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
     if (likely(tlb_hit(tlb_addr, addr))) {
         /* We must have an iotlb entry for MMIO */
         if (tlb_addr & TLB_MMIO) {
-            CPUIOTLBEntry *iotlbentry;
-            iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+            CPUTLBEntryFull *full;
+            full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
             data->is_io = true;
-            data->v.io.section = iotlb_to_section(cpu, iotlbentry->addr, iotlbentry->attrs);
-            data->v.io.offset = (iotlbentry->addr & TARGET_PAGE_MASK) + addr;
+            data->v.io.section =
+                iotlb_to_section(cpu, full->xlat_section, full->attrs);
+            data->v.io.offset = (full->xlat_section & TARGET_PAGE_MASK) + addr;
         } else {
             data->is_io = false;
             data->v.ram.hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
@@ -XXX,XX +XXX,XX @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
 
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
         notdirty_write(env_cpu(env), addr, size,
-                       &env_tlb(env)->d[mmu_idx].iotlb[index], retaddr);
+                       &env_tlb(env)->d[mmu_idx].fulltlb[index], retaddr);
     }
 
     return hostaddr;
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
 
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-        CPUIOTLBEntry *iotlbentry;
+        CPUTLBEntryFull *full;
         bool need_swap;
 
         /* For anything that is unaligned, recurse through full_load.  */
@@ -XXX,XX +XXX,XX @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi,
             goto do_unaligned_access;
         }
 
-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, BP_MEM_READ, retaddr);
+                                 full->attrs, BP_MEM_READ, retaddr);
         }
 
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
         if (likely(tlb_addr & TLB_MMIO)) {
-            return io_readx(env, iotlbentry, mmu_idx, addr, retaddr,
+            return io_readx(env, full, mmu_idx, addr, retaddr,
                             access_type, op ^ (need_swap * MO_BSWAP));
         }
 
@@ -XXX,XX +XXX,XX @@ store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
      */
     if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
         cpu_check_watchpoint(env_cpu(env), addr, size - size2,
-                             env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+                             env_tlb(env)->d[mmu_idx].fulltlb[index].attrs,
                              BP_MEM_WRITE, retaddr);
     }
     if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
         cpu_check_watchpoint(env_cpu(env), page2, size2,
-                             env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
+                             env_tlb(env)->d[mmu_idx].fulltlb[index2].attrs,
                              BP_MEM_WRITE, retaddr);
     }
 
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
     /* Handle anything that isn't just a straight memory access.  */
     if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-        CPUIOTLBEntry *iotlbentry;
+        CPUTLBEntryFull *full;
         bool need_swap;
 
         /* For anything that is unaligned, recurse through byte stores.  */
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
             goto do_unaligned_access;
         }
 
-        iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
+        full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
 
         /* Handle watchpoints.  */
         if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
             /* On watchpoint hit, this will longjmp out.  */
             cpu_check_watchpoint(env_cpu(env), addr, size,
-                                 iotlbentry->attrs, BP_MEM_WRITE, retaddr);
+                                 full->attrs, BP_MEM_WRITE, retaddr);
         }
 
         need_swap = size > 1 && (tlb_addr & TLB_BSWAP);
 
         /* Handle I/O access.  */
         if (tlb_addr & TLB_MMIO) {
-            io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr,
+            io_writex(env, full, mmu_idx, val, addr, retaddr,
                       op ^ (need_swap * MO_BSWAP));
             return;
         }
@@ -XXX,XX +XXX,XX @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         /* Handle clean RAM pages.  */
         if (tlb_addr & TLB_NOTDIRTY) {
-            notdirty_write(env_cpu(env), addr, size, iotlbentry, retaddr);
+            notdirty_write(env_cpu(env), addr, size, full, retaddr);
         }
 
         haddr = (void *)((uintptr_t)addr + entry->addend);
diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     return tags + index;
 #else
     uintptr_t index;
-    CPUIOTLBEntry *iotlbentry;
+    CPUTLBEntryFull *full;
     int in_page, flags;
     ram_addr_t ptr_ra;
     hwaddr ptr_paddr, tag_paddr, xlat;
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     assert(!(flags & TLB_INVALID_MASK));
 
     /*
-     * Find the iotlbentry for ptr.  This *must* be present in the TLB
+     * Find the CPUTLBEntryFull for ptr.  This *must* be present in the TLB
      * because we just found the mapping.
      * TODO: Perhaps there should be a cputlb helper that returns a
      * matching tlb entry + iotlb entry.
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
         g_assert(tlb_hit(comparator, ptr));
     }
 # endif
-    iotlbentry = &env_tlb(env)->d[ptr_mmu_idx].iotlb[index];
+    full = &env_tlb(env)->d[ptr_mmu_idx].fulltlb[index];
 
     /* If the virtual page MemAttr != Tagged, access unchecked. */
-    if (!arm_tlb_mte_tagged(&iotlbentry->attrs)) {
+    if (!arm_tlb_mte_tagged(&full->attrs)) {
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
         int wp = ptr_access == MMU_DATA_LOAD ? BP_MEM_READ : BP_MEM_WRITE;
         assert(ra != 0);
         cpu_check_watchpoint(env_cpu(env), ptr, ptr_size,
-                             iotlbentry->attrs, wp, ra);
+                             full->attrs, wp, ra);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
     tag_paddr = ptr_paddr >> (LOG2_TAG_GRANULE + 1);
 
     /* Look up the address in tag space. */
-    tag_asi = iotlbentry->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
+    tag_asi = full->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
     tag_as = cpu_get_address_space(env_cpu(env), tag_asi);
     mr = address_space_translate(tag_as, tag_paddr, &xlat, NULL,
                                  tag_access == MMU_DATA_STORE,
-                                 iotlbentry->attrs);
+                                 full->attrs);
 
     /*
      * Note that @mr will never be NULL.  If there is nothing in the address
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
         g_assert(tlb_hit(comparator, addr));
 # endif
 
-        CPUIOTLBEntry *iotlbentry = &env_tlb(env)->d[mmu_idx].iotlb[index];
-        info->attrs = iotlbentry->attrs;
+        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+        info->attrs = full->attrs;
     }
 #endif
 
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool is_guarded_page(CPUARMState *env, DisasContext *s)
      * table entry even for that case.
      */
     return (tlb_hit(entry->addr_code, addr) &&
-            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].iotlb[index].attrs));
+            arm_tlb_bti_gp(&env_tlb(env)->d[mmu_idx].fulltlb[index].attrs));
 #endif
 }
 
-- 
2.34.1

This field is only written, not read; remove it.

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUWatchpoint {
  * the memory regions get moved around  by io_writex.
  */
 typedef struct SavedIOTLB {
-    hwaddr addr;
     MemoryRegionSection *section;
     hwaddr mr_offset;
 } SavedIOTLB;
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
  * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
  * because of the side effect of io_writex changing memory layout.
  */
-static void save_iotlb_data(CPUState *cs, hwaddr addr,
-                            MemoryRegionSection *section, hwaddr mr_offset)
+static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
+                            hwaddr mr_offset)
 {
 #ifdef CONFIG_PLUGIN
     SavedIOTLB *saved = &cs->saved_iotlb;
-    saved->addr = addr;
     saved->section = section;
     saved->mr_offset = mr_offset;
 #endif
@@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
      * The memory_region_dispatch may trigger a flush/resize
      * so for plugins we save the iotlb_data just in case.
      */
-    save_iotlb_data(cpu, full->xlat_section, section, mr_offset);
+    save_iotlb_data(cpu, section, mr_offset);
 
     if (!qemu_mutex_iothread_locked()) {
         qemu_mutex_lock_iothread();
-- 
2.34.1

When PAGE_WRITE_INV is set when calling tlb_set_page,
we immediately set TLB_INVALID_MASK in order to force
tlb_fill to be called on the next lookup.  Here in
probe_access_internal, we have just called tlb_fill
and eliminated true misses, thus the lookup must be valid.

This allows us to remove a warning comment from s390x.
There doesn't seem to be a reason to change the code though.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c            | 10 +++++++++-
 target/s390x/tcg/mem_helper.c |  4 ----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     }
     tlb_addr = tlb_read_ofs(entry, elt_ofs);
 
+    flags = TLB_FLAGS_MASK;
     page_addr = addr & TARGET_PAGE_MASK;
     if (!tlb_hit_page(tlb_addr, page_addr)) {
         if (!victim_tlb_hit(env, mmu_idx, index, elt_ofs, page_addr)) {
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
 
             /* TLB resize via tlb_fill may have moved the entry.  */
             entry = tlb_entry(env, mmu_idx, addr);
+
+            /*
+             * With PAGE_WRITE_INV, we set TLB_INVALID_MASK immediately,
+             * to force the next access through tlb_fill.  We've just
+             * called tlb_fill, so we know that this entry *is* valid.
+             */
+            flags &= ~TLB_INVALID_MASK;
         }
         tlb_addr = tlb_read_ofs(entry, elt_ofs);
     }
-    flags = tlb_addr & TLB_FLAGS_MASK;
+    flags &= tlb_addr;
 
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -XXX,XX +XXX,XX @@ static int s390_probe_access(CPUArchState *env, target_ulong addr, int size,
 #else
     int flags;
 
-    /*
-     * For !CONFIG_USER_ONLY, we cannot rely on TLB_INVALID_MASK or haddr==NULL
-     * to detect if there was an exception during tlb_fill().
-     */
     env->tlb_fill_exc = 0;
     flags = probe_access_flags(env, addr, access_type, mmu_idx, nonfault, phost,
                                ra);
-- 
2.34.1

Add an interface to return the CPUTLBEntryFull struct
that goes with the lookup.  The result is not intended
to be valid across multiple lookups, so the user must
use the results immediately.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 15 +++++++++++++
 include/qemu/typedefs.h |  1 +
 accel/tcg/cputlb.c      | 47 +++++++++++++++++++++++++----------------
 3 files changed, 45 insertions(+), 18 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ int probe_access_flags(CPUArchState *env, target_ulong addr,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr);
 
+#ifndef CONFIG_USER_ONLY
+/**
+ * probe_access_full:
+ * Like probe_access_flags, except also return into @pfull.
+ *
+ * The CPUTLBEntryFull structure returned via @pfull is transient
+ * and must be consumed or copied immediately, before any further
+ * access or changes to TLB @mmu_idx.
+ */
+int probe_access_full(CPUArchState *env, target_ulong addr,
+                      MMUAccessType access_type, int mmu_idx,
+                      bool nonfault, void **phost,
+                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
+#endif
+
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
 /* Estimated block size for TB allocation.  */
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
 typedef struct CPUAddressSpace CPUAddressSpace;
 typedef struct CPUArchState CPUArchState;
 typedef struct CPUState CPUState;
+typedef struct CPUTLBEntryFull CPUTLBEntryFull;
 typedef struct DeviceListener DeviceListener;
 typedef struct DeviceState DeviceState;
 typedef struct DirtyBitmapSnapshot DirtyBitmapSnapshot;
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
 static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                  int fault_size, MMUAccessType access_type,
                                  int mmu_idx, bool nonfault,
-                                 void **phost, uintptr_t retaddr)
+                                 void **phost, CPUTLBEntryFull **pfull,
+                                 uintptr_t retaddr)
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
                                            mmu_idx, nonfault, retaddr)) {
                 /* Non-faulting page table read failed.  */
                 *phost = NULL;
+                *pfull = NULL;
                 return TLB_INVALID_MASK;
             }
 
             /* TLB resize via tlb_fill may have moved the entry.  */
+            index = tlb_index(env, mmu_idx, addr);
             entry = tlb_entry(env, mmu_idx, addr);
 
             /*
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     }
     flags &= tlb_addr;
 
+    *pfull = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
         *phost = NULL;
@@ -XXX,XX +XXX,XX @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     return flags;
 }
 
-int probe_access_flags(CPUArchState *env, target_ulong addr,
-                       MMUAccessType access_type, int mmu_idx,
-                       bool nonfault, void **phost, uintptr_t retaddr)
+int probe_access_full(CPUArchState *env, target_ulong addr,
+                      MMUAccessType access_type, int mmu_idx,
+                      bool nonfault, void **phost, CPUTLBEntryFull **pfull,
+                      uintptr_t retaddr)
 {
-    int flags;
-
-    flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
-                                  nonfault, phost, retaddr);
+    int flags = probe_access_internal(env, addr, 0, access_type, mmu_idx,
+                                      nonfault, phost, pfull, retaddr);
 
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
-        uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
-
-        notdirty_write(env_cpu(env), addr, 1, full, retaddr);
+        notdirty_write(env_cpu(env), addr, 1, *pfull, retaddr);
         flags &= ~TLB_NOTDIRTY;
     }
 
     return flags;
 }
 
+int probe_access_flags(CPUArchState *env, target_ulong addr,
+                       MMUAccessType access_type, int mmu_idx,
+                       bool nonfault, void **phost, uintptr_t retaddr)
+{
+    CPUTLBEntryFull *full;
+
+    return probe_access_full(env, addr, access_type, mmu_idx,
+                             nonfault, phost, &full, retaddr);
+}
+
 void *probe_access(CPUArchState *env, target_ulong addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
+    CPUTLBEntryFull *full;
     void *host;
     int flags;
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
-                                  false, &host, retaddr);
+                                  false, &host, &full, retaddr);
 
     /* Per the interface, size == 0 merely faults the access. */
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     }
 
     if (unlikely(flags & (TLB_NOTDIRTY | TLB_WATCHPOINT))) {
-        uintptr_t index = tlb_index(env, mmu_idx, addr);
-        CPUTLBEntryFull *full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
-
         /* Handle watchpoints.  */
         if (flags & TLB_WATCHPOINT) {
             int wp_access = (access_type == MMU_DATA_STORE
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
 void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
                         MMUAccessType access_type, int mmu_idx)
 {
+    CPUTLBEntryFull *full;
     void *host;
     int flags;
 
     flags = probe_access_internal(env, addr, 0, access_type,
-                                  mmu_idx, true, &host, 0);
+                                  mmu_idx, true, &host, &full, 0);
 
     /* No combination of flags are expected by the caller. */
     return flags ? NULL : host;
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
 tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
                                         void **hostp)
 {
+    CPUTLBEntryFull *full;
     void *p;
 
     (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
-                                cpu_mmu_index(env, true), false, &p, 0);
+                                cpu_mmu_index(env, true), false, &p, &full, 0);
     if (p == NULL) {
         return -1;
     }
-- 
2.34.1

Now that we have collected all of the page data into
CPUTLBEntryFull, provide an interface to record that
all in one go, instead of using 4 arguments.  This interface
allows CPUTLBEntryFull to be extended without having to
change the number of arguments.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-defs.h | 14 +++++++++++
 include/exec/exec-all.h | 22 ++++++++++++++++++
 accel/tcg/cputlb.c      | 51 ++++++++++++++++++++++++++---------------
 3 files changed, 69 insertions(+), 18 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLBEntryFull {
      *     + the offset within the target MemoryRegion (otherwise)
      */
     hwaddr xlat_section;
+
+    /*
+     * @phys_addr contains the physical address in the address space
+     * given by cpu_asidx_from_attrs(cpu, @attrs).
+     */
+    hwaddr phys_addr;
+
+    /* @attrs contains the memory transaction attributes for the page. */
     MemTxAttrs attrs;
+
+    /* @prot contains the complete protections for the page. */
+    uint8_t prot;
+
+    /* @lg_page_size contains the log2 of the page size. */
+    uint8_t lg_page_size;
 } CPUTLBEntryFull;
 
 /*
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                uint16_t idxmap,
                                                unsigned bits);
 
+/**
+ * tlb_set_page_full:
+ * @cpu: CPU context
+ * @mmu_idx: mmu index of the tlb to modify
+ * @vaddr: virtual address of the entry to add
+ * @full: the details of the tlb entry
+ *
+ * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
+ * @full must be filled, except for xlat_section, and constitute
+ * the complete description of the translated page.
+ *
+ * This is generally called by the target tlb_fill function after
+ * having performed a successful page table walk to find the physical
+ * address and attributes for the translation.
+ *
+ * At most one entry for a given virtual address is permitted. Only a
+ * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
+ * used by tlb_flush_page.
+ */
+void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
+                       CPUTLBEntryFull *full);
+
 /**
  * tlb_set_page_with_attrs:
  * @cpu: CPU to add this TLB entry for
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
     env_tlb(env)->d[mmu_idx].large_page_mask = lp_mask;
 }
 
-/* Add a new TLB entry. At most one entry for a given virtual address
+/*
+ * Add a new TLB entry. At most one entry for a given virtual address
  * is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
  * supplied size is only used by tlb_flush_page.
  *
  * Called from TCG-generated code, which is under an RCU read-side
  * critical section.
  */
-void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
-                             hwaddr paddr, MemTxAttrs attrs, int prot,
-                             int mmu_idx, target_ulong size)
+void tlb_set_page_full(CPUState *cpu, int mmu_idx,
+                       target_ulong vaddr, CPUTLBEntryFull *full)
 {
     CPUArchState *env = cpu->env_ptr;
     CPUTLB *tlb = env_tlb(env);
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
     target_ulong vaddr_page;
-    int asidx = cpu_asidx_from_attrs(cpu, attrs);
-    int wp_flags;
+    int asidx, wp_flags, prot;
     bool is_ram, is_romd;
 
     assert_cpu_is_self(cpu);
 
-    if (size <= TARGET_PAGE_SIZE) {
+    if (full->lg_page_size <= TARGET_PAGE_BITS) {
         sz = TARGET_PAGE_SIZE;
     } else {
-        tlb_add_large_page(env, mmu_idx, vaddr, size);
-        sz = size;
+        sz = (hwaddr)1 << full->lg_page_size;
+        tlb_add_large_page(env, mmu_idx, vaddr, sz);
     }
     vaddr_page = vaddr & TARGET_PAGE_MASK;
-    paddr_page = paddr & TARGET_PAGE_MASK;
+    paddr_page = full->phys_addr & TARGET_PAGE_MASK;
 
+    prot = full->prot;
+    asidx = cpu_asidx_from_attrs(cpu, full->attrs);
     section = address_space_translate_for_iotlb(cpu, asidx, paddr_page,
-                                                &xlat, &sz, attrs, &prot);
+                                                &xlat, &sz, full->attrs, &prot);
     assert(sz >= TARGET_PAGE_SIZE);
 
     tlb_debug("vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
               " prot=%x idx=%d\n",
-              vaddr, paddr, prot, mmu_idx);
+              vaddr, full->phys_addr, prot, mmu_idx);
 
     address = vaddr_page;
-    if (size < TARGET_PAGE_SIZE) {
+    if (full->lg_page_size < TARGET_PAGE_BITS) {
         /* Repeat the MMU check and TLB fill on every access.  */
         address |= TLB_INVALID_MASK;
     }
-    if (attrs.byte_swap) {
+    if (full->attrs.byte_swap) {
         address |= TLB_BSWAP;
     }
 
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
      * subtract here is that of the page base, and not the same as the
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
+    desc->fulltlb[index] = *full;
     desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
-    desc->fulltlb[index].attrs = attrs;
+    desc->fulltlb[index].phys_addr = paddr_page;
+    desc->fulltlb[index].prot = prot;
 
     /* Now calculate the new entry */
     tn.addend = addend - vaddr_page;
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     qemu_spin_unlock(&tlb->c.lock);
 }
 
-/* Add a new TLB entry, but without specifying the memory
- * transaction attributes to be used.
- */
+void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+                             hwaddr paddr, MemTxAttrs attrs, int prot,
+                             int mmu_idx, target_ulong size)
+{
+    CPUTLBEntryFull full = {
+        .phys_addr = paddr,
+        .attrs = attrs,
+        .prot = prot,
+        .lg_page_size = ctz64(size)
+    };
+
+    assert(is_power_of_2(size));
+    tlb_set_page_full(cpu, mmu_idx, vaddr, &full);
+}
+
 void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size)
-- 
2.34.1

This bitmap is created and discarded immediately.
We gain nothing by its existence.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220822232338.1727934-2-richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 78 ++-------------------------------------
 1 file changed, 4 insertions(+), 74 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
 #endif
 
-#define SMC_BITMAP_USE_THRESHOLD 10
-
 typedef struct PageDesc {
     /* list of TBs intersecting this ram page */
     uintptr_t first_tb;
-#ifdef CONFIG_SOFTMMU
-    /* in order to optimize self modifying code, we count the number
-       of lookups we do to a given page to use a bitmap */
-    unsigned long *code_bitmap;
-    unsigned int code_write_count;
-#else
+#ifdef CONFIG_USER_ONLY
     unsigned long flags;
     void *target_data;
 #endif
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_SOFTMMU
     QemuSpin lock;
 #endif
 } PageDesc;
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void)
     qht_init(&tb_ctx.htable, tb_cmp, CODE_GEN_HTABLE_SIZE, mode);
 }
 
-/* call with @p->lock held */
-static inline void invalidate_page_bitmap(PageDesc *p)
-{
-    assert_page_locked(p);
-#ifdef CONFIG_SOFTMMU
-    g_free(p->code_bitmap);
-    p->code_bitmap = NULL;
-    p->code_write_count = 0;
-#endif
-}
-
 /* Set to NULL all the 'first_tb' fields in all PageDescs. */
 static void page_flush_tb_1(int level, void **lp)
 {
@@ -XXX,XX +XXX,XX @@ static void page_flush_tb_1(int level, void **lp)
         for (i = 0; i < V_L2_SIZE; ++i) {
             page_lock(&pd[i]);
             pd[i].first_tb = (uintptr_t)NULL;
-            invalidate_page_bitmap(pd + i);
             page_unlock(&pd[i]);
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     if (rm_from_page_list) {
         p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
         tb_page_remove(p, tb);
-        invalidate_page_bitmap(p);
         if (tb->page_addr[1] != -1) {
             p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
             tb_page_remove(p, tb);
-            invalidate_page_bitmap(p);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
     }
 }
 
-#ifdef CONFIG_SOFTMMU
-/* call with @p->lock held */
-static void build_page_bitmap(PageDesc *p)
-{
-    int n, tb_start, tb_end;
-    TranslationBlock *tb;
-
-    assert_page_locked(p);
-    p->code_bitmap = bitmap_new(TARGET_PAGE_SIZE);
-
-    PAGE_FOR_EACH_TB(p, tb, n) {
-        /* NOTE: this is subtle as a TB may span two physical pages */
-        if (n == 0) {
-            /* NOTE: tb_end may be after the end of the page, but
-               it is not a problem */
-            tb_start = tb->pc & ~TARGET_PAGE_MASK;
-            tb_end = tb_start + tb->size;
-            if (tb_end > TARGET_PAGE_SIZE) {
-                tb_end = TARGET_PAGE_SIZE;
-             }
-        } else {
-            tb_start = 0;
-            tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
-        }
-        bitmap_set(p->code_bitmap, tb_start, tb_end - tb_start);
-    }
-}
-#endif
-
 /* add the tb in the target page and protect it if necessary
  *
  * Called with mmap_lock held for user-mode emulation.
@@ -XXX,XX +XXX,XX @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
     page_already_protected = p->first_tb != (uintptr_t)NULL;
 #endif
     p->first_tb = (uintptr_t)tb | n;
-    invalidate_page_bitmap(p);
 
 #if defined(CONFIG_USER_ONLY)
     /* translator_loop() must have made all TB pages non-writable */
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     /* remove TB from the page(s) if we couldn't insert it */
     if (unlikely(existing_tb)) {
         tb_page_remove(p, tb);
-        invalidate_page_bitmap(p);
         if (p2) {
             tb_page_remove(p2, tb);
-            invalidate_page_bitmap(p2);
         }
         tb = existing_tb;
     }
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
 #if !defined(CONFIG_USER_ONLY)
     /* if no code remaining, no need to continue to use slow writes */
     if (!p->first_tb) {
-        invalidate_page_bitmap(p);
         tlb_unprotect_code(start);
     }
 #endif
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_page_fast(struct page_collection *pages,
     }
 
     assert_page_locked(p);
-    if (!p->code_bitmap &&
-        ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD) {
-        build_page_bitmap(p);
-    }
-    if (p->code_bitmap) {
-        unsigned int nr;
-        unsigned long b;
-
-        nr = start & ~TARGET_PAGE_MASK;
-        b = p->code_bitmap[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG - 1));
-        if (b & ((1 << len) - 1)) {
-            goto do_invalidate;
-        }
-    } else {
-    do_invalidate:
-        tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
-                                              retaddr);
-    }
+    tb_invalidate_phys_page_range__locked(pages, p, start, start + len,
+                                          retaddr);
 }
 #else
 /* Called with mmap_lock held. If pc is not 0 then it indicates the
-- 
2.34.1

Bool is more appropriate type for the alloc parameter.

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void page_init(void)
 #endif
 }
 
-static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
+static PageDesc *page_find_alloc(tb_page_addr_t index, bool alloc)
 {
     PageDesc *pd;
     void **lp;
@@ -XXX,XX +XXX,XX @@ static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
 
 static inline PageDesc *page_find(tb_page_addr_t index)
 {
-    return page_find_alloc(index, 0);
+    return page_find_alloc(index, false);
 }
 
 static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc);
+                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc);
 
 /* In user-mode page locks aren't used; mmap_lock is enough */
 #ifdef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static inline void page_unlock(PageDesc *pd)
 /* lock the page(s) of a TB in the correct acquisition order */
 static inline void page_lock_tb(const TranslationBlock *tb)
 {
-    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], 0);
+    page_lock_pair(NULL, tb->page_addr[0], NULL, tb->page_addr[1], false);
 }
 
 static inline void page_unlock_tb(const TranslationBlock *tb)
@@ -XXX,XX +XXX,XX @@ void page_collection_unlock(struct page_collection *set)
 #endif /* !CONFIG_USER_ONLY */
 
 static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                           PageDesc **ret_p2, tb_page_addr_t phys2, int alloc)
+                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
 {
     PageDesc *p1, *p2;
     tb_page_addr_t page1;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      * Note that inserting into the hash table first isn't an option, since
      * we can only insert TBs that are fully initialized.
      */
-    page_lock_pair(&p, phys_pc, &p2, phys_page2, 1);
+    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
     tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
     if (p2) {
         tb_page_add(p2, tb, 1, phys_page2);
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
     for (addr = start, len = end - start;
          len != 0;
          len -= TARGET_PAGE_SIZE, addr += TARGET_PAGE_SIZE) {
-        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
+        PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, true);
 
         /* If the write protection bit is set, then we invalidate
            the code inside.  */
-- 
2.34.1

Use the pc coming from db->pc_first rather than the TB.

Use the cached host_addr rather than re-computing for the
first page.  We still need a separate lookup for the second
page because it won't be computed for DisasContextBase until
the translator actually performs a read from the page.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/plugin-gen.h |  7 ++++---
 accel/tcg/plugin-gen.c    | 22 +++++++++++-----------
 accel/tcg/translator.c    |  2 +-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/include/exec/plugin-gen.h b/include/exec/plugin-gen.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/plugin-gen.h
+++ b/include/exec/plugin-gen.h
@@ -XXX,XX +XXX,XX @@ struct DisasContextBase;
 
 #ifdef CONFIG_PLUGIN
 
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress);
+bool plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db,
+                         bool supress);
 void plugin_gen_tb_end(CPUState *cpu);
 void plugin_gen_insn_start(CPUState *cpu, const struct DisasContextBase *db);
 void plugin_gen_insn_end(void);
@@ -XXX,XX +XXX,XX @@ static inline void plugin_insn_append(abi_ptr pc, const void *from, size_t size)
 
 #else /* !CONFIG_PLUGIN */
 
-static inline
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool supress)
+static inline bool
+plugin_gen_tb_start(CPUState *cpu, const struct DisasContextBase *db, bool sup)
 {
     return false;
 }
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -XXX,XX +XXX,XX @@ static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
     pr_ops();
 }
 
-bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_only)
+bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
+                         bool mem_only)
 {
     bool ret = false;
 
@@ -XXX,XX +XXX,XX @@ bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_onl
 
         ret = true;
 
-        ptb->vaddr = tb->pc;
+        ptb->vaddr = db->pc_first;
         ptb->vaddr2 = -1;
-        get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
+        ptb->haddr1 = db->host_addr[0];
         ptb->haddr2 = NULL;
         ptb->mem_only = mem_only;
 
@@ -XXX,XX +XXX,XX @@ void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
      * Note that we skip this when haddr1 == NULL, e.g. when we're
      * fetching instructions from a region not backed by RAM.
      */
-    if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
-        unlikely((db->pc_next & TARGET_PAGE_MASK) !=
-                 (db->pc_first & TARGET_PAGE_MASK))) {
-        get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
-                                 &ptb->haddr2);
-        ptb->vaddr2 = db->pc_next;
-    }
-    if (likely(ptb->vaddr2 == -1)) {
+    if (ptb->haddr1 == NULL) {
+        pinsn->haddr = NULL;
+    } else if (is_same_page(db, db->pc_next)) {
         pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
     } else {
+        if (ptb->vaddr2 == -1) {
+            ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
+            get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2);
+        }
         pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
     }
 }
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
     ops->tb_start(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 
-    plugin_enabled = plugin_gen_tb_start(cpu, tb, cflags & CF_MEMI_ONLY);
+    plugin_enabled = plugin_gen_tb_start(cpu, db, cflags & CF_MEMI_ONLY);
 
     while (true) {
         db->num_insns++;
-- 
2.34.1

Let tb->page_addr[0] contain the address of the first byte of the
translated block, rather than the address of the page containing the
start of the translated block.  We need to recover this value anyway
at various points, and it is easier to discard a page offset when it
is not needed, which happens naturally via the existing find_page shift.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c      | 16 ++++++++--------
 accel/tcg/cputlb.c        |  3 ++-
 accel/tcg/translate-all.c |  9 +++++----
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ struct tb_desc {
     target_ulong pc;
     target_ulong cs_base;
     CPUArchState *env;
-    tb_page_addr_t phys_page1;
+    tb_page_addr_t page_addr0;
     uint32_t flags;
     uint32_t cflags;
     uint32_t trace_vcpu_dstate;
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const struct tb_desc *desc = d;
 
     if (tb->pc == desc->pc &&
-        tb->page_addr[0] == desc->phys_page1 &&
+        tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
         tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
         if (tb->page_addr[1] == -1) {
             return true;
         } else {
-            tb_page_addr_t phys_page2;
-            target_ulong virt_page2;
+            tb_page_addr_t phys_page1;
+            target_ulong virt_page1;
 
             /*
              * We know that the first page matched, and an otherwise valid TB
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
              * is different for the new TB.  Therefore any exception raised
              * here by the faulting lookup is not premature.
              */
-            virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
-            phys_page2 = get_page_addr_code(desc->env, virt_page2);
-            if (tb->page_addr[1] == phys_page2) {
+            virt_page1 = TARGET_PAGE_ALIGN(desc->pc);
+            phys_page1 = get_page_addr_code(desc->env, virt_page1);
+            if (tb->page_addr[1] == phys_page1) {
                 return true;
             }
         }
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
     if (phys_pc == -1) {
         return NULL;
     }
-    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    desc.page_addr0 = phys_pc;
     h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
    can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
 {
-    cpu_physical_memory_test_and_clear_dirty(ram_addr, TARGET_PAGE_SIZE,
+    cpu_physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
+                                             TARGET_PAGE_SIZE,
                                              DIRTY_MEMORY_CODE);
 }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     qemu_spin_unlock(&tb->jmp_lock);
 
     /* remove the TB from the hash list */
-    phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
+    phys_pc = tb->page_addr[0];
     h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
                      tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
      * we can only insert TBs that are fully initialized.
      */
     page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
-    tb_page_add(p, tb, 0, phys_pc & TARGET_PAGE_MASK);
+    tb_page_add(p, tb, 0, phys_pc);
     if (p2) {
         tb_page_add(p2, tb, 1, phys_page2);
     } else {
@@ -XXX,XX +XXX,XX @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
         if (n == 0) {
             /* NOTE: tb_end may be after the end of the page, but
                it is not a problem */
-            tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
+            tb_start = tb->page_addr[0];
             tb_end = tb_start + tb->size;
         } else {
             tb_start = tb->page_addr[1];
-            tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
+            tb_end = tb_start + ((tb->page_addr[0] + tb->size)
+                                 & ~TARGET_PAGE_MASK);
         }
         if (!(tb_end <= start || tb_start >= end)) {
 #ifdef TARGET_HAS_PRECISE_SMC
-- 
2.34.1

This function has two users, who use it incompatibly.
In tlb_flush_page_by_mmuidx_async_0, when flushing a
single page, we need to flush exactly two pages.
In tlb_flush_range_by_mmuidx_async_0, when flushing a
range of pages, we need to flush N+1 pages.

This avoids double-flushing of jmp cache pages in a range.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
     }
 }
 
-static void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
-{
-    /* Discard jump cache entries for any tb which might potentially
-       overlap the flushed page.  */
-    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
-    tb_jmp_cache_clear_page(cpu, addr);
-}
-
 /**
  * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
  * @desc: The CPUTLBDesc portion of the TLB
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
     }
     qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-    tb_flush_jmp_cache(cpu, addr);
+    /*
+     * Discard jump cache entries for any tb which might potentially
+     * overlap the flushed page, which includes the previous.
+     */
+    tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE);
+    tb_jmp_cache_clear_page(cpu, addr);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
         return;
     }
 
-    for (target_ulong i = 0; i < d.len; i += TARGET_PAGE_SIZE) {
-        tb_flush_jmp_cache(cpu, d.addr + i);
+    /*
+     * Discard jump cache entries for any tb which might potentially
+     * overlap the flushed pages, which includes the previous.
+     */
+    d.addr -= TARGET_PAGE_SIZE;
+    for (target_ulong i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
+        tb_jmp_cache_clear_page(cpu, d.addr);
+        d.addr += TARGET_PAGE_SIZE;
     }
 }
 
-- 
2.34.1

Wrap the bare TranslationBlock pointer into a structure.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-hash.h       |  1 +
 accel/tcg/tb-jmp-cache.h  | 24 ++++++++++++++++++++++++
 include/exec/cpu-common.h |  1 +
 include/hw/core/cpu.h     | 15 +--------------
 include/qemu/typedefs.h   |  1 +
 accel/stubs/tcg-stub.c    |  4 ++++
 accel/tcg/cpu-exec.c      | 10 +++++++---
 accel/tcg/cputlb.c        |  9 +++++----
 accel/tcg/translate-all.c | 28 +++++++++++++++++++++++++---
 hw/core/cpu-common.c      |  3 +--
 plugins/core.c            |  2 +-
 trace/control-target.c    |  2 +-
 12 files changed, 72 insertions(+), 28 deletions(-)
 create mode 100644 accel/tcg/tb-jmp-cache.h

diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-hash.h
+++ b/accel/tcg/tb-hash.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu-defs.h"
 #include "exec/exec-all.h"
 #include "qemu/xxhash.h"
+#include "tb-jmp-cache.h"
 
 #ifdef CONFIG_SOFTMMU
 
diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * The per-CPU TranslationBlock jump cache.
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_TCG_TB_JMP_CACHE_H
+#define ACCEL_TCG_TB_JMP_CACHE_H
+
+#define TB_JMP_CACHE_BITS 12
+#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
+
+/*
+ * Accessed in parallel; all accesses to 'tb' must be atomic.
+ */
+struct CPUJumpCache {
+    struct {
+        TranslationBlock *tb;
+    } array[TB_JMP_CACHE_SIZE];
+};
+
+#endif /* ACCEL_TCG_TB_JMP_CACHE_H */
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void cpu_list_unlock(void);
 unsigned int cpu_list_generation_id_get(void);
 
 void tcg_flush_softmmu_tlb(CPUState *cs);
+void tcg_flush_jmp_cache(CPUState *cs);
 
 void tcg_iommu_init_notifier_list(CPUState *cpu);
 void tcg_iommu_free_notifier_list(CPUState *cpu);
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct kvm_run;
 struct hax_vcpu_state;
 struct hvf_vcpu_state;
 
-#define TB_JMP_CACHE_BITS 12
-#define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
-
 /* work queue */
 
 /* The union type allows passing of 64 bit target pointers on 32 bit
@@ -XXX,XX +XXX,XX @@ struct CPUState {
     CPUArchState *env_ptr;
     IcountDecr *icount_decr_ptr;
 
-    /* Accessed in parallel; all accesses must be atomic */
-    TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];
+    CPUJumpCache *tb_jmp_cache;
 
     struct GDBRegisterState *gdb_regs;
     int gdb_num_regs;
@@ -XXX,XX +XXX,XX @@ extern CPUTailQ cpus;
 
 extern __thread CPUState *current_cpu;
 
-static inline void cpu_tb_jmp_cache_clear(CPUState *cpu)
-{
-    unsigned int i;
-
-    for (i = 0; i < TB_JMP_CACHE_SIZE; i++) {
-        qatomic_set(&cpu->tb_jmp_cache[i], NULL);
-    }
-}
-
 /**
  * qemu_tcg_mttcg_enabled:
  * Check whether we are running MultiThread TCG or not.
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex CoMutex;
 typedef struct ConfidentialGuestSupport ConfidentialGuestSupport;
 typedef struct CPUAddressSpace CPUAddressSpace;
 typedef struct CPUArchState CPUArchState;
+typedef struct CPUJumpCache CPUJumpCache;
 typedef struct CPUState CPUState;
 typedef struct CPUTLBEntryFull CPUTLBEntryFull;
 typedef struct DeviceListener DeviceListener;
diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -XXX,XX +XXX,XX @@ void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
 {
 }
 
+void tcg_flush_jmp_cache(CPUState *cpu)
+{
+}
+
 int probe_access_flags(CPUArchState *env, target_ulong addr,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr)
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/replay.h"
 #include "sysemu/tcg.h"
 #include "exec/helper-proto.h"
+#include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     tcg_debug_assert(!(cflags & CF_INVALID));
 
     hash = tb_jmp_cache_hash_func(pc);
-    tb = qatomic_rcu_read(&cpu->tb_jmp_cache[hash]);
+    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
 
     if (likely(tb &&
                tb->pc == pc &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     if (tb == NULL) {
         return NULL;
     }
-    qatomic_set(&cpu->tb_jmp_cache[hash], tb);
+    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
     return tb;
 }
 
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
 
             tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
             if (tb == NULL) {
+                uint32_t h;
+
                 mmap_lock();
                 tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
                 mmap_unlock();
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  * We add the TB in the virtual pc hash table
                  * for the fast lookup
                  */
-                qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
+                h = tb_jmp_cache_hash_func(pc);
+                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
             }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
 
 static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
 {
-    unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr);
+    int i, i0 = tb_jmp_cache_hash_page(page_addr);
+    CPUJumpCache *jc = cpu->tb_jmp_cache;
 
     for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
-        qatomic_set(&cpu->tb_jmp_cache[i0 + i], NULL);
+        qatomic_set(&jc->array[i0 + i].tb, NULL);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 
     qemu_spin_unlock(&env_tlb(env)->c.lock);
 
-    cpu_tb_jmp_cache_clear(cpu);
+    tcg_flush_jmp_cache(cpu);
 
     if (to_clean == ALL_MMUIDX_BITS) {
         qatomic_set(&env_tlb(env)->c.full_flush_count,
@@ -XXX,XX +XXX,XX @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
      * longer to clear each entry individually than it will to clear it all.
      */
     if (d.len >= (TARGET_PAGE_SIZE * TB_JMP_CACHE_SIZE)) {
-        cpu_tb_jmp_cache_clear(cpu);
+        tcg_flush_jmp_cache(cpu);
         return;
     }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/tcg.h"
 #include "qapi/error.h"
 #include "hw/core/tcg-cpu-ops.h"
+#include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
 #include "internal.h"
@@ -XXX,XX +XXX,XX @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
     }
 
     CPU_FOREACH(cpu) {
-        cpu_tb_jmp_cache_clear(cpu);
+        tcg_flush_jmp_cache(cpu);
     }
 
     qht_reset_size(&tb_ctx.htable, CODE_GEN_HTABLE_SIZE);
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     /* remove the TB from the hash list */
     h = tb_jmp_cache_hash_func(tb->pc);
     CPU_FOREACH(cpu) {
-        if (qatomic_read(&cpu->tb_jmp_cache[h]) == tb) {
-            qatomic_set(&cpu->tb_jmp_cache[h], NULL);
+        CPUJumpCache *jc = cpu->tb_jmp_cache;
+        if (qatomic_read(&jc->array[h].tb) == tb) {
+            qatomic_set(&jc->array[h].tb, NULL);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ int page_unprotect(target_ulong address, uintptr_t pc)
 }
 #endif /* CONFIG_USER_ONLY */
 
+/*
+ * Called by generic code at e.g. cpu reset after cpu creation,
+ * therefore we must be prepared to allocate the jump cache.
+ */
+void tcg_flush_jmp_cache(CPUState *cpu)
+{
+    CPUJumpCache *jc = cpu->tb_jmp_cache;
+
+    if (likely(jc)) {
+        for (int i = 0; i < TB_JMP_CACHE_SIZE; i++) {
+            qatomic_set(&jc->array[i].tb, NULL);
+        }
+    } else {
+        /* This should happen once during realize, and thus never race. */
+        jc = g_new0(CPUJumpCache, 1);
+        jc = qatomic_xchg(&cpu->tb_jmp_cache, jc);
+        assert(jc == NULL);
+    }
+}
+
 /* This is a wrapper for common code that can not use CONFIG_SOFTMMU */
 void tcg_flush_softmmu_tlb(CPUState *cs)
 {
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -XXX,XX +XXX,XX @@ static void cpu_common_reset(DeviceState *dev)
     cpu->cflags_next_tb = -1;
 
     if (tcg_enabled()) {
-        cpu_tb_jmp_cache_clear(cpu);
-
+        tcg_flush_jmp_cache(cpu);
         tcg_flush_softmmu_tlb(cpu);
     }
 }
diff --git a/plugins/core.c b/plugins/core.c
index XXXXXXX..XXXXXXX 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -XXX,XX +XXX,XX @@ struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
 {
     bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
-    cpu_tb_jmp_cache_clear(cpu);
+    tcg_flush_jmp_cache(cpu);
 }
 
 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
diff --git a/trace/control-target.c b/trace/control-target.c
index XXXXXXX..XXXXXXX 100644
--- a/trace/control-target.c
+++ b/trace/control-target.c
@@ -XXX,XX +XXX,XX @@ static void trace_event_synchronize_vcpu_state_dynamic(
 {
     bitmap_copy(vcpu->trace_dstate, vcpu->trace_dstate_delayed,
                 CPU_TRACE_DSTATE_MAX_EVENTS);
-    cpu_tb_jmp_cache_clear(vcpu);
+    tcg_flush_jmp_cache(vcpu);
 }
 
 void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
-- 
2.34.1

Populate this new method for all targets.  Always match
the result that would be given by cpu_get_tb_cpu_state,
as we will want these values to correspond in the logs.

Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (target/sparc)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
Cc: Eduardo Habkost <eduardo@habkost.net> (supporter:Machine core)
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> (supporter:Machine core)
Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> (reviewer:Machine core)
Cc: Yanan Wang <wangyanan55@huawei.com> (reviewer:Machine core)
Cc: Michael Rolnik <mrolnik@gmail.com> (maintainer:AVR TCG CPUs)
Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> (maintainer:CRIS TCG CPUs)
Cc: Taylor Simpson <tsimpson@quicinc.com> (supporter:Hexagon TCG CPUs)
Cc: Song Gao <gaosong@loongson.cn> (maintainer:LoongArch TCG CPUs)
Cc: Xiaojuan Yang <yangxiaojuan@loongson.cn> (maintainer:LoongArch TCG CPUs)
Cc: Laurent Vivier <laurent@vivier.eu> (maintainer:M68K TCG CPUs)
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> (reviewer:MIPS TCG CPUs)
Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> (reviewer:MIPS TCG CPUs)
Cc: Chris Wulff <crwulff@gmail.com> (maintainer:NiosII TCG CPUs)
Cc: Marek Vasut <marex@denx.de> (maintainer:NiosII TCG CPUs)
Cc: Stafford Horne <shorne@gmail.com> (odd fixer:OpenRISC TCG CPUs)
Cc: Yoshinori Sato <ysato@users.sourceforge.jp> (reviewer:RENESAS RX CPUs)
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> (maintainer:SPARC TCG CPUs)
Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (maintainer:TriCore TCG CPUs)
Cc: Max Filippov <jcmvbkbc@gmail.com> (maintainer:Xtensa TCG CPUs)
Cc: qemu-arm@nongnu.org (open list:ARM TCG CPUs)
Cc: qemu-ppc@nongnu.org (open list:PowerPC TCG CPUs)
Cc: qemu-riscv@nongnu.org (open list:RISC-V TCG CPUs)
Cc: qemu-s390x@nongnu.org (open list:S390 TCG CPUs)
---
 include/hw/core/cpu.h   |  3 +++
 target/alpha/cpu.c      |  9 +++++++++
 target/arm/cpu.c        | 13 +++++++++++++
 target/avr/cpu.c        |  8 ++++++++
 target/cris/cpu.c       |  8 ++++++++
 target/hexagon/cpu.c    |  8 ++++++++
 target/hppa/cpu.c       |  8 ++++++++
 target/i386/cpu.c       |  9 +++++++++
 target/loongarch/cpu.c  |  9 +++++++++
 target/m68k/cpu.c       |  8 ++++++++
 target/microblaze/cpu.c |  8 ++++++++
 target/mips/cpu.c       |  8 ++++++++
 target/nios2/cpu.c      |  9 +++++++++
 target/openrisc/cpu.c   |  8 ++++++++
 target/ppc/cpu_init.c   |  8 ++++++++
 target/riscv/cpu.c      | 13 +++++++++++++
 target/rx/cpu.c         |  8 ++++++++
 target/s390x/cpu.c      |  8 ++++++++
 target/sh4/cpu.c        |  8 ++++++++
 target/sparc/cpu.c      |  8 ++++++++
 target/tricore/cpu.c    |  9 +++++++++
 target/xtensa/cpu.c     |  8 ++++++++
 22 files changed, 186 insertions(+)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -XXX,XX +XXX,XX @@ struct SysemuCPUOps;
  *       If the target behaviour here is anything other than "set
  *       the PC register to the value passed in" then the target must
  *       also implement the synchronize_from_tb hook.
+ * @get_pc: Callback for getting the Program Counter register.
+ *       As above, with the semantics of the target architecture.
  * @gdb_read_register: Callback for letting GDB read a register.
  * @gdb_write_register: Callback for letting GDB write a register.
  * @gdb_adjust_breakpoint: Callback for adjusting the address of a
@@ -XXX,XX +XXX,XX @@ struct CPUClass {
     void (*dump_state)(CPUState *cpu, FILE *, int flags);
     int64_t (*get_arch_id)(CPUState *cpu);
     void (*set_pc)(CPUState *cpu, vaddr value);
+    vaddr (*get_pc)(CPUState *cpu);
     int (*gdb_read_register)(CPUState *cpu, GByteArray *buf, int reg);
     int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
     vaddr (*gdb_adjust_breakpoint)(CPUState *cpu, vaddr addr);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr alpha_cpu_get_pc(CPUState *cs)
+{
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+
+    return cpu->env.pc;
+}
+
+
 static bool alpha_cpu_has_work(CPUState *cs)
 {
     /* Here we are checking to see if the CPU should wake up from HALT.
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = alpha_cpu_has_work;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
+    cc->get_pc = alpha_cpu_get_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+static vaddr arm_cpu_get_pc(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    if (is_a64(env)) {
+        return env->pc;
+    } else {
+        return env->regs[15];
+    }
+}
+
 #ifdef CONFIG_TCG
 void arm_cpu_synchronize_from_tb(CPUState *cs,
                                  const TranslationBlock *tb)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = arm_cpu_has_work;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
+    cc->get_pc = arm_cpu_get_pc;
     cc->gdb_read_register = arm_cpu_gdb_read_register;
     cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc_w = value / 2; /* internally PC points to words */
 }
 
+static vaddr avr_cpu_get_pc(CPUState *cs)
+{
+    AVRCPU *cpu = AVR_CPU(cs);
+
+    return cpu->env.pc_w * 2;
+}
+
 static bool avr_cpu_has_work(CPUState *cs)
 {
     AVRCPU *cpu = AVR_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = avr_cpu_has_work;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
+    cc->get_pc = avr_cpu_get_pc;
     dc->vmsd = &vms_avr_cpu;
     cc->sysemu_ops = &avr_sysemu_ops;
     cc->disas_set_info = avr_cpu_disas_set_info;
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr cris_cpu_get_pc(CPUState *cs)
+{
+    CRISCPU *cpu = CRIS_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool cris_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
@@ -XXX,XX +XXX,XX @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = cris_cpu_has_work;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
+    cc->get_pc = cris_cpu_get_pc;
     cc->gdb_read_register = cris_cpu_gdb_read_register;
     cc->gdb_write_register = cris_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_set_pc(CPUState *cs, vaddr value)
     env->gpr[HEX_REG_PC] = value;
 }
 
+static vaddr hexagon_cpu_get_pc(CPUState *cs)
+{
+    HexagonCPU *cpu = HEXAGON_CPU(cs);
+    CPUHexagonState *env = &cpu->env;
+    return env->gpr[HEX_REG_PC];
+}
+
 static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = hexagon_cpu_has_work;
     cc->dump_state = hexagon_dump_state;
     cc->set_pc = hexagon_cpu_set_pc;
+    cc->get_pc = hexagon_cpu_get_pc;
     cc->gdb_read_register = hexagon_gdb_read_register;
     cc->gdb_write_register = hexagon_gdb_write_register;
     cc->gdb_num_core_regs = TOTAL_PER_THREAD_REGS + NUM_VREGS + NUM_QREGS;
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.iaoq_b = value + 4;
 }
 
+static vaddr hppa_cpu_get_pc(CPUState *cs)
+{
+    HPPACPU *cpu = HPPA_CPU(cs);
+
+    return cpu->env.iaoq_f;
+}
+
 static void hppa_cpu_synchronize_from_tb(CPUState *cs,
                                          const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = hppa_cpu_has_work;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
+    cc->get_pc = hppa_cpu_get_pc;
     cc->gdb_read_register = hppa_cpu_gdb_read_register;
     cc->gdb_write_register = hppa_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.eip = value;
 }
 
+static vaddr x86_cpu_get_pc(CPUState *cs)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    /* Match cpu_get_tb_cpu_state. */
+    return cpu->env.eip + cpu->env.segs[R_CS].base;
+}
+
 int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->has_work = x86_cpu_has_work;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
+    cc->get_pc = x86_cpu_get_pc;
     cc->gdb_read_register = x86_cpu_gdb_read_register;
     cc->gdb_write_register = x86_cpu_gdb_write_register;
     cc->get_arch_id = x86_cpu_get_arch_id;
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
     env->pc = value;
 }
 
+static vaddr loongarch_cpu_get_pc(CPUState *cs)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    CPULoongArchState *env = &cpu->env;
+
+    return env->pc;
+}
+
 #ifndef CONFIG_USER_ONLY
 #include "hw/loongarch/virt.h"
 
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = loongarch_cpu_has_work;
     cc->dump_state = loongarch_cpu_dump_state;
     cc->set_pc = loongarch_cpu_set_pc;
+    cc->get_pc = loongarch_cpu_get_pc;
 #ifndef CONFIG_USER_ONLY
     dc->vmsd = &vmstate_loongarch_cpu;
     cc->sysemu_ops = &loongarch_sysemu_ops;
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr m68k_cpu_get_pc(CPUState *cs)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool m68k_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = m68k_cpu_has_work;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
+    cc->get_pc = m68k_cpu_get_pc;
     cc->gdb_read_register = m68k_cpu_gdb_read_register;
     cc->gdb_write_register = m68k_cpu_gdb_write_register;
 #if defined(CONFIG_SOFTMMU)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.iflags = 0;
 }
 
+static vaddr mb_cpu_get_pc(CPUState *cs)
+{
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void mb_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
+    cc->get_pc = mb_cpu_get_pc;
     cc->gdb_read_register = mb_cpu_gdb_read_register;
     cc->gdb_write_register = mb_cpu_gdb_write_register;
 
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     mips_env_set_pc(&cpu->env, value);
 }
 
+static vaddr mips_cpu_get_pc(CPUState *cs)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+
+    return cpu->env.active_tc.PC;
+}
+
 static bool mips_cpu_has_work(CPUState *cs)
 {
     MIPSCPU *cpu = MIPS_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = mips_cpu_has_work;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
+    cc->get_pc = mips_cpu_get_pc;
     cc->gdb_read_register = mips_cpu_gdb_read_register;
     cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_set_pc(CPUState *cs, vaddr value)
     env->pc = value;
 }
 
+static vaddr nios2_cpu_get_pc(CPUState *cs)
+{
+    Nios2CPU *cpu = NIOS2_CPU(cs);
+    CPUNios2State *env = &cpu->env;
+
+    return env->pc;
+}
+
 static bool nios2_cpu_has_work(CPUState *cs)
 {
     return cs->interrupt_request & CPU_INTERRUPT_HARD;
@@ -XXX,XX +XXX,XX @@ static void nios2_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = nios2_cpu_has_work;
     cc->dump_state = nios2_cpu_dump_state;
     cc->set_pc = nios2_cpu_set_pc;
+    cc->get_pc = nios2_cpu_get_pc;
     cc->disas_set_info = nios2_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
     cc->sysemu_ops = &nios2_sysemu_ops;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.dflag = 0;
 }
 
+static vaddr openrisc_cpu_get_pc(CPUState *cs)
+{
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
                                              const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = openrisc_cpu_has_work;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
+    cc->get_pc = openrisc_cpu_get_pc;
     cc->gdb_read_register = openrisc_cpu_gdb_read_register;
     cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.nip = value;
 }
 
+static vaddr ppc_cpu_get_pc(CPUState *cs)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+
+    return cpu->env.nip;
+}
+
 static bool ppc_cpu_has_work(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = ppc_cpu_has_work;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
+    cc->get_pc = ppc_cpu_get_pc;
     cc->gdb_read_register = ppc_cpu_gdb_read_register;
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+static vaddr riscv_cpu_get_pc(CPUState *cs)
+{
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    CPURISCVState *env = &cpu->env;
+
+    /* Match cpu_get_tb_cpu_state. */
+    if (env->xl == MXL_RV32) {
+        return env->pc & UINT32_MAX;
+    }
+    return env->pc;
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->has_work = riscv_cpu_has_work;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
+    cc->get_pc = riscv_cpu_get_pc;
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr rx_cpu_get_pc(CPUState *cs)
+{
+    RXCPU *cpu = RX_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void rx_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
     cc->has_work = rx_cpu_has_work;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
+    cc->get_pc = rx_cpu_get_pc;
 
 #ifndef CONFIG_USER_ONLY
     cc->sysemu_ops = &rx_sysemu_ops;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.psw.addr = value;
 }
 
+static vaddr s390_cpu_get_pc(CPUState *cs)
+{
+    S390CPU *cpu = S390_CPU(cs);
+
+    return cpu->env.psw.addr;
+}
+
 static bool s390_cpu_has_work(CPUState *cs)
 {
     S390CPU *cpu = S390_CPU(cs);
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = s390_cpu_has_work;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
+    cc->get_pc = s390_cpu_get_pc;
     cc->gdb_read_register = s390_cpu_gdb_read_register;
     cc->gdb_write_register = s390_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr superh_cpu_get_pc(CPUState *cs)
+{
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void superh_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = superh_cpu_has_work;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
+    cc->get_pc = superh_cpu_get_pc;
     cc->gdb_read_register = superh_cpu_gdb_read_register;
     cc->gdb_write_register = superh_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.npc = value + 4;
 }
 
+static vaddr sparc_cpu_get_pc(CPUState *cs)
+{
+    SPARCCPU *cpu = SPARC_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static void sparc_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
 #endif
     cc->set_pc = sparc_cpu_set_pc;
+    cc->get_pc = sparc_cpu_get_pc;
     cc->gdb_read_register = sparc_cpu_gdb_read_register;
     cc->gdb_write_register = sparc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_set_pc(CPUState *cs, vaddr value)
     env->PC = value & ~(target_ulong)1;
 }
 
+static vaddr tricore_cpu_get_pc(CPUState *cs)
+{
+    TriCoreCPU *cpu = TRICORE_CPU(cs);
+    CPUTriCoreState *env = &cpu->env;
+
+    return env->PC;
+}
+
 static void tricore_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
 
     cc->dump_state = tricore_cpu_dump_state;
     cc->set_pc = tricore_cpu_set_pc;
+    cc->get_pc = tricore_cpu_get_pc;
     cc->sysemu_ops = &tricore_sysemu_ops;
     cc->tcg_ops = &tricore_tcg_ops;
 }
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static vaddr xtensa_cpu_get_pc(CPUState *cs)
+{
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+
+    return cpu->env.pc;
+}
+
 static bool xtensa_cpu_has_work(CPUState *cs)
 {
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->has_work = xtensa_cpu_has_work;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
+    cc->get_pc = xtensa_cpu_get_pc;
     cc->gdb_read_register = xtensa_cpu_gdb_read_register;
     cc->gdb_write_register = xtensa_cpu_gdb_write_register;
     cc->gdb_stop_before_watchpoint = true;
-- 
2.34.1

The availability of tb->pc will shortly be conditional.
Introduce accessor functions to minimize ifdefs.

Pass around a known pc to places like tcg_gen_code,
where the caller must already have the value.

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void page_init(void);
 void tb_htable_init(void);
 
+/* Return the current PC from CPU, which may be cached in TB. */
+static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
+{
+    return tb_pc(tb);
+}
+
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
     uintptr_t jmp_dest[2];
 };
 
+/* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
+static inline target_ulong tb_pc(const TranslationBlock *tb)
+{
+    return tb->pc;
+}
+
 /* Hide the qatomic_read to make code a little easier on the eyes */
 static inline uint32_t tb_cflags(const TranslationBlock *tb)
 {
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ void tcg_register_thread(void);
 void tcg_prologue_init(TCGContext *s);
 void tcg_func_start(TCGContext *s);
 
-int tcg_gen_code(TCGContext *s, TranslationBlock *tb);
+int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start);
 
 void tcg_set_frame(TCGContext *s, TCGReg reg, intptr_t start, intptr_t size);
 
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const TranslationBlock *tb = p;
     const struct tb_desc *desc = d;
 
-    if (tb->pc == desc->pc &&
+    if (tb_pc(tb) == desc->pc &&
         tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     return tb;
 }
 
-static inline void log_cpu_exec(target_ulong pc, CPUState *cpu,
-                                const TranslationBlock *tb)
+static void log_cpu_exec(target_ulong pc, CPUState *cpu,
+                         const TranslationBlock *tb)
 {
-    if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC))
-        && qemu_log_in_addr_range(pc)) {
-
+    if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [" TARGET_FMT_lx
                       "/" TARGET_FMT_lx "/%08x/%08x] %s\n",
@@ -XXX,XX +XXX,XX @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
         return tcg_code_gen_epilogue;
     }
 
-    log_cpu_exec(pc, cpu, tb);
+    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
+        log_cpu_exec(pc, cpu, tb);
+    }
 
     return tb->tc.ptr;
 }
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
     TranslationBlock *last_tb;
     const void *tb_ptr = itb->tc.ptr;
 
-    log_cpu_exec(itb->pc, cpu, itb);
+    if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
+        log_cpu_exec(log_pc(cpu, itb), cpu, itb);
+    }
 
     qemu_thread_jit_execute();
     ret = tcg_qemu_tb_exec(env, tb_ptr);
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
          * of the start of the TB.
          */
         CPUClass *cc = CPU_GET_CLASS(cpu);
-        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
-                               "Stopped execution of TB chain before %p ["
-                               TARGET_FMT_lx "] %s\n",
-                               last_tb->tc.ptr, last_tb->pc,
-                               lookup_symbol(last_tb->pc));
+
         if (cc->tcg_ops->synchronize_from_tb) {
             cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
             assert(cc->set_pc);
-            cc->set_pc(cpu, last_tb->pc);
+            cc->set_pc(cpu, tb_pc(last_tb));
+        }
+        if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+            target_ulong pc = log_pc(cpu, last_tb);
+            if (qemu_log_in_addr_range(pc)) {
+                qemu_log("Stopped execution of TB chain before %p ["
+                         TARGET_FMT_lx "] %s\n",
+                         last_tb->tc.ptr, pc, lookup_symbol(pc));
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
     qemu_spin_unlock(&tb_next->jmp_lock);
 
-    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
-                           "Linking TBs %p [" TARGET_FMT_lx
-                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
-                           tb->tc.ptr, tb->pc, n,
-                           tb_next->tc.ptr, tb_next->pc);
+    qemu_log_mask(CPU_LOG_EXEC, "Linking TBs %p index %d -> %p\n",
+                  tb->tc.ptr, n, tb_next->tc.ptr);
     return;
 
  out_unlock_next:
@@ -XXX,XX +XXX,XX @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
 }
 
 static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
+                                    target_ulong pc,
                                     TranslationBlock **last_tb, int *tb_exit)
 {
     int32_t insns_left;
 
-    trace_exec_tb(tb, tb->pc);
+    trace_exec_tb(tb, pc);
     tb = cpu_tb_exec(cpu, tb, tb_exit);
     if (*tb_exit != TB_EXIT_REQUESTED) {
         *last_tb = tb;
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                 tb_add_jump(last_tb, tb_exit, tb);
             }
 
-            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
+            cpu_loop_exec_tb(cpu, tb, pc, &last_tb, &tb_exit);
 
             /* Try to align the host and virtual clocks
                if the guest is in advance */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 
         for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
             if (i == 0) {
-                prev = (j == 0 ? tb->pc : 0);
+                prev = (j == 0 ? tb_pc(tb) : 0);
             } else {
                 prev = tcg_ctx->gen_insn_data[i - 1][j];
             }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                      uintptr_t searched_pc, bool reset_icount)
 {
-    target_ulong data[TARGET_INSN_START_WORDS] = { tb->pc };
+    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
     uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
     CPUArchState *env = cpu->env_ptr;
     const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
     const TranslationBlock *a = ap;
     const TranslationBlock *b = bp;
 
-    return a->pc == b->pc &&
+    return tb_pc(a) == tb_pc(b) &&
         a->cs_base == b->cs_base &&
         a->flags == b->flags &&
         (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
@@ -XXX,XX +XXX,XX @@ static void do_tb_invalidate_check(void *p, uint32_t hash, void *userp)
     TranslationBlock *tb = p;
     target_ulong addr = *(target_ulong *)userp;
 
-    if (!(addr + TARGET_PAGE_SIZE <= tb->pc || addr >= tb->pc + tb->size)) {
+    if (!(addr + TARGET_PAGE_SIZE <= tb_pc(tb) ||
+          addr >= tb_pc(tb) + tb->size)) {
         printf("ERROR invalidate: address=" TARGET_FMT_lx
-               " PC=%08lx size=%04x\n", addr, (long)tb->pc, tb->size);
+               " PC=%08lx size=%04x\n", addr, (long)tb_pc(tb), tb->size);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void do_tb_page_check(void *p, uint32_t hash, void *userp)
     TranslationBlock *tb = p;
     int flags1, flags2;
 
-    flags1 = page_get_flags(tb->pc);
-    flags2 = page_get_flags(tb->pc + tb->size - 1);
+    flags1 = page_get_flags(tb_pc(tb));
+    flags2 = page_get_flags(tb_pc(tb) + tb->size - 1);
     if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
         printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
-               (long)tb->pc, tb->size, flags1, flags2);
+               (long)tb_pc(tb), tb->size, flags1, flags2);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0];
-    h = tb_hash_func(phys_pc, tb->pc, tb->flags, orig_cflags,
+    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
                      tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
         return;
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     }
 
     /* add in the hash table */
-    h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags,
+    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
                      tb->trace_vcpu_dstate);
     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
 
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->cpu = NULL;
     max_insns = tb->icount;
 
-    trace_translate_block(tb, tb->pc, tb->tc.ptr);
+    trace_translate_block(tb, pc, tb->tc.ptr);
 
     /* generate machine code */
     tb->jmp_reset_offset[0] = TB_JMP_RESET_OFFSET_INVALID;
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     ti = profile_getclock();
 #endif
 
-    gen_code_size = tcg_gen_code(tcg_ctx, tb);
+    gen_code_size = tcg_gen_code(tcg_ctx, tb, pc);
     if (unlikely(gen_code_size < 0)) {
  error_return:
         switch (gen_code_size) {
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
 #ifdef DEBUG_DISAS
     if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
-        qemu_log_in_addr_range(tb->pc)) {
+        qemu_log_in_addr_range(pc)) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             int code_size, data_size;
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
      */
     cpu->cflags_next_tb = curr_cflags(cpu) | CF_MEMI_ONLY | CF_LAST_IO | n;
 
-    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
-                           "cpu_io_recompile: rewound execution of TB to "
-                           TARGET_FMT_lx "\n", tb->pc);
+    if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+        target_ulong pc = log_pc(cpu, tb);
+        if (qemu_log_in_addr_range(pc)) {
+            qemu_log("cpu_io_recompile: rewound execution of TB to "
+                     TARGET_FMT_lx "\n", pc);
+        }
+    }
 
     cpu_loop_exit_noexc(cpu);
 }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_synchronize_from_tb(CPUState *cs,
      * never possible for an AArch64 TB to chain to an AArch32 TB.
      */
     if (is_a64(env)) {
-        env->pc = tb->pc;
+        env->pc = tb_pc(tb);
     } else {
-        env->regs[15] = tb->pc;
+        env->regs[15] = tb_pc(tb);
     }
 }
 #endif /* CONFIG_TCG */
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -XXX,XX +XXX,XX @@ static void avr_cpu_synchronize_from_tb(CPUState *cs,
     AVRCPU *cpu = AVR_CPU(cs);
     CPUAVRState *env = &cpu->env;
 
-    env->pc_w = tb->pc / 2; /* internally PC points to words */
+    env->pc_w = tb_pc(tb) / 2; /* internally PC points to words */
 }
 
 static void avr_cpu_reset(DeviceState *ds)
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
 {
     HexagonCPU *cpu = HEXAGON_CPU(cs);
     CPUHexagonState *env = &cpu->env;
-    env->gpr[HEX_REG_PC] = tb->pc;
+    env->gpr[HEX_REG_PC] = tb_pc(tb);
 }
 
 static bool hexagon_cpu_has_work(CPUState *cs)
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     HPPACPU *cpu = HPPA_CPU(cs);
 
 #ifdef CONFIG_USER_ONLY
-    cpu->env.iaoq_f = tb->pc;
+    cpu->env.iaoq_f = tb_pc(tb);
     cpu->env.iaoq_b = tb->cs_base;
 #else
     /* Recover the IAOQ values from the GVA + PRIV.  */
@@ -XXX,XX +XXX,XX @@ static void hppa_cpu_synchronize_from_tb(CPUState *cs,
     int32_t diff = cs_base;
 
     cpu->env.iasq_f = iasq_f;
-    cpu->env.iaoq_f = (tb->pc & ~iasq_f) + priv;
+    cpu->env.iaoq_f = (tb_pc(tb) & ~iasq_f) + priv;
     if (diff) {
         cpu->env.iaoq_b = cpu->env.iaoq_f + diff;
     }
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void x86_cpu_synchronize_from_tb(CPUState *cs,
 {
     X86CPU *cpu = X86_CPU(cs);
 
-    cpu->env.eip = tb->pc - tb->cs_base;
+    cpu->env.eip = tb_pc(tb) - tb->cs_base;
 }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
 
-    env->pc = tb->pc;
+    env->pc = tb_pc(tb);
 }
 #endif /* CONFIG_TCG */
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_synchronize_from_tb(CPUState *cs,
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.iflags = tb->flags & IFLAGS_TB_MASK;
 }
 
diff --git a/target/mips/tcg/exception.c b/target/mips/tcg/exception.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/exception.c
+++ b/target/mips/tcg/exception.c
@@ -XXX,XX +XXX,XX @@ void mips_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb)
     MIPSCPU *cpu = MIPS_CPU(cs);
     CPUMIPSState *env = &cpu->env;
 
-    env->active_tc.PC = tb->pc;
+    env->active_tc.PC = tb_pc(tb);
     env->hflags &= ~MIPS_HFLAG_BMASK;
     env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
 }
diff --git a/target/mips/tcg/sysemu/special_helper.c b/target/mips/tcg/sysemu/special_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/sysemu/special_helper.c
+++ b/target/mips/tcg/sysemu/special_helper.c
@@ -XXX,XX +XXX,XX @@ bool mips_io_recompile_replay_branch(CPUState *cs, const TranslationBlock *tb)
     CPUMIPSState *env = &cpu->env;
 
     if ((env->hflags & MIPS_HFLAG_BMASK) != 0
-        && env->active_tc.PC != tb->pc) {
+        && env->active_tc.PC != tb_pc(tb)) {
         env->active_tc.PC -= (env->hflags & MIPS_HFLAG_B16 ? 2 : 4);
         env->hflags &= ~MIPS_HFLAG_BMASK;
         return true;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
 {
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
 }
 
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
     RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
 
     if (xl == MXL_RV32) {
-        env->pc = (int32_t)tb->pc;
+        env->pc = (int32_t)tb_pc(tb);
     } else {
-        env->pc = tb->pc;
+        env->pc = tb_pc(tb);
     }
 }
 
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_synchronize_from_tb(CPUState *cs,
 {
     RXCPU *cpu = RX_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
 }
 
 static bool rx_cpu_has_work(CPUState *cs)
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
 {
     SuperHCPU *cpu = SUPERH_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     CPUSH4State *env = &cpu->env;
 
     if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
-        && env->pc != tb->pc) {
+        && env->pc != tb_pc(tb)) {
         env->pc -= 2;
         env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
         return true;
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
 {
     SPARCCPU *cpu = SPARC_CPU(cs);
 
-    cpu->env.pc = tb->pc;
+    cpu->env.pc = tb_pc(tb);
     cpu->env.npc = tb->cs_base;
 }
 
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -XXX,XX +XXX,XX @@ static void tricore_cpu_synchronize_from_tb(CPUState *cs,
     TriCoreCPU *cpu = TRICORE_CPU(cs);
     CPUTriCoreState *env = &cpu->env;
 
-    env->PC = tb->pc;
+    env->PC = tb_pc(tb);
 }
 
 static void tricore_cpu_reset(DeviceState *dev)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -XXX,XX +XXX,XX @@ int64_t tcg_cpu_exec_time(void)
 #endif
 
 
-int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
+int tcg_gen_code(TCGContext *s, TranslationBlock *tb, target_ulong pc_start)
 {
 #ifdef CONFIG_PROFILER
     TCGProfile *prof = &s->prof;
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
 #ifdef DEBUG_DISAS
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
-                 && qemu_log_in_addr_range(tb->pc))) {
+                 && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             fprintf(logfile, "OP:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     if (s->nb_indirects > 0) {
 #ifdef DEBUG_DISAS
         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_IND)
-                     && qemu_log_in_addr_range(tb->pc))) {
+                     && qemu_log_in_addr_range(pc_start))) {
             FILE *logfile = qemu_log_trylock();
             if (logfile) {
                 fprintf(logfile, "OP before indirect lowering:\n");
@@ -XXX,XX +XXX,XX @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
 #ifdef DEBUG_DISAS
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
-                 && qemu_log_in_addr_range(tb->pc))) {
+                 && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             fprintf(logfile, "OP after optimization and liveness analysis:\n");
-- 
2.34.1

Prepare for targets to be able to produce TBs that can
run in more than one virtual context.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      |  4 +++
 accel/tcg/tb-jmp-cache.h  | 41 +++++++++++++++++++++++++
 include/exec/cpu-defs.h   |  3 ++
 include/exec/exec-all.h   | 32 ++++++++++++++++++--
 accel/tcg/cpu-exec.c      | 16 ++++++----
 accel/tcg/translate-all.c | 64 ++++++++++++++++++++++++++-------------
 6 files changed, 131 insertions(+), 29 deletions(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -XXX,XX +XXX,XX @@ void tb_htable_init(void);
 /* Return the current PC from CPU, which may be cached in TB. */
 static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
 {
+#if TARGET_TB_PCREL
+    return cpu->cc->get_pc(cpu);
+#else
     return tb_pc(tb);
+#endif
 }
 
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tb-jmp-cache.h
+++ b/accel/tcg/tb-jmp-cache.h
@@ -XXX,XX +XXX,XX @@
 
 /*
  * Accessed in parallel; all accesses to 'tb' must be atomic.
+ * For TARGET_TB_PCREL, accesses to 'pc' must be protected by
+ * a load_acquire/store_release to 'tb'.
  */
 struct CPUJumpCache {
     struct {
         TranslationBlock *tb;
+#if TARGET_TB_PCREL
+        target_ulong pc;
+#endif
     } array[TB_JMP_CACHE_SIZE];
 };
 
+static inline TranslationBlock *
+tb_jmp_cache_get_tb(CPUJumpCache *jc, uint32_t hash)
+{
+#if TARGET_TB_PCREL
+    /* Use acquire to ensure current load of pc from jc. */
+    return qatomic_load_acquire(&jc->array[hash].tb);
+#else
+    /* Use rcu_read to ensure current load of pc from *tb. */
+    return qatomic_rcu_read(&jc->array[hash].tb);
+#endif
+}
+
+static inline target_ulong
+tb_jmp_cache_get_pc(CPUJumpCache *jc, uint32_t hash, TranslationBlock *tb)
+{
+#if TARGET_TB_PCREL
+    return jc->array[hash].pc;
+#else
+    return tb_pc(tb);
+#endif
+}
+
+static inline void
+tb_jmp_cache_set(CPUJumpCache *jc, uint32_t hash,
+                 TranslationBlock *tb, target_ulong pc)
+{
+#if TARGET_TB_PCREL
+    jc->array[hash].pc = pc;
+    /* Use store_release on tb to ensure pc is written first. */
+    qatomic_store_release(&jc->array[hash].tb, tb);
+#else
+    /* Use the pc value already stored in tb->pc. */
+    qatomic_set(&jc->array[hash].tb, tb);
+#endif
+}
+
 #endif /* ACCEL_TCG_TB_JMP_CACHE_H */
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -XXX,XX +XXX,XX @@
 #  error TARGET_PAGE_BITS must be defined in cpu-param.h
 # endif
 #endif
+#ifndef TARGET_TB_PCREL
+# define TARGET_TB_PCREL 0
+#endif
 
 #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ struct tb_tc {
 };
 
 struct TranslationBlock {
-    target_ulong pc;   /* simulated PC corresponding to this block (EIP + CS base) */
-    target_ulong cs_base; /* CS base for this block */
+#if !TARGET_TB_PCREL
+    /*
+     * Guest PC corresponding to this block.  This must be the true
+     * virtual address.  Therefore e.g. x86 stores EIP + CS_BASE, and
+     * targets like Arm, MIPS, HP-PA, which reuse low bits for ISA or
+     * privilege, must store those bits elsewhere.
+     *
+     * If TARGET_TB_PCREL, the opcodes for the TranslationBlock are
+     * written such that the TB is associated only with the physical
+     * page and may be run in any virtual address context.  In this case,
+     * PC must always be taken from ENV in a target-specific manner.
+     * Unwind information is taken as offsets from the page, to be
+     * deposited into the "current" PC.
+     */
+    target_ulong pc;
+#endif
+
+    /*
+     * Target-specific data associated with the TranslationBlock, e.g.:
+     * x86: the original user, the Code Segment virtual base,
+     * arm: an extension of tb->flags,
+     * s390x: instruction data for EXECUTE,
+     * sparc: the next pc of the instruction queue (for delay slots).
+     */
+    target_ulong cs_base;
+
     uint32_t flags; /* flags defining in which context the code was generated */
     uint32_t cflags;    /* compile flags */
 
@@ -XXX,XX +XXX,XX @@ struct TranslationBlock {
 /* Hide the read to avoid ifdefs for TARGET_TB_PCREL. */
 static inline target_ulong tb_pc(const TranslationBlock *tb)
 {
+#if TARGET_TB_PCREL
+    qemu_build_not_reached();
+#else
     return tb->pc;
+#endif
 }
 
 /* Hide the qatomic_read to make code a little easier on the eyes */
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const TranslationBlock *tb = p;
     const struct tb_desc *desc = d;
 
-    if (tb_pc(tb) == desc->pc &&
+    if ((TARGET_TB_PCREL || tb_pc(tb) == desc->pc) &&
         tb->page_addr[0] == desc->page_addr0 &&
         tb->cs_base == desc->cs_base &&
         tb->flags == desc->flags &&
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
         return NULL;
     }
     desc.page_addr0 = phys_pc;
-    h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : pc),
+                     flags, cflags, *cpu->trace_dstate);
     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
                                           uint32_t flags, uint32_t cflags)
 {
     TranslationBlock *tb;
+    CPUJumpCache *jc;
     uint32_t hash;
 
     /* we should never be trying to look up an INVALID tb */
     tcg_debug_assert(!(cflags & CF_INVALID));
 
     hash = tb_jmp_cache_hash_func(pc);
-    tb = qatomic_rcu_read(&cpu->tb_jmp_cache->array[hash].tb);
+    jc = cpu->tb_jmp_cache;
+    tb = tb_jmp_cache_get_tb(jc, hash);
 
     if (likely(tb &&
-               tb->pc == pc &&
+               tb_jmp_cache_get_pc(jc, hash, tb) == pc &&
                tb->cs_base == cs_base &&
                tb->flags == flags &&
                tb->trace_vcpu_dstate == *cpu->trace_dstate &&
@@ -XXX,XX +XXX,XX @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     if (tb == NULL) {
         return NULL;
     }
-    qatomic_set(&cpu->tb_jmp_cache->array[hash].tb, tb);
+    tb_jmp_cache_set(jc, hash, tb, pc);
     return tb;
 }
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (cc->tcg_ops->synchronize_from_tb) {
             cc->tcg_ops->synchronize_from_tb(cpu, last_tb);
         } else {
+            assert(!TARGET_TB_PCREL);
             assert(cc->set_pc);
             cc->set_pc(cpu, tb_pc(last_tb));
         }
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
                  * for the fast lookup
                  */
                 h = tb_jmp_cache_hash_func(pc);
-                qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);
+                tb_jmp_cache_set(cpu->tb_jmp_cache, h, tb, pc);
             }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 
         for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
             if (i == 0) {
-                prev = (j == 0 ? tb_pc(tb) : 0);
+                prev = (!TARGET_TB_PCREL && j == 0 ? tb_pc(tb) : 0);
             } else {
                 prev = tcg_ctx->gen_insn_data[i - 1][j];
             }
@@ -XXX,XX +XXX,XX @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
 static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                      uintptr_t searched_pc, bool reset_icount)
 {
-    target_ulong data[TARGET_INSN_START_WORDS] = { tb_pc(tb) };
+    target_ulong data[TARGET_INSN_START_WORDS];
     uintptr_t host_pc = (uintptr_t)tb->tc.ptr;
     CPUArchState *env = cpu->env_ptr;
     const uint8_t *p = tb->tc.ptr + tb->tc.size;
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
         return -1;
     }
 
+    memset(data, 0, sizeof(data));
+    if (!TARGET_TB_PCREL) {
+        data[0] = tb_pc(tb);
+    }
+
     /* Reconstruct the stored insn data while looking for the point at
        which the end of the insn exceeds the searched_pc.  */
     for (i = 0; i < num_insns; ++i) {
@@ -XXX,XX +XXX,XX @@ static bool tb_cmp(const void *ap, const void *bp)
     const TranslationBlock *a = ap;
     const TranslationBlock *b = bp;
 
-    return tb_pc(a) == tb_pc(b) &&
-        a->cs_base == b->cs_base &&
-        a->flags == b->flags &&
-        (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
-        a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
-        a->page_addr[0] == b->page_addr[0] &&
-        a->page_addr[1] == b->page_addr[1];
+    return ((TARGET_TB_PCREL || tb_pc(a) == tb_pc(b)) &&
+            a->cs_base == b->cs_base &&
+            a->flags == b->flags &&
+            (tb_cflags(a) & ~CF_INVALID) == (tb_cflags(b) & ~CF_INVALID) &&
+            a->trace_vcpu_dstate == b->trace_vcpu_dstate &&
+            a->page_addr[0] == b->page_addr[0] &&
+            a->page_addr[1] == b->page_addr[1]);
 }
 
 void tb_htable_init(void)
@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
     qemu_spin_unlock(&dest->jmp_lock);
 }
 
+static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
+{
+    CPUState *cpu;
+
+    if (TARGET_TB_PCREL) {
+        /* A TB may be at any virtual address */
+        CPU_FOREACH(cpu) {
+            tcg_flush_jmp_cache(cpu);
+        }
+    } else {
+        uint32_t h = tb_jmp_cache_hash_func(tb_pc(tb));
+
+        CPU_FOREACH(cpu) {
+            CPUJumpCache *jc = cpu->tb_jmp_cache;
+
+            if (qatomic_read(&jc->array[h].tb) == tb) {
+                qatomic_set(&jc->array[h].tb, NULL);
+            }
+        }
+    }
+}
+
 /*
  * In user-mode, call with mmap_lock held.
  * In !user-mode, if @rm_from_page_list is set, call with the TB's pages'
@@ -XXX,XX +XXX,XX @@ static inline void tb_jmp_unlink(TranslationBlock *dest)
  */
 static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 {
-    CPUState *cpu;
     PageDesc *p;
     uint32_t h;
     tb_page_addr_t phys_pc;
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
 
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0];
-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, orig_cflags,
-                     tb->trace_vcpu_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
+                     tb->flags, orig_cflags, tb->trace_vcpu_dstate);
     if (!qht_remove(&tb_ctx.htable, tb, h)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void do_tb_phys_invalidate(TranslationBlock *tb, bool rm_from_page_list)
     }
 
     /* remove the TB from the hash list */
-    h = tb_jmp_cache_hash_func(tb->pc);
-    CPU_FOREACH(cpu) {
-        CPUJumpCache *jc = cpu->tb_jmp_cache;
-        if (qatomic_read(&jc->array[h].tb) == tb) {
-            qatomic_set(&jc->array[h].tb, NULL);
-        }
-    }
+    tb_jmp_cache_inval_tb(tb);
 
     /* suppress this TB from the two jump lists */
     tb_remove_from_jmp_list(tb, 0);
@@ -XXX,XX +XXX,XX @@ tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     }
 
     /* add in the hash table */
-    h = tb_hash_func(phys_pc, tb_pc(tb), tb->flags, tb->cflags,
-                     tb->trace_vcpu_dstate);
+    h = tb_hash_func(phys_pc, (TARGET_TB_PCREL ? 0 : tb_pc(tb)),
+                     tb->flags, tb->cflags, tb->trace_vcpu_dstate);
     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
 
     /* remove TB from the page(s) if we couldn't insert it */
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
     gen_code_buf = tcg_ctx->code_gen_ptr;
     tb->tc.ptr = tcg_splitwx_to_rx(gen_code_buf);
+#if !TARGET_TB_PCREL
     tb->pc = pc;
+#endif
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
-- 
2.34.1

From: Leandro Lupori <leandro.lupori@eldorado.org.br>

PowerPC64 processors handle direct branches better than indirect
ones, resulting in less stalled cycles and branch misses.

However, PPC's tb_target_set_jmp_target() was only using direct
branches for 16-bit jumps, while PowerPC64's unconditional branch
instructions are able to handle displacements of up to 26 bits.
To take advantage of this, now jumps whose displacements fit in
between 17 and 26 bits are also converted to direct branches.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Leandro Lupori <leandro.lupori@eldorado.org.br>
[rth: Expanded some commentary.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 119 +++++++++++++++++++++++++++++----------
 1 file changed, 88 insertions(+), 31 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
     tcg_out32(s, insn);
 }
 
+static inline uint64_t make_pair(tcg_insn_unit i1, tcg_insn_unit i2)
+{
+    if (HOST_BIG_ENDIAN) {
+        return (uint64_t)i1 << 32 | i2;
+    }
+    return (uint64_t)i2 << 32 | i1;
+}
+
+static inline void ppc64_replace2(uintptr_t rx, uintptr_t rw,
+                                  tcg_insn_unit i0, tcg_insn_unit i1)
+{
+#if TCG_TARGET_REG_BITS == 64
+    qatomic_set((uint64_t *)rw, make_pair(i0, i1));
+    flush_idcache_range(rx, rw, 8);
+#else
+    qemu_build_not_reached();
+#endif
+}
+
+static inline void ppc64_replace4(uintptr_t rx, uintptr_t rw,
+                                  tcg_insn_unit i0, tcg_insn_unit i1,
+                                  tcg_insn_unit i2, tcg_insn_unit i3)
+{
+    uint64_t p[2];
+
+    p[!HOST_BIG_ENDIAN] = make_pair(i0, i1);
+    p[HOST_BIG_ENDIAN] = make_pair(i2, i3);
+
+    /*
+     * There's no convenient way to get the compiler to allocate a pair
+     * of registers at an even index, so copy into r6/r7 and clobber.
+     */
+    asm("mr  %%r6, %1\n\t"
+        "mr  %%r7, %2\n\t"
+        "stq %%r6, %0"
+        : "=Q"(*(__int128 *)rw) : "r"(p[0]), "r"(p[1]) : "r6", "r7");
+    flush_idcache_range(rx, rw, 16);
+}
+
 void tb_target_set_jmp_target(uintptr_t tc_ptr, uintptr_t jmp_rx,
                               uintptr_t jmp_rw, uintptr_t addr)
 {
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_insn_unit i1, i2;
-        intptr_t tb_diff = addr - tc_ptr;
-        intptr_t br_diff = addr - (jmp_rx + 4);
-        uint64_t pair;
+    tcg_insn_unit i0, i1, i2, i3;
+    intptr_t tb_diff = addr - tc_ptr;
+    intptr_t br_diff = addr - (jmp_rx + 4);
+    intptr_t lo, hi;
 
-        /* This does not exercise the range of the branch, but we do
-           still need to be able to load the new value of TCG_REG_TB.
-           But this does still happen quite often.  */
-        if (tb_diff == (int16_t)tb_diff) {
-            i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
-            i2 = B | (br_diff & 0x3fffffc);
-        } else {
-            intptr_t lo = (int16_t)tb_diff;
-            intptr_t hi = (int32_t)(tb_diff - lo);
-            assert(tb_diff == hi + lo);
-            i1 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
-            i2 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
-        }
-#if HOST_BIG_ENDIAN
-        pair = (uint64_t)i1 << 32 | i2;
-#else
-        pair = (uint64_t)i2 << 32 | i1;
-#endif
-
-        /* As per the enclosing if, this is ppc64.  Avoid the _Static_assert
-           within qatomic_set that would fail to build a ppc32 host.  */
-        qatomic_set__nocheck((uint64_t *)jmp_rw, pair);
-        flush_idcache_range(jmp_rx, jmp_rw, 8);
-    } else {
+    if (TCG_TARGET_REG_BITS == 32) {
         intptr_t diff = addr - jmp_rx;
         tcg_debug_assert(in_range_b(diff));
         qatomic_set((uint32_t *)jmp_rw, B | (diff & 0x3fffffc));
         flush_idcache_range(jmp_rx, jmp_rw, 4);
+        return;
     }
+
+    /*
+     * For 16-bit displacements, we can use a single add + branch.
+     * This happens quite often.
+     */
+    if (tb_diff == (int16_t)tb_diff) {
+        i0 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, tb_diff);
+        i1 = B | (br_diff & 0x3fffffc);
+        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
+        return;
+    }
+
+    lo = (int16_t)tb_diff;
+    hi = (int32_t)(tb_diff - lo);
+    assert(tb_diff == hi + lo);
+    i0 = ADDIS | TAI(TCG_REG_TB, TCG_REG_TB, hi >> 16);
+    i1 = ADDI | TAI(TCG_REG_TB, TCG_REG_TB, lo);
+
+    /*
+     * Without stq from 2.07, we can only update two insns,
+     * and those must be the ones that load the target address.
+     */
+    if (!have_isa_2_07) {
+        ppc64_replace2(jmp_rx, jmp_rw, i0, i1);
+        return;
+    }
+
+    /*
+     * For 26-bit displacements, we can use a direct branch.
+     * Otherwise we still need the indirect branch, which we
+     * must restore after a potential direct branch write.
+     */
+    br_diff -= 4;
+    if (in_range_b(br_diff)) {
+        i2 = B | (br_diff & 0x3fffffc);
+        i3 = NOP;
+    } else {
+        i2 = MTSPR | RS(TCG_REG_TB) | CTR;
+        i3 = BCCTR | BO_ALWAYS;
+    }
+    ppc64_replace4(jmp_rx, jmp_rw, i0, i1, i2, i3);
 }
 
 static void tcg_out_call_int(TCGContext *s, int lk,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         if (s->tb_jmp_insn_offset) {
             /* Direct jump. */
             if (TCG_TARGET_REG_BITS == 64) {
-                /* Ensure the next insns are 8-byte aligned. */
-                if ((uintptr_t)s->code_ptr & 7) {
+                /* Ensure the next insns are 8 or 16-byte aligned. */
+                while ((uintptr_t)s->code_ptr & (have_isa_2_07 ? 15 : 7)) {
                     tcg_out32(s, NOP);
                 }
                 s->tb_jmp_insn_offset[args[0]] = tcg_current_code_size(s);
-- 
2.34.1

The value previously chosen overlaps GUSA_MASK.

Rename all DELAY_SLOT_* and GUSA_* defines to emphasize
that they are included in TB_FLAGs.  Add aliases for the
FPSCR and SR bits that are included in TB_FLAGS, so that
we don't accidentally reassign those bits.

Fixes: 4da06fb3062 ("target/sh4: Implement prctl_unalign_sigbus")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/856
Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/cpu.h        | 56 +++++++++++++------------
 linux-user/sh4/signal.c |  6 +--
 target/sh4/cpu.c        |  6 +--
 target/sh4/helper.c     |  6 +--
 target/sh4/translate.c  | 90 ++++++++++++++++++++++-------------------
 5 files changed, 88 insertions(+), 76 deletions(-)

diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define FPSCR_RM_NEAREST       (0 << 0)
 #define FPSCR_RM_ZERO          (1 << 0)
 
-#define DELAY_SLOT_MASK        0x7
-#define DELAY_SLOT             (1 << 0)
-#define DELAY_SLOT_CONDITIONAL (1 << 1)
-#define DELAY_SLOT_RTE         (1 << 2)
+#define TB_FLAG_DELAY_SLOT       (1 << 0)
+#define TB_FLAG_DELAY_SLOT_COND  (1 << 1)
+#define TB_FLAG_DELAY_SLOT_RTE   (1 << 2)
+#define TB_FLAG_PENDING_MOVCA    (1 << 3)
+#define TB_FLAG_GUSA_SHIFT       4                      /* [11:4] */
+#define TB_FLAG_GUSA_EXCLUSIVE   (1 << 12)
+#define TB_FLAG_UNALIGN          (1 << 13)
+#define TB_FLAG_SR_FD            (1 << SR_FD)           /* 15 */
+#define TB_FLAG_FPSCR_PR         FPSCR_PR               /* 19 */
+#define TB_FLAG_FPSCR_SZ         FPSCR_SZ               /* 20 */
+#define TB_FLAG_FPSCR_FR         FPSCR_FR               /* 21 */
+#define TB_FLAG_SR_RB            (1 << SR_RB)           /* 29 */
+#define TB_FLAG_SR_MD            (1 << SR_MD)           /* 30 */
 
-#define TB_FLAG_PENDING_MOVCA  (1 << 3)
-#define TB_FLAG_UNALIGN        (1 << 4)
-
-#define GUSA_SHIFT             4
-#ifdef CONFIG_USER_ONLY
-#define GUSA_EXCLUSIVE         (1 << 12)
-#define GUSA_MASK              ((0xff << GUSA_SHIFT) | GUSA_EXCLUSIVE)
-#else
-/* Provide dummy versions of the above to allow tests against tbflags
-   to be elided while avoiding ifdefs.  */
-#define GUSA_EXCLUSIVE         0
-#define GUSA_MASK              0
-#endif
-
-#define TB_FLAG_ENVFLAGS_MASK  (DELAY_SLOT_MASK | GUSA_MASK)
+#define TB_FLAG_DELAY_SLOT_MASK  (TB_FLAG_DELAY_SLOT |       \
+                                  TB_FLAG_DELAY_SLOT_COND |  \
+                                  TB_FLAG_DELAY_SLOT_RTE)
+#define TB_FLAG_GUSA_MASK        ((0xff << TB_FLAG_GUSA_SHIFT) | \
+                                  TB_FLAG_GUSA_EXCLUSIVE)
+#define TB_FLAG_FPSCR_MASK       (TB_FLAG_FPSCR_PR | \
+                                  TB_FLAG_FPSCR_SZ | \
+                                  TB_FLAG_FPSCR_FR)
+#define TB_FLAG_SR_MASK          (TB_FLAG_SR_FD | \
+                                  TB_FLAG_SR_RB | \
+                                  TB_FLAG_SR_MD)
+#define TB_FLAG_ENVFLAGS_MASK    (TB_FLAG_DELAY_SLOT_MASK | \
+                                  TB_FLAG_GUSA_MASK)
 
 typedef struct tlb_t {
     uint32_t vpn;		/* virtual page number */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index (CPUSH4State *env, bool ifetch)
 {
     /* The instruction in a RTE delay slot is fetched in privileged
        mode, but executed in user mode.  */
-    if (ifetch && (env->flags & DELAY_SLOT_RTE)) {
+    if (ifetch && (env->flags & TB_FLAG_DELAY_SLOT_RTE)) {
         return 0;
     } else {
         return (env->sr & (1u << SR_MD)) == 0 ? 1 : 0;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
 {
     *pc = env->pc;
     /* For a gUSA region, notice the end of the region.  */
-    *cs_base = env->flags & GUSA_MASK ? env->gregs[0] : 0;
-    *flags = env->flags /* TB_FLAG_ENVFLAGS_MASK: bits 0-2, 4-12 */
-            | (env->fpscr & (FPSCR_FR | FPSCR_SZ | FPSCR_PR))  /* Bits 19-21 */
-            | (env->sr & ((1u << SR_MD) | (1u << SR_RB)))      /* Bits 29-30 */
-            | (env->sr & (1u << SR_FD))                        /* Bit 15 */
+    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
+    *flags = env->flags
+            | (env->fpscr & TB_FLAG_FPSCR_MASK)
+            | (env->sr & TB_FLAG_SR_MASK)
             | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
 #ifdef CONFIG_USER_ONLY
     *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/sh4/signal.c
+++ b/linux-user/sh4/signal.c
@@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc)
     __get_user(regs->fpul, &sc->sc_fpul);
 
     regs->tra = -1;         /* disable syscall checks */
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags = 0;
 }
 
 void setup_frame(int sig, struct target_sigaction *ka,
@@ -XXX,XX +XXX,XX @@ void setup_frame(int sig, struct target_sigaction *ka,
     regs->gregs[5] = 0;
     regs->gregs[6] = frame_addr += offsetof(typeof(*frame), sc);
     regs->pc = (unsigned long) ka->_sa_handler;
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
 
     unlock_user_struct(frame, frame_addr, 1);
     return;
@@ -XXX,XX +XXX,XX @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
     regs->gregs[5] = frame_addr + offsetof(typeof(*frame), info);
     regs->gregs[6] = frame_addr + offsetof(typeof(*frame), uc);
     regs->pc = (unsigned long) ka->_sa_handler;
-    regs->flags &= ~(DELAY_SLOT_MASK | GUSA_MASK);
+    regs->flags &= ~(TB_FLAG_DELAY_SLOT_MASK | TB_FLAG_GUSA_MASK);
 
     unlock_user_struct(frame, frame_addr, 1);
     return;
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_synchronize_from_tb(CPUState *cs,
     SuperHCPU *cpu = SUPERH_CPU(cs);
 
     cpu->env.pc = tb_pc(tb);
-    cpu->env.flags = tb->flags & TB_FLAG_ENVFLAGS_MASK;
+    cpu->env.flags = tb->flags;
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
     SuperHCPU *cpu = SUPERH_CPU(cs);
     CPUSH4State *env = &cpu->env;
 
-    if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
+    if ((env->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND))
         && env->pc != tb_pc(tb)) {
         env->pc -= 2;
-        env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
+        env->flags &= ~(TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND);
         return true;
     }
     return false;
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -XXX,XX +XXX,XX @@ void superh_cpu_do_interrupt(CPUState *cs)
     env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
     env->lock_addr = -1;
 
-    if (env->flags & DELAY_SLOT_MASK) {
+    if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
         /* Branch instruction should be executed again before delay slot. */
 	env->spc -= 2;
 	/* Clear flags for exception/interrupt routine. */
-        env->flags &= ~DELAY_SLOT_MASK;
+        env->flags &= ~TB_FLAG_DELAY_SLOT_MASK;
     }
 
     if (do_exp) {
@@ -XXX,XX +XXX,XX @@ bool superh_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         CPUSH4State *env = &cpu->env;
 
         /* Delay slots are indivisible, ignore interrupts */
-        if (env->flags & DELAY_SLOT_MASK) {
+        if (env->flags & TB_FLAG_DELAY_SLOT_MASK) {
             return false;
         } else {
             superh_cpu_do_interrupt(cs);
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -XXX,XX +XXX,XX @@ void superh_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 		    i, env->gregs[i], i + 1, env->gregs[i + 1],
 		    i + 2, env->gregs[i + 2], i + 3, env->gregs[i + 3]);
     }
-    if (env->flags & DELAY_SLOT) {
+    if (env->flags & TB_FLAG_DELAY_SLOT) {
         qemu_printf("in delay slot (delayed_pc=0x%08x)\n",
 		    env->delayed_pc);
-    } else if (env->flags & DELAY_SLOT_CONDITIONAL) {
+    } else if (env->flags & TB_FLAG_DELAY_SLOT_COND) {
         qemu_printf("in conditional delay slot (delayed_pc=0x%08x)\n",
 		    env->delayed_pc);
-    } else if (env->flags & DELAY_SLOT_RTE) {
+    } else if (env->flags & TB_FLAG_DELAY_SLOT_RTE) {
         qemu_fprintf(f, "in rte delay slot (delayed_pc=0x%08x)\n",
                      env->delayed_pc);
     }
@@ -XXX,XX +XXX,XX @@ static inline void gen_save_cpu_state(DisasContext *ctx, bool save_pc)
 
 static inline bool use_exit_tb(DisasContext *ctx)
 {
-    return (ctx->tbflags & GUSA_EXCLUSIVE) != 0;
+    return (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) != 0;
 }
 
 static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
@@ -XXX,XX +XXX,XX @@ static void gen_conditional_jump(DisasContext *ctx, target_ulong dest,
     TCGLabel *l1 = gen_new_label();
     TCGCond cond_not_taken = jump_if_true ? TCG_COND_EQ : TCG_COND_NE;
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* When in an exclusive region, we must continue to the end.
            Therefore, exit the region on a taken branch, but otherwise
            fall through to the next instruction.  */
         tcg_gen_brcondi_i32(cond_not_taken, cpu_sr_t, 0, l1);
-        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
+        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
         /* Note that this won't actually use a goto_tb opcode because we
            disallow it in use_goto_tb, but it handles exit + singlestep.  */
         gen_goto_tb(ctx, 0, dest);
@@ -XXX,XX +XXX,XX @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
     tcg_gen_mov_i32(ds, cpu_delayed_cond);
     tcg_gen_discard_i32(cpu_delayed_cond);
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* When in an exclusive region, we must continue to the end.
            Therefore, exit the region on a taken branch, but otherwise
            fall through to the next instruction.  */
         tcg_gen_brcondi_i32(TCG_COND_EQ, ds, 0, l1);
 
         /* Leave the gUSA region.  */
-        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~GUSA_MASK);
+        tcg_gen_movi_i32(cpu_flags, ctx->envflags & ~TB_FLAG_GUSA_MASK);
         gen_jump(ctx);
 
         gen_set_label(l1);
@@ -XXX,XX +XXX,XX @@ static inline void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
 #define XHACK(x) ((((x) & 1 ) << 4) | ((x) & 0xe))
 
 #define CHECK_NOT_DELAY_SLOT \
-    if (ctx->envflags & DELAY_SLOT_MASK) {  \
-        goto do_illegal_slot;               \
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {  \
+        goto do_illegal_slot;                       \
     }
 
 #define CHECK_PRIVILEGED \
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x000b:		/* rts */
 	CHECK_NOT_DELAY_SLOT
 	tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x0028:		/* clrmac */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         gen_write_sr(cpu_ssr);
 	tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc);
-        ctx->envflags |= DELAY_SLOT_RTE;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_RTE;
 	ctx->delayed_pc = (uint32_t) - 1;
         ctx->base.is_jmp = DISAS_STOP;
 	return;
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	return;
     case 0xe000:		/* mov #imm,Rn */
 #ifdef CONFIG_USER_ONLY
-        /* Detect the start of a gUSA region.  If so, update envflags
-           and end the TB.  This will allow us to see the end of the
-           region (stored in R0) in the next TB.  */
+        /*
+         * Detect the start of a gUSA region (mov #-n, r15).
+         * If so, update envflags and end the TB.  This will allow us
+         * to see the end of the region (stored in R0) in the next TB.
+         */
         if (B11_8 == 15 && B7_0s < 0 &&
             (tb_cflags(ctx->base.tb) & CF_PARALLEL)) {
-            ctx->envflags = deposit32(ctx->envflags, GUSA_SHIFT, 8, B7_0s);
+            ctx->envflags =
+                deposit32(ctx->envflags, TB_FLAG_GUSA_SHIFT, 8, B7_0s);
             ctx->base.is_jmp = DISAS_STOP;
         }
 #endif
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0xa000:		/* bra disp */
 	CHECK_NOT_DELAY_SLOT
         ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	return;
     case 0xb000:		/* bsr disp */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B11_0s * 2;
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_xori_i32(cpu_delayed_cond, cpu_sr_t, 1);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
-        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
 	return;
     case 0x8900:		/* bt label */
 	CHECK_NOT_DELAY_SLOT
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_mov_i32(cpu_delayed_cond, cpu_sr_t);
         ctx->delayed_pc = ctx->base.pc_next + 4 + B7_0s * 2;
-        ctx->envflags |= DELAY_SLOT_CONDITIONAL;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT_COND;
 	return;
     case 0x8800:		/* cmp/eq #imm,R0 */
         tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_t, REG(0), B7_0s);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x0023:		/* braf Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->base.pc_next + 4);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x0003:		/* bsrf Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
 	tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr);
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x4015:		/* cmp/pl Rn */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     case 0x402b:		/* jmp @Rn */
 	CHECK_NOT_DELAY_SLOT
 	tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x400b:		/* jsr @Rn */
 	CHECK_NOT_DELAY_SLOT
         tcg_gen_movi_i32(cpu_pr, ctx->base.pc_next + 4);
 	tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8));
-        ctx->envflags |= DELAY_SLOT;
+        ctx->envflags |= TB_FLAG_DELAY_SLOT;
 	ctx->delayed_pc = (uint32_t) - 1;
 	return;
     case 0x400e:		/* ldc Rm,SR */
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
     fflush(stderr);
 #endif
  do_illegal:
-    if (ctx->envflags & DELAY_SLOT_MASK) {
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
  do_illegal_slot:
         gen_save_cpu_state(ctx, true);
         gen_helper_raise_slot_illegal_instruction(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void _decode_opc(DisasContext * ctx)
 
  do_fpu_disabled:
     gen_save_cpu_state(ctx, true);
-    if (ctx->envflags & DELAY_SLOT_MASK) {
+    if (ctx->envflags & TB_FLAG_DELAY_SLOT_MASK) {
         gen_helper_raise_slot_fpu_disable(cpu_env);
     } else {
         gen_helper_raise_fpu_disable(cpu_env);
@@ -XXX,XX +XXX,XX @@ static void decode_opc(DisasContext * ctx)
 
     _decode_opc(ctx);
 
-    if (old_flags & DELAY_SLOT_MASK) {
+    if (old_flags & TB_FLAG_DELAY_SLOT_MASK) {
         /* go out of the delay slot */
-        ctx->envflags &= ~DELAY_SLOT_MASK;
+        ctx->envflags &= ~TB_FLAG_DELAY_SLOT_MASK;
 
         /* When in an exclusive region, we must continue to the end
            for conditional branches.  */
-        if (ctx->tbflags & GUSA_EXCLUSIVE
-            && old_flags & DELAY_SLOT_CONDITIONAL) {
+        if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE
+            && old_flags & TB_FLAG_DELAY_SLOT_COND) {
             gen_delayed_conditional_jump(ctx);
             return;
         }
         /* Otherwise this is probably an invalid gUSA region.
            Drop the GUSA bits so the next TB doesn't see them.  */
-        ctx->envflags &= ~GUSA_MASK;
+        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
 
         tcg_gen_movi_i32(cpu_flags, ctx->envflags);
-        if (old_flags & DELAY_SLOT_CONDITIONAL) {
+        if (old_flags & TB_FLAG_DELAY_SLOT_COND) {
 	    gen_delayed_conditional_jump(ctx);
         } else {
             gen_jump(ctx);
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
     }
 
     /* The entire region has been translated.  */
-    ctx->envflags &= ~GUSA_MASK;
+    ctx->envflags &= ~TB_FLAG_GUSA_MASK;
     ctx->base.pc_next = pc_end;
     ctx->base.num_insns += max_insns - 1;
     return;
@@ -XXX,XX +XXX,XX @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
 
     /* Restart with the EXCLUSIVE bit set, within a TB run via
        cpu_exec_step_atomic holding the exclusive lock.  */
-    ctx->envflags |= GUSA_EXCLUSIVE;
+    ctx->envflags |= TB_FLAG_GUSA_EXCLUSIVE;
     gen_save_cpu_state(ctx, false);
     gen_helper_exclusive(cpu_env);
     ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
                   (tbflags & (1 << SR_RB))) * 0x10;
     ctx->fbank = tbflags & FPSCR_FR ? 0x10 : 0;
 
-    if (tbflags & GUSA_MASK) {
+#ifdef CONFIG_USER_ONLY
+    if (tbflags & TB_FLAG_GUSA_MASK) {
+        /* In gUSA exclusive region. */
         uint32_t pc = ctx->base.pc_next;
         uint32_t pc_end = ctx->base.tb->cs_base;
-        int backup = sextract32(ctx->tbflags, GUSA_SHIFT, 8);
+        int backup = sextract32(ctx->tbflags, TB_FLAG_GUSA_SHIFT, 8);
         int max_insns = (pc_end - pc) / 2;
 
         if (pc != pc_end + backup || max_insns < 2) {
             /* This is a malformed gUSA region.  Don't do anything special,
                since the interpreter is likely to get confused.  */
-            ctx->envflags &= ~GUSA_MASK;
-        } else if (tbflags & GUSA_EXCLUSIVE) {
+            ctx->envflags &= ~TB_FLAG_GUSA_MASK;
+        } else if (tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
             /* Regardless of single-stepping or the end of the page,
                we must complete execution of the gUSA region while
                holding the exclusive lock.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
             return;
         }
     }
+#endif
 
     /* Since the ISA is fixed-width, we can bound by the number
        of instructions remaining on the page.  */
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
 #ifdef CONFIG_USER_ONLY
-    if (unlikely(ctx->envflags & GUSA_MASK)
-        && !(ctx->envflags & GUSA_EXCLUSIVE)) {
+    if (unlikely(ctx->envflags & TB_FLAG_GUSA_MASK)
+        && !(ctx->envflags & TB_FLAG_GUSA_EXCLUSIVE)) {
         /* We're in an gUSA region, and we have not already fallen
            back on using an exclusive region.  Attempt to parse the
            region into a single supported atomic operation.  Failure
@@ -XXX,XX +XXX,XX @@ static void sh4_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
-    if (ctx->tbflags & GUSA_EXCLUSIVE) {
+    if (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) {
         /* Ending the region of exclusivity.  Clear the bits.  */
-        ctx->envflags &= ~GUSA_MASK;
+        ctx->envflags &= ~TB_FLAG_GUSA_MASK;
     }
 
     switch (ctx->base.is_jmp) {
-- 
2.34.1